Glossary
BusinessProxy terms in plain language
Definitions for the terms used across this site, kept consistent with how the product actually works.
- Managed Web Access Gateway
- The top-level product category: verified, scoped, logged and revocable sessions to selected web apps. It spans portal-launched Private App Access and extension-based Managed Browser Access.
- Industry mapping
- BusinessProxy is closest to application-scoped access for selected web apps plus managed browser access for work browsing. It is intentionally narrower than a full remote-access or SSE platform.
- Managed Browser Access
- One product line within the gateway: policy-governed browser sessions delivered through the BusinessProxy browser extension.
- Partner Access
- The partner model: SaaS, ERP, hosting and integrators give their own clients managed access to private apps and customer environments — apps, connectors, users, reports and billing under one partner account.
- Free Work Demo
- The free tier: a controlled work-access demonstration for approved domains or a demo app — never general internet access.
- Browser extension
- The required client: a browser extension for supported desktop browsers that configures browser proxy settings and answers proxy-auth challenges. It does not read or modify page content.
- Browser-proxy path (Layer 1)
- Browser traffic routed through the managed proxy by the extension. HTTPS content is not decrypted; filtering is by domain, category and policy only.
- Private App Access
- The product path that publishes selected internal web apps through public HTTPS addresses, portal-launched sessions and a customer-run connector.
- Private app path (Layer 2)
- The Private App Access web-layer route. It relays the HTTP request and response (method, path, query, headers and bodies) in transit. Bodies are not logged or retained.
- L7 / Layer 7
- The application (HTTP) layer. An L7 reverse proxy sees method, path, headers and bodies — unlike the Layer-1 browser path, which does not decrypt HTTPS content.
- Connector
- A small process you run inside your own network. It dials out to BusinessProxy over TLS, holds a tunnel, reaches the internal app address and relays requests. No inbound ports.
- Internal app address
- The real internal web app the connector forwards requests to. Its hostname and IP never leave your network.
- Public app address
- The external HTTPS hostname users open instead of the internal address.
- Tunnel
- The persistent outbound connection from the connector to the gateway over which internal app requests are multiplexed. If it is down, access closes.
- Workspace
- The tenant boundary for users, devices, policy, sessions and audit. Policy is set per workspace.
- Roles
- Workspace membership roles: member, admin and billing. The workspace creator is the owner. SSO/SAML and SCIM are Enterprise/contact-only.
- Routing policy
- Backend-issued policy that tells the extension whether to use proxy_all, work_only or private_app_only.
- proxy_all
- Routing mode where browser traffic goes through the generated PAC proxy except local, control-plane, update and bypass entries.
- work_only
- Routing mode where approved work domains and published internal web apps use BusinessProxy while everything else goes direct (implemented through browser routing policy).
- private_app_only
- Routing mode where only published Private App browser hosts, including local names such as crm.acme.internal, use the proxy; ordinary sites stay direct.
- PAC
- Proxy Auto-Configuration: a script the browser uses to decide per request whether to proxy or go direct.
- Bypass list
- Domains or hosts that always go direct, never through the proxy.
- Egress
- The point and region where proxied traffic exits BusinessProxy to the public internet; the region is selected from the plan options.
- Proxy session credentials
- Random, short-lived per-session secrets (about a 2-minute TTL) that the extension auto-rotates. They are stored server-side only as a one-way keyed digest, never as reusable plaintext, and are separate from your account password.
- Keyed digest
- A server-side one-way HMAC-style value used to validate the random proxy session secrets. It is not a human-password hash.
- TTL
- Time-to-live: how long a credential or session stays valid before it must be reissued (proxy credential about 2 minutes; private-app session default 60 minutes, max 480).
- Device key
- A per-device ECDSA P-256 key the extension uses to sign proxy-session requests.
- Heartbeat
- A periodic liveness signal from the extension or connector; it drives session renewal and connector readiness.
- Category list
- The versioned category feed used for domain and category decisions, combined with workspace allow/deny rules.
- Quota
- Per-plan fair-use limits. Plans are priced per seat, not by traffic; quotas are a technical guardrail, not the unit of value.
- SASE
- Secure Access Service Edge — large cloud platforms that combine networking and security. BusinessProxy is intentionally lighter and scoped to the browser, not a SASE replacement.
- Unmanaged-device boundary
- On unmanaged devices BusinessProxy governs only the browser profile and path where the extension is installed and enabled; enforced control requires validated customer-managed browser or device policy. It is not tamper-proof endpoint control.
- Content protection
- Optional per-app controls on the Private App path: a dynamic watermark plus copy, print and screenshot deterrents. They reduce casual leakage risk but do not replace DLP.