Security

What actually protects a session, described plainly enough that you can check it against the source.

Operated by Keysender — Łukasz Wicenciak, VAT PL7822386443, Poland.

The session is encrypted between the two machines

Screen frames and mouse/keyboard events travel over WebRTC, encrypted end to end with DTLS-SRTP directly between the controlling machine and the controlled one. Where the network allows it, the two connect peer-to-peer and the traffic never touches our server at all. When a direct path isn't possible, the media is relayed through a TURN server — still encrypted end to end; the relay forwards packets it cannot read. The session window shows you which of the two is in use.

What our server can and cannot see

The signalling server brokers the connection: it holds account records, device registrations, and the messages needed to introduce two peers. It does not hold your screen content, keystrokes or transferred files — those never exist on it in readable form. Web traffic is HTTPS-only with HSTS; session cookies are HttpOnly and same-origin.

The exception is opt-in and per organisation: with cloud recordings turned on, the operator's viewer uploads each finished recording after the session so it can be played from the dashboard. Those files are readable only by that organisation's administrators and auditors and by the person who recorded them, are served only to a signed-in session (no shareable links), every upload, play, download and deletion is in the activity log, and they are deleted automatically on the organisation's schedule. The person at the recorded computer is told on screen that the session is being recorded and stored by that organisation.

Getting into a machine requires proof

• Attended machines show a session password that changes and must be given to the operator by the person sitting there.
• Unattended agents are enrolled into an organisation and reachable only by accounts in that organisation, or by devices in the same group.
• Optionally, the machine can require the person at the keyboard to approve each incoming session before it starts.
• Sessions are recorded in the organisation's activity log: who connected, to which machine, when.

What you install is what we built

Every release is built automatically by GitHub Actions from a version-controlled source tree — no hand-assembled installers. The SHA-256 of each published file is listed in /update/manifest.json, so you can confirm that the installer you downloaded, and every update the app applies, is the one we shipped. The source is not public; if your organisation needs to review it before deployment, write to kontakt@senditnow.online.

A word about remote-access fraud

Remote-control software is a favourite tool of scammers, who phone people and talk them into installing it. We will never contact you unprompted and ask you to install Remotler, read out a session password, or grant access to your computer. If that happens to you, it is fraud — hang up. Installers are only available to signed-in account holders, specifically so that an anonymous stranger cannot direct someone to a one-click download.

Reporting a vulnerability

If you believe you have found a security problem, please write to kontakt@senditnow.online with enough detail to reproduce it. We will confirm receipt, keep you informed while we investigate, and credit you if you would like us to. Please give us a reasonable opportunity to fix the issue before publishing it.