SecurSpaces Flex overview

Last published : Oct 20, 2026
Citrix SecurSpaces™ Flex is a Citrix-managed service within Citrix Platform Flex that delivers secure Linux workspaces for development teams. Delivered through Citrix Cloud, this service provides hosted developer environments on Azure with no customer infrastructure to stand up or maintain. Citrix runs the platform and the underlying Azure infrastructure; customers retain control of identity, workspace images, policies, and data.
Citrix SecurSpaces Flex includes:
  • Citrix-managed hosting of developer workspaces on Azure, with a control plane built on Azure Kubernetes Service (AKS) and Azure Cosmos DB.
  • Isolated, sandboxed Linux workspaces accessible via browser (PWA-based IDE or terminal), SSH from local IDEs such as VS Code, JetBrains Gateway, Cursor, or Windsurf, or a customer-built application experience.
  • Workspace sizing by persona - Light, Medium, and Heavy - each mapped to a published Platform Flex credit rate.
  • Citrix-managed workspace size tiers, so compute profiles stay aligned with the Flex service catalog.
  • Decoupled workspace size and workspace template, so a single template can be paired with any compute profile on demand.
  • Native data loss prevention (DLP), controlled ingress and egress, role-based access control (RBAC), and full audit logging.
  • Sandboxed execution environments for AI coding agents under the same control plane as human developer sessions.
  • Compatibility with Citrix DaaS Flex, with both services drawing from a shared Platform Flex credit pool.
Citrix SecurSpaces Flex deployments are planned and provisioned by Citrix. To get started, contact your Citrix sales team or your Citrix SecurSpaces Solution Specialist.
Related information
About SecurSpaces

Concepts and terminology

This section defines the terms that administrators frequently use in Citrix SecurSpaces Flex.

Deployment

A deployment is the provisioned instance of Citrix SecurSpaces Flex for your organization. It consists of a primary Azure region, a custom access URL, and an initial local administrator account. Citrix provisions and manages your deployment for you. Each organization has one deployment; additional Azure regions can be added as secondary regions after deployment.

Primary region

The primary region is the Azure region where the Citrix SecurSpaces Flex control plane and primary execution capacity are hosted. You agree the primary region with your Citrix team during implementation planning. The primary region cannot be changed after provisioning is complete.

Secondary regions

Secondary regions are additional Azure regions added to an existing deployment to extend workspace capacity, bringing capacity closer to distributed development teams. To add or remove a secondary region, contact your Citrix team.

Access URL

The access URL is the custom subdomain assigned to your organization's Citrix SecurSpaces Flex environment, in the format https://<yourcompany>.flex.sds.citrix.com. You choose the subdomain with your Citrix team during implementation planning. Developers and administrators use this URL to access the Citrix SecurSpaces environment.

Workspace

A workspace is an isolated, sandboxed Linux container that provides a secure development environment for a developer or AI agent. Each workspace runs on the Citrix SecurSpaces Flex execution plane with defined vCPU, RAM, and persistent storage. Persistent state is backed by Kubernetes Persistent Volume Claims (PVCs), so multi-project and multi-repository work survives between sessions. Workspaces can be accessed through a browser, SSH, or a supported local IDE.

Workspace template

A workspace template is a pre-configured, version-controlled definition that includes the container image, preinstalled tools, resource limits, access controls, and startup scripts. Templates are the primary unit of deployment in Citrix SecurSpaces Flex. The customer owns and hosts the container images; Citrix hosts and runs the platform that executes them. Because workspace size and workspace template are decoupled, a single template can be paired with any workspace size on demand. See Workspace templates for more information.

Workspace size

Workspace size is the compute profile assigned to a workspace. Each size maps to a defined vCPU and RAM configuration with a published Platform Flex credit rate. The available workspace sizes at launch are:
Size vCPUs RAM Storage Intended workload
Developer (Light) 2 vCPUs 8 GB 32 GB General coding and routine development work
Developer (Medium) 4 vCPUs 16 GB 64 GB Mixed workloads
Developer (Heavy) 8 vCPUs 32 GB 128 GB Large builds, compilations, and demanding data workloads
Workspace size and workspace template are configured independently. Because they are decoupled, organizations can reuse a single template across workspaces of different sizes, and developers can switch compute profiles as workload demands change.
Citrix manages the workspace size definitions in Flex. Each size belongs to a managed tier and can have newer versions over time. Administrators control where a tier is available, but they do not edit the CPU, RAM, storage, or storage-class values that define the tier. When Citrix publishes a newer version of a tier, affected workspaces can be updated to the current version of the same tier.

Platform Flex credits

Platform Flex credits are the consumption unit for Citrix Platform Flex services. Citrix SecurSpaces Flex workspaces consume credits based on workspace size and daily usage. The same credit pool covers other Platform Flex services, including Citrix DaaS Flex, so developers can use a DaaS Flex virtual desktop for general tasks and a Citrix SecurSpaces Flex workspace for development — both tracked through a single unified credit model with no separate procurement cycle. See Licensing for Citrix Platform Flex and Platform Flex credit consumption and reporting for more information.
Availability of Citrix Platform Flex services, and the service credit remedy if Citrix misses a commitment, are covered by the Platform Flex SLA.

Network connectivity

Citrix SecurSpaces Flex workspaces connect to customer-owned systems through a shared Azure virtual network (vNET) peering or VPN gateway between the Citrix-managed Azure tenant and the customer network. This integration layer enables workspace access to customer-managed identity providers, Git repositories, artifact repositories, CI/CD pipelines, data sources, and secrets managers. See Network connections for more information.

All SecurSpaces Flex documentation

Flex articles sit in the section that matches what they are for, so they are not adjacent in the contents pane. This is the full set, along with the Platform Flex service level agreement, which is published with the Citrix Platform Flex documentation.
Article What it covers
Technical security overview The security architecture of the Citrix-managed service: tenancy, data residency, encryption, and the shared responsibility split
Network connections How Flex workspaces reach your identity provider, repositories, and other customer-owned systems
Workspace templates The templates available in Flex, and what each one provides
What's new in SecurSpaces Flex Release notes for the Flex service
Platform Flex SLA The availability commitment for Platform Flex services, and the service credit remedy
Everything else in this documentation applies to Flex as well, except where a page says otherwise. Flex is a deployment model for Citrix SecurSpaces™ rather than a separate product, so the developer, project, and platform articles describe the same environment.

More information