You can tell SecureGate Card which networks your team works from, as a list of IP ranges. With the policy on, every authenticated request a member makes from anywhere else is refused, not just the sign-in. A finance team's bank logins stop being reachable from a home laptop, a hotel Wi-Fi or a stolen session in someone else's browser.
It's on the Business plan. It's not a substitute for strong passwords or a second factor. It's a fence around the building: it doesn't stop someone already inside, and it does stop everyone else.
What "restricted by network" actually means
Every office connection reaches the internet through a public IP address, the one your router presents to the outside world. Some offices have one address. Some have a small block, written as a CIDR range like 203.0.113.0/29, which covers eight addresses.
You add those ranges to the organisation's network policy. From then on, the server looks at where each request comes from and checks it against the list. Inside the list, the request goes through. Outside, it's refused.
A password is something you know. A card is something you have. A network rule adds somewhere you are: the right password from the wrong place still gets turned away at the door.
Every request, not just the sign-in
This is the detail that decides whether the rule is worth having.
If a network rule only checks the sign-in, anything that happens after sign-in is outside it. A laptop that signed in at the office and went home in a bag is still signed in. A session token lifted by malware or a malicious browser extension works from wherever the attacker is.
SecureGate Card checks the network on every authenticated request, on the server. Opening a vault, reading an entry, saving a change: each one is checked. The laptop that went home gets refused the moment it asks for anything. The stolen token gets refused too.
It's also why the check lives on the server. A rule enforced in the app can be skipped by anyone who talks to the API directly.
One detail to know: the policy is cached for 60 seconds. When you change the ranges, allow up to a minute before every request follows the new list.
How the others handle it
1Password Business has firewall rules that can allow, report or deny access by IP address, CIDR range, country or anonymous IP type, such as VPNs and Tor. It's more flexible than ours. Its documentation describes the rules in terms of sign-in attempts, so check how they treat a session that's already open if that matters to you.
Bitwarden's cloud service has no IP allowlist that we could find in its documentation. There's a long-running feature request on its community forum. The usual workaround is single sign-on through Microsoft Entra ID with conditional access policies, which needs the right Microsoft licence on top.
Why a finance team, specifically
Think about what the finance vault holds: online banking, payroll, the HMRC login, the card processor, the supplier payment portals. One wrong login there moves money. The people who use those accounts tend to work set hours from set desks. For them, access from anywhere isn't a feature. It's risk nobody asked for.
Most password managers sell the opposite. Any device, any network, any country. That's right for a sales team and wrong for the four people who can pay a supplier.
The catch: it's organisation-wide
The network policy applies to every member of the organisation, not to one vault or one department. You can't fence the finance vault and leave marketing's open. A per-vault rule would be better. We don't have one.
So it suits a company where most people work from the office anyway, with a VPN for the ones who don't. If half your staff are on the road and you only want the fence round finance, this isn't the right tool yet.
What it doesn't protect against
A network rule answers one question: where is this request coming from? It has nothing to say about these:
- Someone inside the network. A visitor on the office Wi-Fi, or a colleague at an unlocked desk, is inside the fence.
- Malware on an office machine. It sends its requests from your office address.
- Shared addresses. In a coworking space or a shared building, the public IP may belong to every tenant. Your fence then includes all of them.
- What's already been copied. The rule controls what the server answers. A password someone copied into a spreadsheet last month is out of reach of any policy.
It's one layer. Keep the master password strong, keep the card on you, and remember that a card alone never opens an account on a new device. It also needs a PIN, the master password, email approval or a trusted device.
Before you switch it on
| Situation | Allowed with the policy on? |
|---|---|
| Staff member at an office desk | Yes |
| Staff member at home, no VPN | No |
| Staff member at home on a VPN that exits through the office | Yes |
| Phone on office Wi-Fi | Yes |
| Same phone on mobile data, sitting in the office | No. Mobile data doesn't come from your office IP |
| Administrator from home, admins exempt | Yes |
| Administrator from home, admins not exempt | No |
Then work through this:
- Find your office's public IP. Searching "what is my IP" from an office machine shows it.
- Ask your internet provider whether it's static. If it changes, your team is locked out the day it does.
- Add every site: main office, second office, warehouse.
- Decide how remote staff get in. A VPN that exits through the office is the usual answer.
- Decide whether administrators are exempt. If they are, an admin can fix a wrong range from anywhere. If they aren't, a wrong range can lock everyone out, admins included.
- Test from a phone on mobile data before you tell anyone it's done.
- Allow a minute after any change.
A worked example
Take a hypothetical twelve-person accountancy practice with one office and a business broadband line with a static IP. Three partners sometimes work from home.
The setup is short. The office address goes in as a single range, a /32. The three partners connect through the office VPN before they open the vault. The office manager is an administrator and stays exempt, so if the provider ever changes the address, one person edits a range instead of twelve people waiting.
On Business that's €96 a month for twelve seats. What it buys is simple to explain to the partners: the bank logins only open from the office or through it.
When it fits, and when it doesn't
It fits a small company that mostly works from one or two offices with fixed IP addresses, where the vault holds things that move money and nobody has a good reason to open it from a beach. It fits an MSP selling a finance team a concrete control it can point to in an audit. It's part of Business, at €8 per user a month or €77 a year, with a 14-day trial. The business page covers the rest of the plan and pricing has the numbers.
It doesn't fit if your team is mostly remote without a company VPN, or if your office IP changes every time the router restarts. It doesn't fit if you want the fence round one department only, or need country rules and VPN blocking. 1Password's firewall rules go further there. And if your requirement is that the provider can't read the vault, we're not that either: we encrypt with AES-256-GCM on our servers, with a key we hold.