Working in Workspaces
A workspace is where day-to-day work happens in Enprivacy. Each workspace is an isolated tenant environment: it imports the content sources and database hosts it cares about, detects and scores sensitive data in them, applies redaction plans, and hosts AI chats that work over everything in the workspace. In the product’s own words: “Workspaces are the core of your organization’s data management. They help you to organize your data, explore and transform document and data, report on outcomes, and collaborate with your team.”
You only see workspaces you have been granted access to. Access is granted by administrators through teams — see the Admin workspace for how the access model works.
Finding your workspaces
Section titled “Finding your workspaces”Signing in lands you on the All workspaces page (also reachable any time from the workspace picker’s All workspaces link). Each workspace you can reach appears as a card showing its name, a green Granted pill, counts of its sources, databases, and teams, and two ways in:
- Enter workspace — opens the workspace’s Overview page.
- An ask-bar — “Ask anything about this workspace’s data…” — with suggested starter questions such as “Where is personal data in this workspace?”. Typing here (or choosing a suggestion) takes you straight into a new chat in that workspace.
If you have no workspaces yet, your administrator can grant access. Below the cards, an Other places in Enprivacy grid links to the System areas (Admin, Estate, Library) you can access.
Navigating inside a workspace
Section titled “Navigating inside a workspace”The top bar carries the workspace navigation:
| Item | What it is |
|---|---|
| Overview | The workspace home — health, triage actions, and recent activity |
| Topology | A graph of how data flows and derives across the workspace |
| Content | Document and email sources imported into the workspace |
| Databases | Database hosts imported into the workspace |
| AI | The AI dashboard — chats, models, providers, and usage |
Content, Databases, and AI only appear when the corresponding feature is enabled for your deployment.
On the right-hand side of the top bar: a Search pill (⌘K), a Chat button (⌘J) that jumps to your chats, a help link to this documentation, notifications, and your avatar menu. The workspace picker (the pill on the left) switches between workspaces and the System areas.
Some surfaces are not on the top-bar strip and are reached from the Overview header or the Manage page instead: Workflows, Manage, and the Manage sub-sections described below.
Overview
Section titled “Overview”The workspace home page is a triage console: a verdict and health summary for the workspace, a feed of suggested triage actions, and recent audit events. The header offers three actions — Workflows, Manage, and Run First Setup — plus a “What are workspaces?” help popover.
Content
Section titled “Content”Path: Content in the top bar
Everything document-shaped in the workspace. The section has two tabs:
- Overview — a health verdict for the workspace’s content plus its highest-risk sources, ranked by risk tier.
- Sources — the sources imported into this workspace, with name, risk, item count, status, kind, and import date.
Sources live in the organisation-wide Estate catalogue; a workspace imports a source to bring it into its own relevance set. Choose Import a source to browse “every kept content source you’re allowed to read” and Import the ones this workspace needs. Importing creates a source link — the workspace’s own scoped view of that source. The same source can be imported by many workspaces, and removing the link removes it from this workspace without affecting the source itself.
Opening a source shows its items. Each item page has four tabs — Overview, Analyses, Transformations, Artefacts — covering the original content, what the detectors found, how it was redacted or transformed, and the outputs produced, along with its tags and a provenance graph. A New analysis action re-runs analysis on the item.
Where permitted, you can also upload documents directly through a source link; uploads require a separate permission and land in the workspace’s default uploads repository.
Databases
Section titled “Databases”Path: Databases in the top bar
The same pattern for structured data. Two tabs — Overview (health and risk) and Hosts (the database hosts imported into the workspace). Choose Import a host to import from the estate catalogue; the imported host surfaces its full schema tree — schemas, tables, and columns — along with sample sets, records, and schema snapshots, so you can see exactly where sensitive columns live. Sampling actions (resample, sample values) and manual schema/sample uploads are available where permitted.
Path: AI in the top bar
The AI dashboard shows the workspace’s AI posture over a selectable window (7/30/90 days): risk reduction over time (redacted versus still exposed), category breakdowns, transformation impact, and a triage list of exposed chats, with tabs for Overview, Chats, Models, Agents, Credentials, and Users.
Two configuration surfaces here matter before anyone can chat:
- AI providers — link a provider to set the workspace’s default credential and plans.
- AI models — link at least one chat-capable model. A model link is “the chat-creation clamp — without one, chats against that model can’t be started.”
The chat experience itself has its own page: Chats and the AI Assistant.
Topology
Section titled “Topology”A live provenance graph of the workspace: sources, items, analyses, transformations, and their relationships, so you can trace where any piece of data came from and what was derived from it.
Search
Section titled “Search”Path: the Search pill (⌘K)
Hybrid search across the workspace: “Search documents, task runs, sources, and tags across this workspace by name, identifier, or content.”
Workflows
Section titled “Workflows”Path: Overview header → Workflows
Every analysis and processing run in the workspace, with per-run task detail. Failed runs can be retried — Re-run failed retries every failed task across all runs, and each run’s page allows re-running individual tasks.
Manage
Section titled “Manage”Path: Overview header → Manage
The workspace settings hub: “Everything wired up for this workspace — imports, detection, plans, reports, labels, connections, and access.” It opens with workspace-health warnings (teams without a role, orphaned source or host links, providers without models) and counts of teams, members, categories, plans, entities, and tags, then groups its surfaces:
| Group | Surfaces |
|---|---|
| Data | Sources, Database hosts, Library books (import shared reference books into the workspace) |
| Detection | Categories (estate-wide definitions), Category scoring (this workspace’s overrides), Entities |
| Plans | Analysis Plans (estate-wide, read-only here), Transformation Plans (owned by this workspace) |
| Reports | Residual risk — findings by category, top exposed sources, top exposed chats |
| Labels | Tags |
| Connections | Credentials (estate-wide catalogue), API keys (this workspace’s inbound keys) |
| Access | Teams and Members tables — who reaches this workspace and through which teams and roles |
Notes on the pieces you’ll touch most:
- Analysis plans vs transformation plans. An analysis plan decides what is detected — which categories and detectors run. Analysis plans are defined estate-wide. A transformation plan decides what happens to detected data on the way out — redaction, substitution, masking — and is owned and edited by the workspace (New transformation plan under Manage → Plans).
- Category scoring. Sensitivity categories are defined estate-wide, but each workspace can re-weight how they score. Overrides are per-axis, and each carries a Reset back to the estate default.
- API keys. Inbound keys for calling this workspace programmatically, plus registered vendor pass-through keys. Keys can be revoked (kept for audit) rather than deleted. These are distinct from the outbound vendor credentials managed in Estate.
- Teams. Adding or removing a team here is the same grant that administrators make from the Admin workspace — each team row links to its admin page.
First-run setup
Section titled “First-run setup”Creating a workspace (from the Admin workspace catalogue) collects a name, description, and default chat plans, then runs first setup automatically in the background — there is no wizard to walk through. Setup creates the workspace’s internal storage (a redacted repository and an uploads repository, each pre-imported as a source), a Default Transformation Plan, and a Chat Transformation Plan. The default chat analysis plan is chosen on the create form and defaults to the estate Lite plan.
After that, a new workspace typically needs three things before it is fully usable: at least one team attached (so people can reach it), at least one AI model linked (so chats can start), and its first sources or hosts imported. The Overview’s triage console and the Manage health tiles point out whatever is missing. Run First Setup in the Overview header re-runs the setup flow safely at any time.
Permissions
Section titled “Permissions”As everywhere in Enprivacy, what you can see and do in a workspace is determined by the permissions your teams’ roles grant. Broadly: viewing Content or Databases requires the estate-level source/host view permissions; importing and removing links, uploading through links, editing transformation plans, category scoring, API keys, reports, and AI provider/model links each have their own workspace.* permission; and chats require workspace.chat:create to start and are otherwise private to their owner. If a section or button is missing for you, ask your administrator — the Admin workspace is where those grants are made.