Remote access you can prove.

Screen, input, terminal, files, clipboard — one authenticated Noise connection, per-channel AEAD, and no plaintext middle on any path.

The most exposed component holds the least: no keys, no frames, no tenant metadata — and it refuses sessions the control plane didn't sign for.

Device and technician identities are held in the Secure Enclave or TPM — usable on that machine, never copyable off it.

The control plane cryptographically proves a key lives in genuine hardware — policy sees verified verdicts, never the endpoint's word.

Seven separate signing roles behind an HSM-capable seam — and endpoints verify every grant against an independently-signed directory.

Sessions re-key continuously and re-prove both identities on a clock — a captured key or session state goes stale in minutes.

Protected tenants require a live hardware-key touch for every connection — and every resume. Stolen cookies stop being enough.

Attended support runs a real PAKE: short codes with no offline attack, and a spoken four-word check that defeats even a hostile relay.

Screen sharing always shows a visible indicator — and visibility is proven, not assumed. Cover it, minimize it, wedge it: the session ends.

On "knock" devices a connection waits at the door — nothing captures, nothing injects — until a real human clicks Allow on a prompt built to resist fakery.

Sensitive actions mid-session prompt the person at the machine — on a surface the technician can neither see nor click.

Monitoring the monitors is a product feature: clients see what their MSP watches, and monitoring-shaped behavior gets flagged automatically.

Hash-chained, signed, append-only records on both the endpoint and the control plane. Edit, reorder, or delete anything and verification fails loudly.

Screen capture exists only while a screen session does — an idle managed machine is never "being recorded," and the OS's own indicator agrees.

Silent, notify, knock, or deny-while-in-use — per device, signed under its own control key, so posture can only ever tighten out from under an attacker.

No tier, add-on, or flag removes the consent indicator. We deliberately forfeited the covert-monitoring market so "no banner" is never ambiguous on any endpoint.

Hardware HEVC capture-to-glass with encryption on — measured, on both desktop platforms, at desktop resolutions.

A content classifier routes every tile: text rides a lossless overlay above the video stream, bit-exact — even while scrolling.

Packet loss heals through tiny reference refreshes and per-frame parity — a momentary softness, not a frozen screen waiting on a keyframe.

The stream measures its path and degrades in a deliberate order — then climbs back on its own. On a clean network, all of it costs exactly nothing.

Networks change, processes crash, machines reboot — the session heals through all of it, and revocation still bites mid-heal.

Each remote monitor is an independent stream — one focused at full rate, the rest as live thumbnails that pause themselves under pressure.

Terminal, files, and clipboard are first-class channels with their own permissions — usable together or entirely without video.

GPU-less VMs and headless servers stream through a bespoke software codec with no video decoder at all — the case that breaks tools derived from game streaming.

MSP → client → site, with umbrella groups at any depth for resellers and holding companies. Acquisitions are a subtree move, not a migration project.

Tenants author real authorization policy — validated at write, inherited down the tree, with parent forbids that children cannot override.

Access is a short-lived signed capability, re-authorized on a schedule against current policy — and revocable to a dead session in tens of milliseconds.

Devices are born pending. A leaked installer token mints nothing — it buys a place in an approval queue, in front of a human, with risk flags attached.

A bundled Apache-2.0 identity provider behind a backend-for-frontend — tokens never touch the browser, and technicians start with exactly nothing.

Pin your whole environment to your networks — and recover from your own mistakes without the vendor ever being the recovery path.

Every endpoint holds one outbound connection carrying grants, revocations, policy, inventory, alerts, and jobs — with freshness measured by evidence, not socket optimism.

Your logo and colors on the console, the client, and the consent banner — cryptographically bound to your tenant, and impossible to weaponize.

Software, patches, services, hardware, posture, network, certificates, users — from one agent on Windows, macOS, and Linux, kept fresh by deltas.

Sensitive collection is off until a signed tenant document turns it on — and some things are structurally not collectible at all.

Monitors evaluate on the endpoint against a signed per-device policy — the wire carries state changes, so cost scales with problems, not fleet size.

OS event capture where the privacy class of every source is decided by shipped code — not by whoever wrote the rule.

A crashed service restarts itself at 3 a.m. — inside limits stronger than the ones humans get, with a tamper-evident attempt trail.

Live CPU, memory, disk, and network at 1 Hz in the browser; processes and logged-in users on demand — audited, TTL-cached, structurally never historized.

Fleet scripting where the platform's authorization, a signed content directory, and the technician's own hardware touch must all agree — or nothing runs.

Blueprints, desired-state convergence, and patching — designed in depth with the per-platform truths stated honestly, landing phase by phase. The convergence engine is landing now.

Every surface without a backend carries a badge naming exactly what it awaits. Unwired actions disable instead of pretending. Refusals render verbatim.

⌘K to anywhere — including "connect to that machine." Scope the whole console to one client. Save your views. Export what you see.

Session states are first-class screens: the verification ceremony gates input and video, interruptions show a live countdown, endings tell the truth.

From console to live session in one click — through a handoff designed so a malicious link can never add trust.

A first-run wizard takes a technician's machine from blank to operational — pin the control plane, generate a hardware-backed key, register it — across as many consoles as they work in.

Console, technician client, and the endpoint's consent surfaces re-skin to your tenant at runtime — inside hard limits that keep branding from becoming phishing.

A no-install, nothing-left-behind support app: the user runs it, reads a code aloud, and gets help — engineered assuming criminals will try to abuse it.

Session recording as an authorized member of the encryption group — compliance-grade, higher quality than the live view, and still unreadable by the vendor.