TotalHealSurfGuardSecure Web Gateway (SWG)
Every web request your people make, checked against their own policy — malware, phishing, your threat intelligence and about 57 content categories — in the TotalHeal cloud or on a proxy in your office.
Trial: 30 days, up to 25 people. You sign in to the TotalHeal console with a Sttiz account and activate SurfGuard SWG. No card.
Most attacks still start with a click: a phishing page that looks like the bank, a download from a look-alike site, a link in an SMS. DNS filtering stops many of them but sees only the name, not the person or the file, and gives the user no explanation. Content rules differ by team — the newsroom needs social networks, accounts does not — and when a site is blocked by mistake there is no simple way to ask for it.
SurfGuard is a secure web gateway. Browsers send their web traffic to it — the TotalHeal cloud proxy or a proxy in your office — and each person signs in with their e-mail and a proxy token. Every request is checked against that person’s policy: the security checks of DNSGuard first, then content categories, then your own lists. A blocked or warned site shows a page that says why, with a button to request access.
SurfGuard SWG, feature by feature.
A policy per person
Each person gets their own policy, the policy of the first group rule that matches, or the default. Allow, warn or block each content category; add sites to always allow or always block; turn on safe search for Google, Bing, YouTube and DuckDuckGo.
Security first
Malware and phishing hosts (URLhaus), your own threat intelligence, analyst blocks from incident response and look-alike domains of your brands and Indian banks are decided by the same engine as DNSGuard, before any category. Security blocks raise alerts in the incident queue with MITRE ATT&CK.
57 content categories
Adult, gambling, piracy, proxies and anonymisers, social networks, streaming, shopping, games, webmail and more — about 5 million domains from the Université Toulouse Capitole (UT1) lists, rebuilt daily. A site in several categories is decided by all of them.
Pages that explain
Blocked and warned sites show a page with the reason — on HTTPS too, when devices trust the organisation’s SurfGuard root. A warning lets the person continue for an hour; a block lets them request access with a reason.
Access requests
Requests arrive in the console with the site, its categories and the reason. Approve for that person only, or add the site to their policy’s allow list for everyone; the proxies have it within a minute.
TLS inspection
On the Professional tier, allowed HTTPS sites can be decrypted with the organisation’s root, except the categories and sites you exempt (online banking and finance by default), so the activity shows full addresses and downloads can be checked.
File types
On the Professional tier, downloads of chosen file types — exe, msi, apk, iso — are blocked, by name and by the file name the server sends.
Cloud or office
The TotalHeal cloud proxy serves people anywhere; on the Professional tier a self-hosted proxy runs in the office, where listed office networks need no sign-in. Both take the same signed policy and keep working on the last good one if the cloud cannot be reached.
Work hours
On the Elite tier, categories can be blocked only inside work hours — for example streaming and games from 09:30 to 18:30 on weekdays, in your time zone.
How SurfGuard SWG works.
SurfGuard checks every web request against the policy of the person who made it: the DNSGuard security engine first, then about 57 content categories, then your lists. Blocks explain themselves and can be appealed; approved sites reach every proxy within a minute.
- ConnectBrowsers take the PAC file; people sign in with their e-mail and a proxy token.
- DecideSecurity checks, content categories and your lists decide each request for that person’s policy.
- ExplainBlocked and warned sites show the reason; a warning can be continued for an hour.
- AskPeople request access from the page; an administrator approves for them or for the policy.
- RecordEvery block is logged and security blocks raise alerts in the incident queue.
Platforms and deployment
Platforms
| Platform | How it is covered |
|---|---|
| Browsers | Any browser that takes a PAC file or a proxy setting (Windows, macOS, Linux, ChromeOS, Android, iOS) |
| Self-hosted proxy | Linux x86-64 or arm64 with systemd (Professional) |
| Category data | Université Toulouse Capitole blacklists (UT1), CC BY-SA 4.0, rebuilt daily |
| Console | TotalHeal web console |
Deployment
| Profile | Status |
|---|---|
| SaaS | AvailableThe cloud proxy runs in the TotalHeal cloud; a self-hosted proxy runs in your office (Professional). |
| On-premises control plane | AvailableDelivered with our team from the on-premises kit. |
| Air-gapped | AvailableOffline kit, offline licence file and offline update bundles. |
Essential, Professional or Elite.
Priced per user per year. Counted: people who sign in to SurfGuard.
| Feature | EssentialUS$30per user per year | ProfessionalUS$54per user per year | EliteUS$78per user per year |
|---|---|---|---|
| Cloud proxy with a PAC file; each person signs in with their e-mail and a proxy token; policy by person, group rule or default | |||
| Malware, phishing, your threat intelligence, analyst blocks and typo-squats (the DNSGuard engine); your allow and block lists; safe search | |||
| About 57 content categories from the UT1 lists (5 million domains, updated daily): allow, warn or block each | |||
| Block and warning pages on HTTP and HTTPS (with the SurfGuard root trusted), continue for an hour, request access; approve for a person or a policy | |||
| Alerts from security blocks in the incident queue; activity search | |||
| TLS inspection with exempt categories and sites; full addresses in the activity | |||
| File-type blocking of downloads (exe, msi, apk …) | |||
| Self-hosted proxies in your office; office networks that need no sign-in | |||
| Work-hours rules: categories blocked only inside the hours, in your time zone | |||
| Activity kept 30 days (Essential), 90 days (Professional), one year (Elite) |
List prices per user per year; minimum 25 users. Each tier includes everything in the tier before it. Volume, multi-product and partner pricing on request.
SurfGuard is sold on its own, outside the editions.
Government profile. Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks.
What you need
- Browsers set to the SurfGuard PAC file (by Group Policy, MDM or TotalHeal UEM)
- The SurfGuard root trusted on devices for pages on HTTPS and for inspection
Procurement documents for SurfGuard SWG
The datasheet is public. The full dossier is sent on request, so we can match it to your tender.
- Datasheet. What the product does, platforms, deployment profiles, tiers and honest limits.
- Compliance matrix. Each requirement marked comply, partial or no, with an evidence reference — CERT-In directions, DPDP, ISO 27001 controls touched, accessibility of the console, data residency.
- Bill of materials. SKUs per sizing, the unit and quantity formula, customer-side components and services.
- Architecture and hardening. How the product is deployed and the hardening guidance for each component.
- SLA. Support tiers, response targets the team can meet, update cadence and end-of-life policy.
- OEM authorisation letter. A MAF template for resellers and system integrators, with product names exactly as on the SKU.
Works well with
Part of TotalHeal UnifiedEdge suite and of Complete — each product is still licensed on its own.
Get a quote for SurfGuard SWG.
Tell us how many users you need and how you want to deploy. We reply with a quote and the procurement documents you ask for.
Or email business@totalhealsecurity.com.