Screen view and control
Hardware-encoded H.265 with an H.264 fallback over WebRTC, decoded in the browser with WebCodecs and an MSE path for browsers without it. Sessions start view-only; control is a separate, deliberate step.
The platform
Everything it does
Remote support for networks where an unannounced connection is not acceptable: clinics, classrooms, and the providers who look after them. Below is the whole product, grouped by the part of the job it belongs to, with nothing held back for a higher tier.
In the session
A full support session, not a demo of one.
Screen, terminal, files, clipboard and multi-monitor are one product, not a paid tier each. Everything a technician does in a session is visible to the person sitting at the machine.
Multi-monitor, mixed DPI
Enumerate every display and switch between them mid-session. A resolution change or a monitor being unplugged is handled live rather than by dropping the connection.
Remote terminal
Open a shell without ever starting a screen session, for fast, low-bandwidth fixes on a machine nobody is sitting at. Every command is written to the audit trail.
Files and clipboard
Bidirectional file transfer and clipboard sync over encrypted data channels. Filenames and sizes are recorded; the contents are not, by design.
Live activity feed
Transfers, clipboard syncs, terminal commands and endpoint state changes appear in the session as they happen, so a second technician can see what has already been tried.
Session changes survive
A Windows security prompt taking over the screen does not end the session or black out the view: the prompt is shown, control is suspended and said to be suspended, and it comes back on its own the moment the person at the machine has dealt with it. Locking the screen and switching accounts are handled the same way.
Elevation, if you allow it
A technician can be permitted to answer a Windows security prompt rather than talking somebody through it, and that permission is a customer setting that is off until it is switched on. Every visit to that screen is written to the audit trail by name, and a customer who would rather no privileged process ran on their machines at all can turn the whole capability off.
What the end user sees
Consent is a component of the product, not a setting.
The person at the keyboard always knows a technician is connected, who they are, and what is being recorded. None of it can be turned off from the technician's side.
Always-on presence indicator
A screen border plus a tray or menu-bar item naming the technician and the provider, shown for the whole session including unattended access. It cannot be suppressed.
Control is gated on it
Input cannot be enabled until the endpoint confirms the indicator is actually on screen. That rule is enforced on the server, so there is no path that grants control quietly.
Approval prompt
Require the end user to allow each session, per customer or per group, with a configurable timeout that auto-denies. The technician waits; nothing starts in the meantime.
End it from either side
The end user can terminate the session from the indicator at any point, without needing to find an application or call anyone.
Recording shown separately
Whether the session is being recorded is displayed distinctly from whether someone is connected, so the two are never confused with each other.
Getting on a machine
Unattended fleets and one-off help, in one console.
Enrol the machines you manage permanently, and hand out a single-use link for everything else. Both end up in the same audit trail.
Install it, type a code
The installer takes no options. It opens a window on the machine asking for your setup code, so you can email the same installer to anyone and read them the code over the phone. Codes are group-scoped, capped by device count and expiry, and revocable in one click.
New devices can wait for you
Turn on the approval hold and a machine that enrols on a shared code shows up in your fleet but cannot be connected to until someone approves it. The placement is always your decision, never the installer's.
Enrolled agents
A single-use, short-lived, rate-limited enrolment token binds a device to a group. The agent generates its own keypair, the server pins the public key, and the token is never valid twice.
One-off join links
For a machine you do not manage: the user runs an ephemeral agent from a link, and it removes itself when the session ends. A server-side sweep retires any that linger.
Fleet tree
Customers, groups and endpoints, with live status, last-seen, and the operating system on every device. Connect or open a terminal straight from the tree.
Degraded is not offline
A machine that is online but missing macOS Screen Recording, or whose Windows session helper is down, is shown as its own state with the reason, rather than as healthy.
Concurrency and control ownership
Several technicians can watch the same endpoint; only one holds input, and handing it over is explicit. Per-group limits cap how many can connect at once.
Installers from the console
The current Windows and macOS builds are downloadable from the console with their size, version, full checksum and signing state stated, and every download is audited.
Control and oversight
Rules that hold without anyone watching.
Policy is inherited, enforced on the server, and every override leaves a mark. This is the half of the product that matters at three in the morning.
Policy inheritance
Set defaults for the whole organisation, override per customer, override again per group. The console shows which level a setting came from before you change it.
Access hours and maintenance windows
Access outside permitted hours is refused, not merely flagged. Scheduled maintenance windows lift the restriction for as long as they run.
Break glass, loudly
An owner or admin can override an out-of-hours refusal with a written reason. It is audited, raised as an anomaly, and sent to your notification channels.
Session recording and retention
Recording can be forced by policy so a technician cannot turn it off, and what is recorded is exactly what the technician was shown. Recordings are held on infrastructure you control and deleted automatically on the retention you set.
Audited playback
Playing a recording back requires a short-lived grant and is itself audited. The storage location is never exposed to the browser.
Anomaly detection
First-ever access to an endpoint, out-of-hours access and connection bursts are flagged for review and acknowledgement, as the insider-threat and compromised-account layer.
Append-only audit trail
Who connected, to what, when, for how long, what type of session, transfers, commands and elevation, held in a log the application cannot rewrite. Keystroke content is never recorded.
Reporting and export
Date-ranged session history with per-technician and per-customer breakdowns, most-accessed endpoints, and CSV export of sessions and audit for anyone who asks.
Notifications
HMAC-signed webhooks and email for approvals, break glass, anomalies and failed updates, queued and retried so a slow endpoint never holds up the console.
Running it
Built to be operated by a small team.
Everything an administrator needs is in the console: people, branding, updates, and the state of the fleet.
Team management
Invite by email with a single-use link the invitee uses to set their own password, change roles, suspend, sign someone out everywhere, or reset credentials. Nobody ever handles another person's password.
Roles that are enforced
Owner, admin, technician and viewer, checked on the server for every action rather than by hiding buttons. The last owner cannot be demoted or suspended out of existence.
Passkeys and TOTP
Sign in with a passkey in one tap, or password plus TOTP. No external identity provider is required, and no account is confirmed to exist by an error message.
White-label branding
Your product name, logo and colours re-theme the console per tenant, with a live preview while you edit.
Signed agent updates
Releases are verified against a signing key before they can be published, rolled out in stages, held to a minimum-version floor when an update is mandatory, and reported back when one fails.
Tenant isolation
Every read and write is scoped to your organisation, with automated tests that exist specifically to prove one tenant cannot see another.
Where it runs
Your infrastructure, your country, your keys.
Self-hosted end to end. No session, recording or audit record passes through a vendor's cloud, because there is no vendor cloud in the path.
Onshore and self-hosted
The control plane, database, signaling, relay and recording storage all run on infrastructure you control in Australia.
Nothing inbound
Agents dial out on 443. No port is opened on the customer firewall, and no listener is exposed on the machines you support.
Ciphertext through the relay
Media and data channels are DTLS-SRTP end to end, so the relay that forwards them when a direct path fails only ever sees encrypted bytes.
Windows and macOS
A shared core with thin per-OS layers: the Windows service and session-helper split that makes unattended access to a locked machine work, and the macOS permission model handled for managed and unmanaged Macs alike.
Browser console
No client to install for technicians. Strict content security policy, no inline script, and a documented decode fallback for browsers and tablets without WebCodecs.
Supply chain discipline
A generated software bill of materials, a licence gate over the whole dependency graph, signed releases, and hardened, least-privilege containers.
Read it like an auditor.
The security posture, the threat model and the residual risk we accept are all written down, in the same plain terms as the feature list above.