Ask Secure Desk a question. Answers come from this site's docs only. I will cite a page. I will not invent a product claim.
Self-hosted · end-to-end encrypted · endpoints dial out
Remote support and Windows desktops in the browser. The relay you run can't watch.
Self-hosted remote support on a relay you run — help users, move files, and reach sign-in and lock screens when you need to. Windows endpoints dial out to you; there is no vendor cloud in the middle. Operators work in the browser. The relay pairs the session and forwards encrypted traffic it cannot read. Ports, crypto, and limits are in Docs.
Free Starter: 1 operator, 1 concurrent session, 3 enrolled Windows devices, self-hosted relay.
AES-256-GCM
Per-direction session keys
6 digits
Read-aloud check against a MITM
Dial-out
Endpoints; relay needs 80/443
SYSTEM
Shell that needs no desktop
What you get
One browser console, from a desktop to a managed fleet
Persistent Windows desktops, attended sessions, unattended devices, a privileged shell, file transfer and voice — with the identity, roles and audit trail to justify all of it to a security reviewer. Support is one use case.
End-to-end encrypted sessions
After pairing, console and device run an ephemeral ECDH P-256 exchange and derive AES-256-GCM keys — one per direction — through HKDF-SHA256. The relay forwards ciphertext it holds no key for.
A 6-digit code that catches a MITM
Both ends derive the same short authentication string from the agreed key material. Read it aloud to the user and a relay that tampered with the exchange is exposed immediately.
Enrolled desktops, persistent access
The installed Windows service runs as LocalSystem from boot with its own enrolled device token, grouped per customer in the portal. Connect across logon, lock and fast-user-switch.
Attended support from a single link
Create a one-time session in the portal and send the join link. The user runs a portable executable in their own session — nothing installed, no admin rights, access ends when they close it. One use case on the same pipe.
Backstage: a SYSTEM shell, no desktop
Open cmd or PowerShell as SYSTEM on a machine with nobody logged in, without taking over anyone's screen. It rides a derived session id, so the user still shares just the one code.
Sign-in and lock screens
GDI capture returns the Windows sign-in desktop as solid black, so the unattended worker probes DXGI duplication on the live input desktop and switches to it when it succeeds. UAC and Ctrl-Alt-Del remain out of reach.
Elevation with credentials that stay local
Escalate an attended session by entering that machine's own admin account. The credentials are used once on that box, never persisted, never logged, and never reach the portal — and the console refuses to send them unless the session is end-to-end encrypted.
File transfer, verified
Push files either direction in 64 KB chunks; the receiver verifies a SHA-256 of the whole file before acknowledging it. Multi-monitor switching and two-way clipboard are in the same console.
Talk the user through it
Start a voice call inside the session — 16 kHz mono PCM over the same encrypted channel — with optional webcam video from the technician. No second tool, no conference bridge.
Roles, TOTP and SSO
Technicians sign in to your portal with a password plus enforced TOTP, or through Microsoft Entra / Google. Roles are admin, operator and viewer; auto-provisioned SSO logins land in read-only viewer.
White-label the end-user experience
Your company name, logo, colour and support line lead what the supported user sees; the platform mark stays subtle. Bring your own code-signing certificate and the relay signs client builds on the fly.
Updates without a truck roll
The installed service checks for a newer published build, downloads it and swaps itself out as SYSTEM — triggered from the portal or on its own six-hourly schedule. A failed update leaves the running version untouched.
How a session works
Outbound-only, from both directions
No VPN, no port forwarding, no exception for your firewall team to sign off. Both ends connect out to the relay you control, and the relay never gets a key.
1
Open an enrolled desktop, or share a join link
Sign in to your portal and open a persistent Windows desktop, or create a one-time join link for attended support. Same pipe either way — a label, an expiry, single-use or reusable.
2
Both ends dial out to your relay
The Windows Client shares the screen; the Agent opens the console in a browser. Each side connects outbound over WSS and presents the session id plus its token, so neither endpoint needs a public IP or an inbound firewall rule. The relay you host still needs 80/443; it pairs them and nothing else.
3
Keys, then control
The two endpoints run an ECDH exchange through the relay and derive their own AES-256-GCM keys. Compare the 6-digit code with the user, then view the screen, take mouse and keyboard, open a SYSTEM shell, move files, or start a voice call.
Screens
What your technicians and your users see
Portal dashboard, join page, and technician console.
Security model
Assume the middle is hostile
Backstage is a SYSTEM shell and Elevate carries admin credentials. Capabilities that powerful only make sense if the transport holds up even when the relay itself is compromised — so the endpoints, not the server, own the keys.
The relay is outside the confidentiality boundary
TLS protects each hop, but a relay that terminates TLS could read plaintext — so the endpoints encrypt above it. Compromise the relay host and you get pairing metadata and ciphertext, not screens, keystrokes or files.
Three credential planes that never mix
Portal identity decides who may run a session. A portal-issued token authorizes a socket. The session then acts in whatever context the client already runs in. We never join, trust, or authenticate against the supported machine's domain.
Admin credentials stay on the target machine
The in-session Elevate prompt takes that host's own admin account, uses it once for a linked-token launch, and reports the privilege level actually obtained. Nothing is persisted, logged, or sent to the portal.
Designed to support a PCI-scoped deployment
TLS 1.2+ with AEAD-only ciphers, a relay designed to sit outside the cardholder data environment, per-session identity, idle session reaping, and connect/pair/transfer events to ship to your SIEM. Compliance is still yours to validate with your assessor.
The full trust model, including what the product deliberately does not do, is in the security documentation.
Deployment
You run the relay. That is the point.
One Linux host with a DNS name serves the technician portal, the join page, the browser console and the WebSocket rendezvous. No secrets in config files: the first start prints a one-time setup token and funnels everything to a setup wizard.
Debian / Ubuntu installer
The recommended bare-VM path. Idempotent, so upgrades are the same command.
- One command on a Debian or Ubuntu VM
- Provisions Node.js, PostgreSQL and certbot
- Let's Encrypt issued and renewed for you
- Re-run the same command to upgrade in place
- Database, secrets and config survive upgrades
Docker Compose + Caddy
For teams that would rather ship a container than manage a VM.
- docker compose up -d --build
- Caddy obtains and renews the certificate
- Certs and config persist in named volumes
- Reproducible and self-healing
- Point DATABASE_URL at your own PostgreSQL
# download and extract the release, then:
sudo bash install.sh
# the setup token is printed to the service log:
sudo journalctl -u rubix-relay -e | grep -i 'setup token'
# then finish in the browser: https://support.example.com/setup
sudo bash install.sh
# the setup token is printed to the service log:
sudo journalctl -u rubix-relay -e | grep -i 'setup token'
# then finish in the browser: https://support.example.com/setup
Production uses PostgreSQL — the Debian installer provisions it. Step-by-step instructions, including TLS and the Windows clients, are in the install guide.
Windows on the endpoints
The supported machine always runs the native Windows client — a web page cannot inject operating-system mouse and keyboard input. Technicians work in the browser console. There is no supported native technician application.
Who it is for
Teams that have to justify who can see a desktop
Web VDI on a relay you run
Persistent Windows desktops in the browser through a relay you operate. Not Azure Virtual Desktop, Citrix or Omnissa — no published app stacks, no GPU pools, no vendor control plane. Support is one use case, not the product.
Fleets of AI-agent desktops
Many agents, each with its own Windows desktop, on one relay you run. Isolated sessions. Enrol each desktop once, watch what the agent is actually doing, and take the keyboard when it gets stuck. Desk does not run the agents.
MSPs and IT helpdesks
Devices can be grouped per customer in the portal. White-label branding and your own code-signing certificate (Business) mean the end user sees your company, not ours. There are no per-technician customer ACLs.
Internal IT
Reach employee laptops, meeting rooms and servers with no VPN and no inbound firewall rule. Elevate inside the session to fix a driver or service without pulling the user off their machine.
Regulated and security-first teams
Self-hosted, end-to-end encrypted, TOTP or SSO on every technician, roles down to read-only, and a relay designed to sit outside your cardholder data environment.
Servers and headless machines
Backstage opens a SYSTEM shell on a box with nobody logged in and no desktop to disturb — the right tool for a service that will not start or a disk that is filling up at 2am.
AI-agent desktops
Many agents. Each gets a desktop. One relay you run.
An AI agent driving its own Windows desktop is an unattended machine that occasionally needs a human — and the usual answer, RDP through a jump host, means opening inbound access to the exact machines you least want exposed. Same pipe as web VDI.
One desktop per agent
Many agents on one relay you run. Each agent gets its own enrolled Windows desktop and its own session keys. Isolated sessions — no shared screen, no shared keyboard.
See what the agent is actually doing
Attach to the live desktop and watch the agent work. Multi-monitor machines let you pick the screen, so a wide agent workspace does not have to be squeezed into one view.
Intervene without stealing the keyboard
Backstage opens a SYSTEM shell with no desktop attached, so you can read logs, restart a stuck service or fix a dependency while the agent keeps running on screen, undisturbed.
Get artifacts off the box
Pull traces, screenshots and output files back over the same encrypted channel, verified by SHA-256 on arrival — no file share to open, no bucket to grant the desktop access to.
No inbound rules for the agent subnet
Both ends dial out over WSS to your own relay. An agent fleet can sit in a locked-down subnet with no public IP and no inbound exception, which is usually the first thing security asks about.
The relay cannot watch
Each session runs its own ECDH exchange and a 6-digit SAS. The relay forwards ciphertext it holds no key for. Roles decide who may connect; the portal records who opened which session and when.
Secure Desk does not run or orchestrate your agents — it is how you reach, watch and repair the desktops they run on. Device caps by plan are 3, 100 and 1,000. AI-agent desktops · Tell us about your fleet if you need more than that.
Pricing
One annual licence for the whole deployment
Not per seat, not per session, not per minute connected. Every plan includes end-to-end encryption, a persistent web desktop, backstage and file transfer — the paid tiers raise the operator and enrolled-desktop caps and add SSO, branding and code signing. Attended support is one use case.
Starter
One operator, three enrolled Windows devices, same end-to-end encryption as paid tiers. For a lab or a first site.
Free
1 operator · 3 enrolled desktops
- 1 operator, 1 concurrent session, 3 enrolled Windows devices
- Attended remote support
- End-to-end encryption (ECDH P-256, AES-256-GCM, 6-digit SAS)
- Sign-in and lock-screen capture on Windows
- File transfer either direction (SHA-256 verified). Not a remote Explorer.
- Community support
- Unlicensed installs run as Starter
Team
IT and MSP fleets — enrolled desktops, elevation and SSO. One annual licence for the whole deployment.
$249 / yr
≈ $21/mo · billed annually
Up to 10 operators
- Everything in Starter
- Up to 10 operators, unlimited concurrent sessions, 100 enrolled devices
- On-demand SYSTEM elevation (credentials stay on the target machine)
- SSO: Microsoft Entra and Google
- Silent client auto-update
- Email support
Recommended
Business
Larger IT and MSP fleets, on your brand, with roles and a 200-event portal audit log.
$499 / yr
≈ $42/mo · billed annually
Unlimited operators
- Everything in Team
- Unlimited operators, 1,000 enrolled devices
- White-label branding (one brand per appliance, not per customer)
- Roles: admin / operator / viewer, plus a portal audit log of the last 200 events
- Bring-your-own code-signing certificate (relay Authenticode-signs served Windows clients)
- Priority support
Prices in USD, billed annually. Your licence is verified offline against a key baked into the build, so the relay keeps working if it cannot reach us — and reverts to Starter, never to nothing, if a licence expires. Compare plans.
Install the relay on a Linux host you control
One Linux VM, one command, one setup wizard. Starter is 1 operator and 3 enrolled desktops — no vendor tenant in the path; you own the host.
Questions first? sales@secure-desk.io