Secure Workspace is a desktop workspace shell, browser tabs and terminal tabs side by side, whose entire window, and every popup it spawns, is excluded from screen sharing and recording (Zoom, Meet, Teams, OBS) at the OS level. Not a blur filter or an app-switch discipline: the window itself never reaches the capture buffer.
Every window, including popups it spawns, is marked with the OS per-window capture-exclusion flag: SetWindowDisplayAffinity(hwnd, WDA_EXCLUDEFROMCAPTURE) on Windows 10 2004+, NSWindow.sharingType = .none on macOS. Zoom, Meet, Teams, and OBS all read from the same OS compositor, so all of them are blind to it at once, with nothing to configure per-tool.
Alpha, Beta, Gamma, Delta: a fixed hierarchy above groups. Each profile is a complete separate world, its own groups, tabs, cookies, storage, logins, and window state, so identically-named groups in two profiles never share a cookie jar.
Tabs in a group share cookies/localStorage/cache by default, log into a client's account once per group, while different groups stay fully isolated. Dial it to fully shared or fully per-tab instead, and choose persistent vs. in-memory sessions.
node-pty (ConPTY on Windows) backing an xterm.js view, rendered inline, so it's excluded from capture exactly like the browser tabs next to it. An optional start command (e.g. ssh host -t 'tmux new -As work') reattaches the same remote session every time the tab reopens, with reconnect-on-drop when it exits.
Groups, tabs, hotkeys, popup handling, and window behavior are all set from an in-app Settings panel, persisted per profile. Popups open contained as a protected in-app tab by default, or externally when you want a page in a real browser.
Linux capture exclusion is best-effort. Chromium's implementation is limited on X11/Wayland and is effectively a no-op on most compositors. The app runs fine there; the hide-from-share guarantee is a Windows/macOS property.
Google's own sign-in block isn't a UA check, and isn't defeated. accounts.google.com detects embedded frameworks like Chromium Embedded Framework, which Electron is built on, through signals beyond User-Agent spoofing. The app detects that rejection and offers a one-click open-in-system-browser escape hatch instead of claiming a fix that doesn't hold, but that browser has its own separate cookie jar, so the session doesn't carry back into the protected tab.
A UA spoof for the rest. Sites rejecting Electron's default User-Agent (WhatsApp Web and similar "unsupported browser" checks) are fixed by advertising a clean desktop-Chrome UA and normalized Sec-CH-UA, built from the real bundled Chromium version so it never overstates capability. A determined fingerprinter reading full Client-Hints entropy can still tell; the common browser-version checks pass.
Windows (NSIS installer + portable) and Linux (AppImage + .deb) builds run through a real CI pipeline. Distribution is direct rather than a public download page, ask Maya below and we'll get you a build.
Secure Workspace is how this practice keeps client browser and terminal sessions out of its own screen shares. Ask what it would take to get a build for your team.