Skip to content
RemoteAccessApp
Get Pro

Security and privacy

How RemoteAccessApp keeps you and your PCs safe

A remote access tool can see a screen and type on a keyboard, so it has to earn trust. Here's how RemoteAccessApp is designed: the person at the PC decides who gets in, sessions from the app are encrypted end to end, your password stays on your device, and updates are checked before they install. Where there are limits, we say so. It all follows from our consent-first approach to remote access.

Download freeCreate a free account
  • Consent before every session
  • End to end in the app
  • Signed updates

Nobody connects behind anyone's back

Consent is built into every session, not bolted on as a setting.

  • Asked before every session

    Unless unattended access is on, the PC asks the person there to allow each connection, naming the console. Nothing is shown until they click Allow, and an unanswered request is denied by itself.

  • A banner the whole time

    While anyone is connected, a banner stays on the PC's screen with a chat button. It also says when a command prompt is open, and names an AI assistant if one is connected.

  • One click to take back control

    The person at the PC can switch off mouse, keyboard and commands at any time, making the session view-only, or quit RemoteAccessApp.

  • Unattended access is the PC's decision

    It can only be switched on at the PC. Even then, only consoles someone there has trusted, or the PC owner's own account (a setting at the PC), get in without a click.
    About unattended access

  • Trusted consoles live on the PC

    The list is stored only on that PC, protected for its Windows user, and tied to each console's certificate. A server that announced a different console couldn't get in without someone clicking Allow.

  • No recording

    RemoteAccessApp doesn't record sessions or keep what you see, type or run.

Asking the person at the PC every time was one of the first things we decided the app had to do, because remote access is exactly what scammers abuse. Our post on why we built RemoteAccessApp tells that story. For how these protections compare with what's typical elsewhere, see why choose RemoteAccessApp.

Encrypted connections, with an honest caveat

Your console and the PC both connect out to the relay, which joins them without being able to read an app session.

No open ports on either side. In the app, the relay forwards data it can't decrypt.

In the RemoteAccessApp app, the connection between your Console and your PC is encrypted end to end with TLS. When it passes through our relay, the relay forwards data it can't decrypt and doesn't store it. That covers the screen, your mouse and keyboard, chat, clipboard, sound, commands and files. Because both ends connect outward, nothing on your network has to be opened to the internet (more in remote desktop without port forwarding).

In a web browser, including on a phone, the connection is encrypted too, but not end to end. Our website acts as your console: the encrypted link runs from your PC to the website server, which handles the picture and your input in memory only to pass them to your browser over HTTPS. It doesn't record, store or look at them. When end-to-end encryption matters, use the Console on Windows.

Traffic between the apps and our servers uses TLS too, and the apps only trust our own server certificate.

Your account password never reaches our server

When you sign in with the current apps or the website, your password is turned into a key on your own device, using PBKDF2 with 600,000 rounds and then HKDF. Only that key is sent. Our server stores a one-way hash of it, made with its own random salt, and compares in constant time. So the server never needs, sees or stores your password.

That matters because the same password also protects your saved-password vault. A server that never receives the password can't use it to open the vault.

No design makes a weak password strong. Someone who stole a database could still try to guess passwords, one slow calculation at a time, so choose a long, unique password. The RemoteAccessApp docs have step-by-step help for two-factor sign-in, trusted browsers and the rest of your account's security settings.

More ways to protect your account

  • Two-factor sign-in with an authenticator app, plus one-time backup codes that we store only as hashes.
  • Sign-in codes by email: without two-factor, a browser or PC you haven't signed in from before also needs a 6-digit code we email you. You can let it remember that browser or PC for 30 days.
  • Trusted networks: limit your account and your PCs to IP ranges you choose. Very broad ranges and RemoteAccessApp's own shared server addresses are refused.
  • Sign-in sessions expire 30 days after they were last used, and you can sign out.
  • A security log of sign-ins, PCs added or removed, account changes and when each session took place (never what happened in it), kept for 90 days. With Pro you can download it as a CSV or JSON file.
  • Team roles and per-PC permissions (Pro): Admin, Member or Viewer, and for each shared PC what someone may do there. Our server signs them into each connection, and the PC enforces them.

Passwords to your servers

  • Kept on your PC, encrypted

    Passwords for your SSH, SFTP, FTP, RDP and VNC hosts stay on your own PC, encrypted for your Windows account. Your saved hosts sync to your account without them.
  • Pro

    Synced end to end

    Turn on password sync and they're encrypted on your PC, with a key from your account password, before they reach us. We store data we can't read.

  • Server keys are checked

    A new SSH server's key fingerprint is shown for you to trust before any password is sent. A key that changed is refused with a warning.
    About the SSH client

Prefer that nothing is ever synced? Turn on Never save passwords in Security on the website or in the app's account settings. It deletes any synced passwords from our server straight away.

Updates you can trust

  • Signed updates

    Installed apps accept only updates signed with RemoteAccessApp's key, and check the signature before installing.

  • Never mid-session

    The Agent never updates while someone is connected, so a session isn't cut off by an update.

  • Checked downloads

    Each installer download is checked against the signed release before the website hands it to you.
    Download

The installer for our free remote desktop software for Windows and the apps it installs are code-signed too, so Windows names a verified publisher when you install it. Our Windows app is now code-signed explains what that means, and why Windows SmartScreen may still warn you for a while.

How a connection is made

  1. Step 1: Your console asks

    You sign in and choose a PC. The relay checks that the PC is in your account and that any trusted networks you set allow it.

  2. Step 2: The PC decides

    The PC asks the person there to allow it, or, with unattended access on, checks your console against its own trusted list.

  3. Step 3: An encrypted session, in plain view

    The session opens, end to end encrypted from the app, with the banner on the PC for as long as you're connected.

AI assistants follow the same rules

Pro

With Pro, an AI assistant like Claude Code can work with your PCs through RemoteAccessApp's MCP server. It gets no shortcuts: the PC asks the person there to allow the session unless unattended access is on, and the banner names the assistant the whole time. Claude Code asks you before each tool unless you've allowed it, and the app's MCP page shows what it's doing, with Disconnect, Stop and an off switch. What the assistant sees goes to its provider under their terms. See AI remote support and the MCP page.

Privacy, in short

  • Little data

    Your email is the only personal detail we need. We keep what's needed to run your account and PCs, and delete security logs after 90 days.
    Your data, in plain English

  • No ads, no data sales

    We don't sell personal data or run ads. Service statistics are about the service, not about you.
    Privacy Policy

  • Your PCs, your call

    Remove a PC or turn off remote control whenever you like, or ask us to delete your account.

  • People at your PCs

    If other people use the PCs you connect to, tell them about RemoteAccessApp. It's only for PCs you own or may access.

Want the plain version? Remote desktop privacy: who can see what walks through what a helper, the person at the PC and we can see, and access control for your PCs and servers covers who may connect and what they may do.

No system is perfectly secure

We design RemoteAccessApp to limit what could go wrong, but we can't promise nothing ever will. Keep your password, setup codes and devices safe, turn on two-factor sign-in, and only let people connect when you're expecting them.

For IT teams and security reviewers

The full design in one document: architecture, data flows, encryption, authentication, consent, team access control, our servers, and the limits we know about.

Read the security white paper

Questions, answered

Related