Built on cryptographic principles, not trust.

Table of Contents

• → End-to-End Encryption Architecture
• → Key Exchange Protocol
• → Forensic Audit Trail
• → Privacy Masking
• → Compliance & Certifications
• → Security Disclosure Policy

End-to-End Encryption Architecture

Every RemoteDesk session uses AES-256-GCM encryption with ephemeral keys. The signaling server never sees your screen, SDP offers, or ICE candidates—only signed ciphertext.

Key Generation

1. Host generates ephemeral ECDH keypair (P-256)
2. Viewer generates ephemeral ECDH keypair (P-256)
3. Both sides exchange public keys signed with session password (HMAC-SHA256)
4. Shared secret derived via ECDH
5. Final AES-256 key derived via HKDF-SHA256
6. New key generated for every session—no key reuse

ENCRYPTION_FLOW: ┌─ Host Screen Capture ─┐ │ (1920x1080@60fps) │ └──────────┬────────────┘ │ ▼ ┌─ H.264 Encoding ─┐ │ (Adaptive BR) │ └────────┬──────────┘ │ ▼ ┌─ AES-256-GCM ─┐ │ (Authenticated)│ └────────┬───────┘ │ ▼ [SIGNALING SERVER] Sees: Ciphertext only │ ▼ [VIEWER's Decryption] Uses: Ephemeral key │ ▼ [H.264 Decode → Display]

Forensic Audit Trail

Every action is logged with millisecond precision and cryptographically signed. Support teams get an immutable record of what happened, when, and by whom.

Export Formats

Audit trails can be exported as signed HTML (human-readable) or JSON (machine-parseable). HMAC-SHA256 signatures allow organizations to verify integrity even years later.