Security

What actually protects a session, described plainly enough that you can check it against the source.

Operated by Keysender — Łukasz Wicenciak, VAT PL7822386443, Poland.

The session is encrypted between the two machines

Screen frames and mouse/keyboard events travel over WebRTC, encrypted end to end with DTLS-SRTP directly between the controlling machine and the controlled one. Where the network allows it, the two connect peer-to-peer and the traffic never touches our server at all. When a direct path isn't possible, the media is relayed through a TURN server — still encrypted end to end; the relay forwards packets it cannot read. The session window shows you which of the two is in use.

What our server can and cannot see

The signalling server brokers the connection: it holds account records, device registrations, and the messages needed to introduce two peers. It does not hold your screen content, keystrokes or transferred files — those never exist on it in readable form. Web traffic is HTTPS-only with HSTS; session cookies are HttpOnly and same-origin.

Getting into a machine requires proof

• Attended machines show a session password that changes and must be given to the operator by the person sitting there.
• Unattended agents are enrolled into an organisation and reachable only by accounts in that organisation, or by devices in the same group.
• Optionally, the machine can require the person at the keyboard to approve each incoming session before it starts.
• Sessions are recorded in the organisation's activity log: who connected, to which machine, when.

The software is open to inspection

The source is public at github.com/edkeysender/remote-desktop, and every release is built from it automatically by GitHub Actions, so the published installer corresponds to code you can read. Release hashes are published in /update/manifest.json.

A word about remote-access fraud

Remote-control software is a favourite tool of scammers, who phone people and talk them into installing it. We will never contact you unprompted and ask you to install Remotler, read out a session password, or grant access to your computer. If that happens to you, it is fraud — hang up. Installers are only available to signed-in account holders, specifically so that an anonymous stranger cannot direct someone to a one-click download.

Reporting a vulnerability

If you believe you have found a security problem, please write to kontakt@senditnow.online with enough detail to reproduce it. We will confirm receipt, keep you informed while we investigate, and credit you if you would like us to. Please give us a reasonable opportunity to fix the issue before publishing it.