Skip to main content
Corral · Beta

Block the web you don't want,on every managed device

Meet Corral, network filtering built into Appaloosa. Ads, trackers, phishing sites, gambling, adult content: decide what your managed phones and tablets can reach, from the console.

Corral runs on the device itself. No proxy, no cloud filtering, nothing for users to install.

Android 11 and later On-device, no cloud relay Managed from the console
Join the beta Book a demo
No entry sign on a yellow wall: Corral blocks unwanted traffic on managed devices

Highlights

Why filtering belongs in your MDM

Most fleets protect the device and forget the network it talks to. A phishing link in a text message, an ad network serving malware, a gambling site opened on a shared terminal: none of that is stopped by a passcode policy. Corral closes that gap with one policy, applied from the console you already use.

One Policy, Every Device

Pick a Level, Add Your Domains

Choose a protection level, from ads only to maximum, add the categories you care about (threats, gambling, social media, adult content) and your own block and allow lists. Apply it to a device group. Done in minutes.

Filtering Stays Local

Browsing Stays on the Device

Domains are checked on the device against lists it downloads from Appaloosa. No proxy, no cloud filtering: Corral never sends the sites people visit. It only reports a technical status to your MDM console (filtering active, health, list freshness), and anonymous crash reports if you turn them on. Known encrypted DNS bypasses (DoH, DoT) are blocked so the policy holds.

Nothing to Install

Enrolled Means Protected

The filter deploys with the device configuration. Users can't remove it or switch it off, and the services your MDM, app store and notifications depend on are never blocked.

How it works

How Corral works

No appliance, no VPN gateway, no extra account. The policy lives in your Appaloosa configuration and the device enforces it. Three steps.

  1. 01

    Choose

    Pick a protection level and the categories to block: threats, ads and trackers, gambling, social media, adult content, telemetry, newly registered domains and more.

  2. 02

    Adjust

    Add the domains your business needs to block, and the ones that must always work. Your lists come on top of the categories.

  3. 03

    Apply

    Assign the policy to a device group. Devices pick it up in seconds and start filtering, with a local log of what was blocked and why.

Where it makes the biggest difference

Frontline and Logistics

Handhelds and phones used on the road or in the warehouse only talk to the services your operations need. Fewer distractions, fewer phishing incidents, less data used on ads.

Shared Devices and Kiosks

A terminal used by many hands stays on task. Block what the device was never meant to reach, whatever the user tries, without touching the kiosk setup.

Employee Protection

Phishing links in text messages, fake login pages, malware served by ad networks: Corral stops the connection before the page loads, so a wrong tap on a company phone stays harmless.

Solutions built on this feature

Frontline workers Rugged, dedicated, remotely fixed.
Shared devices One device, many users, clean handover. Corporate device management Full control of company-owned devices.

They trust us

Get started

Be first to try Corral

Book a demo and get on the beta list.

Get started

Or talk to our sales team.

14-day free trial
Expert support

FAQ

Frequently asked questions about Corral

Employee using a managed smartphone with network filtering

Android 11 and later on Android Enterprise, on managed devices or COPE. Personal devices (BYOD) are not filtered. iOS is in development. macOS is not covered at launch.

No. Filtering happens entirely on the device. Corral only looks at DNS lookups (domain names) and the destination address of connections, to allow or block them. It never reads, inspects or decrypts the content of your connections: no TLS interception, no certificate installed. No browsing data is sent to Appaloosa or to any third party. The only exchanges are the device downloading the block lists, and the diagnostic report a user chooses to send to support. Activity logs stay on the device (they are purged after seven days on Android), and the console never receives the domains visited.

A technical status only, so you can see the filter is working (for example whether filtering is active or paused, and the health of the app). Never the sites people visit or any browsing history. Crash reports are off by default; the admin can turn them on, and they stay anonymous.

On Android, Corral is a local VPN on the device, declared as an always-on VPN and locked down by Android Enterprise: traffic is examined on the phone itself, no server is involved. Android allows only one active VPN per profile, so Corral takes that slot in the scope it filters (the whole device in fully managed mode, the work profile only in COPE) and cannot run alongside another corporate VPN in that scope. The configuration comes from the Appaloosa console, with no account and no third-party app.

The page simply doesn't load: the browser shows a connection error, with no warning page or redirection. The on-device app shows the protection status, the number of blocked requests and the latest events, with the domain and the list that blocked it.

No. The filter is deployed by the device configuration and can't be disabled or uninstalled by the user. Your support team can pause it for five minutes on the spot with an administrator code, for troubleshooting.

A DNS filter: it works at the domain level, globally on the device, not per app and not per URL. You can block gambling.example, not a single page on an allowed site. Known encrypted DNS providers (DoH, DoT) are blocked to prevent bypass.

In the on-device log, which lists blocked domains and events and can be exported or sent to support as a diagnostic report in one tap.

Still have questions?Our team answers in minutes.
Talk to us