![Internal/external file access](https://pachca.com/help/vnutrenniy-i-vneshniy-kontury-pri-rabote-s-faylami.jpg)

# Internal/external file access

> How to set up internal and external zones in Pachca to protect your company documents. A detailed guide with examples to help your team work effectively

Источник: https://pachca.com/en/help-center/administration/vnutrenniy-i-vneshniy-kontury-pri-rabote-s-faylami

## How to set up internal and external zones in Pachca to protect your company documents

Pachca lets you split your company workspace into two zones for working with files: a secure internal zone and an external one. This way, confidential documents, images and other files never leave your company's network. They can be accessed only from networks you trust and aren't available from external addresses.

Here's how it works:

- Files sent from the secure zone (an IP allowlist) can be viewed and downloaded only by users inside that zone.

    - Users in the external zone (outside the allowlist) can't view or download these files.
- Files sent from the external zone can be viewed and downloaded by all workspace members, no matter which zone they connect from.

![__wf_reserved_inherit](https://pachca.com/help/vnutrenniy-i-vneshniy-kontury-pri-rabote-s-faylami-1762628592123-8dk8rc.png)

 How the two zones handle files

The easiest way to set up the two zones is with a corporate VPN (with a list of subnets in CIDR notation). Your employees then access the internet through one or two public IP addresses. Add these addresses to the IP allowlist in Pachca, and Pachca uses them to determine which zone a user is in when working with files.

To add IP addresses to the allowlist:

- You need the **Owner** role and the Corporation plan
- Go to **Workspace settings**. To open it, click the workspace name in the top-left corner.
- Go to the **IP allowlist** tab and enter the address you want to allow.

![__wf_reserved_inherit](https://pachca.com/help/vnutrenniy-i-vneshniy-kontury-pri-rabote-s-faylami-1762628592280-bx9ia.jpeg)

In practice, the two zones work like this:

- Employees connect to the corporate VPN on their devices and access the internet through an IP address from the secure zone.

- When an employee uploads a file while on the corporate VPN, it's marked as a secure-zone file. Users whose IP addresses aren't on the allowlist can't view or download it.

    - Users whose IP addresses are outside the allowlist can't preview or download files sent inside the secure zone. These files are marked with a lock, and a download attempt shows a placeholder saying the file isn't available.
- If users in the external zone (on a home network or in a coffee shop) send files in Pachca, these attachments can be viewed and downloaded by all workspace members, whatever their IP address.

![__wf_reserved_inherit](https://pachca.com/help/vnutrenniy-i-vneshniy-kontury-pri-rabote-s-faylami-1762628592502-u1r27f.jpeg)

If you have questions about separate file access or ideas for improving this article, contact our support in [Telegram](https://telegram.me/pachca_signup_bot) or [MAX](https://max.ru/id7842383501_bot). We'll do our best to help and update the article :)

‍

Updated: August 4, 2025