RelayDesktop
Sign inSign up

Security

A transparent security model.

We describe what works today and what the goal is — without marketing exaggeration.

Honestly: the system is designed for end-to-end (E2E) encryption, but we do not yet claim it for every channel. Once it is independently verified, we will say so here.

Encrypted transport

Every connection runs over TLS 1.3 / QUIC with channel binding.

  • Fallback: TCP-TLS and WebSocket on port 443

Signed access grants

Connections are authorised by short-lived, single-use grants signed by the service with Ed25519.

  • Revocable sessions
  • Maximum session duration

Enrollment with a code

A new machine joins an account only with an expiring, limited-use code generated in the portal.

  • The code is shown only once
  • Revocable at any time

Account and controller

The controller identifies with its own key pair; you link it to your account by code pairing with fingerprint check.

  • Passwords: strong hashing, login throttling
  • Two-step sign-in (TOTP)
  • Roles in organisation accounts

Visible notice on the remote machine

While someone is connected, the remote machine shows a notice with a Disconnect button.

  • No hidden monitoring

Relay network

Relay servers only forward; they neither store nor inspect session content.

  • Self-operated, EU-based infrastructure

Data minimisation

We process only what is needed to operate; the portal uses a single session cookie.

  • No tracking cookies, no third-party fonts