Secure the micro perimeter, The Browser.
SASE controls the network. Your IdP handles login. Neither controls what users actually do after they're in. Spirex sits in the browser execution path and enforces real-time policies on every user action - without replacing your stack, your browser, or your VPN.
System Architecture
How every session flows end to end.
From the device in a coffee shop to the database in your datacenter — here's every hop.
Between your users and every SaaS app they touch.
Traditional security tools secure the wire or the login. Spirex secures the session - the space between authentication and the action. It operates alongside your existing SASE platform and identity provider, extending your security stack into the browser without replacing anything.
Spirex Admin Console
The single source of truth for every policy, user, and published application. Admins define rules once and they propagate to every enrolled browser instantly - no manual rollout, no endpoint agents to update.
Spirex Browser Enforcement Runtime
The Spirex browser runtime translates cloud policy bundles into live, per-tab enforcement decisions - before any navigation request reaches the network.
In-Page Security Engine · Threat Detection · DLP Controls
Code injected into every tab that monitors DOM mutations, intercepts credential submissions, scores page risk in real time, and enforces DLP controls at the point of data contact - inside the page itself.
Zero Trust access to private apps. Zero attack surface.
Spirex ZTNA publishes private applications through the cloud broker without putting them on the public internet. Access is identity-gated at the control plane before a tunnel is even attempted.
Admin publishes an app
The private application's internal host and connector are registered in the cloud admin console. No firewall rules changed.
Browser pulls the app catalog
On login and every sync cycle, the browser receives the list of published hosts the authenticated user is allowed to reach.
Local proxy starts
ztna-client.js opens an HTTP CONNECT proxy on an ephemeral localhost port. A PAC script routes only published-app traffic through it.
Tunnel token issued
The control plane requests a short-lived tunnel token from the cloud for each matching private host. Tokens are scoped to the session.
WebSocket tunnel opens
A WebSocket tunnel connects the browser-side proxy to the cloud broker, which relays to the on-premises connector and then to the private app.
Policy still applies
The ZTNA tunnel is a transport layer only. Navigation through it is still subject to the full policy stack - access can be revoked at any point from the admin console.
How Spirex authenticates and authorises every session.
The authorisation code flow with PKCE means no client secret is embedded in the browser. Even if an auth code is intercepted, it cannot be exchanged without the original verifier - which never leaves the session.
Every access token is verified for TLS integrity, cryptographic signature validity, issuer, audience, and expiry before any request is forwarded. Expired or tampered tokens are rejected immediately - no grace windows.
Proving who you are does not automatically grant access. A verified identity is passed to the Spirex policy engine, which evaluates the specific resource and action requested against the user's assigned policies - separately from the IdP.
The protected application only ever receives requests that have passed both authentication and policy authorisation. For private apps via ZTNA, the application is not reachable on the public internet at all - the tunnel exists only after authorisation is confirmed.
Not an extension. Not a proxy. Enforcement in the execution path.
Browser extensions operate at the UI layer. Users can disable them, switch browsers, or open an incognito session to work around them. Spirex is different - enforcement is built into the browser session itself, managed centrally, and cannot be disabled by end users.
Security does not depend on users keeping anything enabled.
Extend your security stack into the browser.
No rip-and-replace. No new browser. Deploy alongside your existing SASE and IdP in hours.