EU endpoint web blocks
without the black box.

• Category policies

  Block UT1 content categories per Environment — adult, gambling, malware, AI chat tools, and more.

• Allow and block lists

  Tenant-wide allowlists override category blocks; blocklists add domains on top of threat feeds.

• Threat indicator feeds

  URLhaus, OpenPhish, and PhishTank domains ship in an ed25519-signed bundle refreshed every 15 minutes.

• Local block page

  Blocked DNS queries sinkhole to 127.0.0.1 with the domain, category, and source feed on screen.

• False-positive review

  Users submit a review request from the block page; Console operators decide with the original policy reason attached.

• Device reporting

  Every block writes a JSONL audit record on the endpoint and posts to the Console block feed in managed mode.

1. 1

   Start the trial

   Enter your work email and company on the Spot Suite buy page, choose where your data is stored, then add a card at Stripe checkout.

   Enlarge Enlarge
2. 2

   Wait for setup

   Setup takes about 5 to 10 minutes; it took 7 in our test. The welcome email with your sign-in link arrives right after checkout.

   Enlarge Enlarge
3. 3

   Sign in

   Open the link in the welcome email and sign in to the Console with your Spot Suite account.

   Enlarge Enlarge
4. 4

   Install the agent

   Rotate the enrollment key, download the Windows or Linux agent, and run the install command on each computer.

   Enlarge Enlarge
5. 5

   See your computers

   Each enrolled computer appears under Devices with its name, platform, last check-in and number of blocks.

   Enlarge Enlarge
6. 6

   Choose what to block

   Malware, phishing, botnets and stalkerware are always blocked. Tick extra categories such as gambling, online games or AI chat. Computers pick up the change at their next policy refresh, every 15 minutes by default.

   Enlarge Enlarge
7. 7

   Users see why

   A blocked site shows a block page with your company name and the reason, and the user can ask IT to review it from there.

   Enlarge Enlarge
8. 8

   Watch the dashboard

   The dashboard counts devices, recent blocks and open reviews, and lists each block with the site and the reason.

   Enlarge Enlarge
9. 9

   Review reported blocks

   Review requests wait under Reviews, where you mark each one allowed, reject it or ignore it.

   Enlarge Enlarge

Founding offer: 50% off your first 2 paid months after the 30-day trial.

• Where is tenant data stored?

  Policy, block events, and enrollment records live in the shared EU Supabase Postgres project (Paris) for trials and shared data, or in a paid workspace's own Supabase project in the region chosen at purchase, behind a Cloudflare Worker dedicated to your workspace. Threat indicator bundles are signed at the edge and pulled by agents. There is no third-party DNS proxy in the path.

• Does ClearScreen support SSO?

  Yes, on the Business plan: Microsoft Entra ID single sign-on through Spot Suite OIDC at spot-cloud.spot-suite.com. Every plan signs in with a Spot Suite account. Device agents authenticate with per-device enrollment credentials, not user passwords.

• Do you decrypt TLS traffic?

  No. ClearScreen enforces at DNS only. Blocked domains resolve to a local sinkhole and show a block page — there is no TLS inspection, PAC file, or network gateway in the policy path.

• How does the 30-day trial work?

  Card checkout includes a 30-day free trial per Environment. Invoice billing is available (paid from day one; no trial on invoice). Run managed mode for up to 100 endpoints. Category policy, block reporting, and audit export are included. Convert to Team when you are ready.

• Secure file exchange Move files over SFTP, S3, Azure Blob and more, with a custody record per transfer. xevolve.io Open
• Cloud cost and forecasts Daily spend from AWS, Azure, GCP and StackIT, with anomalies flagged before the close. Join waitlist
• TLS certificate lifecycle Find every certificate, renew it through ACME, and deploy it where it runs. automate-certificates.com Open
• IP address management Plan CIDR blocks across Azure tenants and catch conflicts before they ship. Join waitlist
• Joiner, mover, leaver Onboard, move and offboard staff in Microsoft 365 or Google Workspace, with a log. Join waitlist
• UBO and sanctions screening Screen owners and counterparties against UBO and sanctions lists. Join waitlist