Remote Support Security: Consent, TLS, Audit Log

The model

Seven rules we don't bend.

Consent gate. Remote control doesn't start until the person on the other side approves the on-screen prompt. If consent is refused, the session never opens.
A status banner that can't be hidden. While the screen is shared, the warning banner and the system-tray indicator cannot be turned off — the user always sees that someone is watching.
All transport is encrypted with TLS. Every connection between the panel, the agent and the relay server is encrypted; certificates renew automatically.
The relay server never opens the content. It doesn't know the session and doesn't decode the data; it is a dumb pipe connecting two ends. That's not a limitation — it is the model.
Session authority is signed. A technician's right to connect to a machine is carried by a cryptographically signed, short-lived authorization token.
The file you download is signed. The agent binary carries a timestamped code signature from a verified publisher — Windows tells you where the file came from and that it hasn't been altered.
Two-step verification is mandatory. The second step cannot be switched off on technician and administrator accounts.

An honest note: VizzDesk does not claim end-to-end encryption. Whoever operates the installation — you on your own server, or us on the hosted setup — is technically inside the trust chain. Rather than selling this as “end-to-end”, we write it down; the option to put the server on your own rack exists precisely for this reason.

$ vizzdesk server setup --domain support.yourcompany.com

  → generating relay key pair   done
  → creating tenant database    done
  → obtaining TLS certificate           done

  Panel     https://support.yourcompany.com/admin
  Guest   https://support.yourcompany.com

  ready — outbound traffic: none

Audit trail

If it happened, it is on record.

Every session goes on record, with a name and a time.

Your support history answers "who, when, which machine" months later. When a customer asks "what was done last Tuesday?", the answer is a record, not a guess.

Sessions get names: "Outlook profile repair" — searchable later
Pending, active and completed sessions in separate filters
The audit log is immutable; even an administrator can't delete it

VizzDesk support session history: a list of 117 completed sessions; each row shows the session name, technician, remote device and status — Session history screen, from the same demo panel. Interface shown in Turkish.

Frequently asked

Security, in questions.

Is there end-to-end encryption?

All transport is encrypted with TLS and the relay server never opens the content. However, whoever operates the installation is technically inside the trust chain; for that reason we do not claim "end-to-end encryption". If you want that trust chain entirely on your side, you can install the server on your own rack.

Can the status banner be turned off?

No. While the screen is shared, the warning banner and the tray indicator stay visible — by design, for the person at the remote machine. A support product that can watch someone secretly is a product we would not want to use ourselves.

Where is our data kept?

You have two options: use our hosted setup, or install VizzDesk entirely on your own server. When you run it yourself, session traffic, the device list and the logs never leave your infrastructure.

On our hosted setup, each company's data lives in its own database file; customers are not mixed into one giant table.

Is two-step verification optional?

No — on technician and administrator accounts the second step cannot be switched off. Accounts that can reach other people's machines deserve the stricter default.

Visibility first. Then encryption.

Seven rules we don't bend.

If it happened, it is on record.

Every session goes on record, with a name and a time.

Security, in questions.

Security you can explain to your customers.