Product documentation
Citrix SecurSpaces™
View PDF

Technical security overview for SecurSpaces Flex

This article describes the security architecture, shared responsibility model, data handling practices, and compliance posture of Citrix SecurSpaces™ Flex. It is intended for security teams, procurement reviewers, and CISOs evaluating the service.

Architecture overview

Citrix SecurSpaces Flex is built on three layers:

Layer Description Operated by
Control plane Manages workspace provisioning, access, policies, and lifecycle. Built on Azure Kubernetes Service (AKS) and Azure Cosmos DB. Citrix
Execution plane Runs isolated, sandboxed Linux workspaces. Each workspace is a containerized environment with defined vCPU, RAM, and persistent storage. Citrix
Integration layer Connects workspaces to customer-owned systems: identity providers, Git repositories, CI/CD pipelines, secrets managers, and data sources. Customer + Citrix (connectivity infrastructure)

All components run inside Citrix-managed Azure subscriptions in the Azure regions agreed for your deployment. The customer’s application data, container images, secrets, and identity configuration remain under customer ownership and control.

Shared responsibility model

Citrix SecurSpaces Flex uses a clear division of responsibilities between Citrix and the customer across configuration and management, infrastructure, and ongoing support.

Configuration and management

Customer Citrix
Workspace image hosting and management Citrix SecurSpaces platform configuration and updates
Workspace and template management Citrix SecurSpaces region management (upon request)
User accounts, access, and permissions Platform-wide Citrix SecurSpaces configurations
Organizations, projects, and secrets Workspace specifications
Network policies and security monitoring Backups, DR planning, and availability monitoring

Infrastructure

Customer Citrix
Authentication (IdP) Azure AKS, Cosmos DB, and Azure tenant
Source code repositories Landing zone VM
Artifactories Citrix SecurSpaces control plane scaling (up/down)
Azure vNET peering / VPN gateway (shared) Azure vNET peering / VPN gateway (shared)

Ongoing support

Customer Citrix
End-user support Citrix SecurSpaces and Azure infrastructure support
  Citrix SecurSpaces product support

Note: Azure vNET peering and the VPN gateway are a shared responsibility. Citrix provisions and operates the Citrix-managed side of the connection; the customer configures and maintains their side. See Network connections for details.

Workspace isolation

Each workspace is an isolated, sandboxed Linux container. Isolation is enforced at the Kubernetes runtime level.

  • No shared file systems between workspaces. Each workspace has its own Persistent Volume Claim (PVC) for persistent state.
  • No lateral movement. A compromised workspace cannot access other workspaces or the control plane.
  • Controlled ingress and egress. Workspace network traffic is subject to policy-defined rules. Egress to the internet and to customer networks is controlled; unrestricted outbound access is not the default.
  • AI agent containment. AI coding agents run inside the same workspace sandbox as human sessions. Agent processes are subject to the same egress controls, DLP rules, and audit logging as any other workspace activity.

Data loss prevention (DLP)

Citrix SecurSpaces Flex includes built-in DLP controls.

  • Clipboard DLP — Clipboard operations between the workspace and the user’s local device are policy-controlled. Administrators can restrict or monitor copy/paste behavior.
  • Session monitoring — Workspace activity can be subject to session recording and behavioral monitoring for compliance and forensic purposes.
  • Audit logging — All administrative and developer actions generate audit log entries. Logs are retained and exportable for SIEM integration.

Data residency and encryption

Data residency

Workspace execution runs in the Azure region designated as your primary region, and in any secondary regions provisioned for your deployment. Citrix does not transfer workspace data across regions outside of the regions agreed for your deployment.

Customer-owned assets — container images, secrets, source code, identity configurations — remain in customer-owned infrastructure and are not replicated into Citrix-managed systems except as required for workspace execution (for example, pulling a container image at workspace launch).

Encryption

  • In transit — All communication between workspace clients and the platform uses TLS 1.2 or higher. Communication between internal platform components is encrypted.
  • At rest — Persistent workspace storage (PVCs) is encrypted at rest using Azure-managed encryption keys. Control plane configuration data stored in Cosmos DB is encrypted at rest.

Role-based access control (RBAC)

Citrix SecurSpaces Flex enforces role-based access at the platform level.

  • Administrators manage deployments, workspace templates, user access, and policy configuration.
  • Developers access workspaces assigned to them. They cannot access other developers’ workspaces or administrative functions.
  • Roles and permissions are managed in the Citrix SecurSpaces console and integrated with the customer’s IdP.

More information

Technical security overview for SecurSpaces Flex

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.