# Workspace

A workspace is a private computer that a bot uses during a chat. The bot works with files, runs code, uses [skills](/skills), and can open web pages in a browser. Without a workspace a bot only chats and uses its [tools](/tools).

A workspace belongs to one chat. It stops after the bot's idle time and starts fresh with the next message. Chat shows "Starting workspace…" and then "Workspace ready" while it starts.

## Turn it on

In the bot editor, open Capabilities, Workspace.

On a [Company Bot](/bots), turn on Use a workspace. Then choose:

- **Size.** The size of the computer.
- **Browser.** The bot can open web pages. A browser needs size L.
- **Vaults.** Credentials for the workspace. See [Tools and MCP connectors](/tools).

On the [Personal bot](/personal-bot), turn on Allow workspace. Members can then give a chat a workspace. You set the default size. Allow browser lets members turn on a browser in a chat.

The idle time of a bot is the same with and without a workspace. You set it in the same section: 15 minutes (default), 30 minutes, or 1 hour. A chat stops after this time without activity.

Skills, files, Knowledge Bases, and memory need a workspace.

## How many run at once

Your organization can run a limited number of chats at the same time. A chat counts while it runs, until it stops after its idle time. At the limit, a new chat shows that your organization has reached its limit of running chats. Try again when another chat has stopped. Tests in the bot editor count too. A test stops after 10 minutes without activity, and a new test ends your previous one. If your organization needs more, ask GEKI.

## Files in a workspace

Files you add to a bot in the editor, under Capabilities, Files, land in `inputs/`. A file can be at most 25 MB, and a bot takes up to 50 files.

Files a person attaches in [Chat](/chat) land in `attachments/`. Files the bot saves to `outputs/` show under the answer in Chat, where people can preview and download them. Hidden files and folders, and caches such as `__pycache__` and `node_modules`, are not shown.

## Documents

Every workspace reads and writes Excel, Word, PowerPoint, and PDF files. It also reads most other office, mail, and archive formats, including older Office files, Outlook messages, and iPhone photos. The bot makes PDFs, charts, and standalone HTML presentations. This works without internet access.

## Internet access

An Owner or Admin chooses how far the workspace of a Company Bot reaches into the internet. Open the bot in the [Console](/console), go to Capabilities, Workspace, and pick one of three levels under Internet access.

- **No internet access.** The workspace has no network. Packages, downloads, vault credentials, and the browser do not work. MCP connectors, web search, and Knowledge Bases still work.
- **Restricted.** The workspace reaches only a list of hosts. GEKI adds the package sources, the hosts that the skills of the bot need, and the hosts of the credentials in its vaults. You add your own hosts in Own hosts, one per line. Names are exact: `github.com` does not allow `api.github.com`. The editor lists the hosts GEKI added under "Added automatically".
- **Internet access.** The workspace reaches any public website and web API over HTTP and HTTPS. Other connections, such as mail (SMTP) and SSH, are blocked. Private networks are blocked.

A new Company Bot starts with Restricted and an empty list of your own hosts. A bot that existed before keeps Internet access. The Personal bot has no choice.

What a workspace may reach also depends on your organization. A new organization starts with Restricted. GEKI grants Internet access to an organization. GEKI can also take internet access away from an organization, so that every workspace of it has no network. A bot never gets more than the level of its organization. If the level of the organization is lower than the level you chose for a bot, the bot runs with the lower level and the editor shows a warning. Your choice stays saved, and the bot gets it back when GEKI raises the level. This also holds for the Personal bot.

GEKI blocks some destinations for all organizations, for example sites used for abuse. A workspace cannot reach them at any level.

A skill can say which hosts and credentials it needs. See [Skills](/skills). The editor shows a warning when something is missing, for example a skill that needs a host while the bot has no internet access. Warnings show in the editor and next to Publish. They never block Publish.

When you publish, the bot overview and the list of what the bot can do show its internet access. Internet access and Restricted need your acknowledgement.