Human approval first
A session request can exist, but screen and input relaying remain blocked until the receiving person chooses to approve it.
Security model
Trust begins with knowing what the software can—and cannot—do.
No product is unhackable. VeyaDesk reduces risk through visible consent, temporary sessions, end-to-end encrypted content, narrow capabilities and honest disclosure.
Keys stay at the endpoints
P-256 ECDH derives a shared secret. HKDF-SHA-256 produces directional keys used with AES-256-GCM.
Stop means stop
Leaving or revoking removes the live relay session. Short idle expiry and an eight-hour maximum lifetime limit stale access.
DATA PATHENDPOINT ↔ ENDPOINTThe relay handles session routing and encrypted envelopes.
Inside a session
The relay coordinates. The computers encrypt.
Each app creates an ephemeral cryptographic identity for its session. The paired public keys and session ID establish independent send and receive keys. Screen frames and control commands are authenticated before decryption.
Authenticated encryptionAES-256-GCM detects modification and rejects altered content.
Directional keysHost-to-controller and controller-to-host traffic use different keys.
Replay countersRepeated and out-of-order messages are rejected by the receiving app.
Verification wordsBoth people can compare a six-word phrase derived from the session.
Deliberate exclusions
A smaller beta has a smaller attack surface.
The attended beta intentionally does not provide permanent passwords, silent startup, background service installation, unattended access, clipboard sync, file transfer, audio, camera access, privilege elevation or Windows secure-desktop control.
These are useful capabilities, but they also widen the product’s security boundary. They will not be presented as available until separately designed, tested and reviewed.
Infrastructure boundary
The current relay is a single-instance service that stores active session state in memory. A restart intentionally terminates active sessions. Production scale-out and durable operations require a later infrastructure design.
Current release status
The native cryptographic channel and relay protocol have automated tests. Public distribution still requires live two-computer acceptance testing, code signing and independent security review.
Responsible reporting
Found a security issue?
Please report suspected vulnerabilities privately to security@veyadesk.com. Include the affected version, reproduction steps and potential impact. Do not access data that is not yours, disrupt other users, or publicly disclose an unresolved vulnerability.
We will acknowledge valid reports, investigate them and coordinate disclosure when a fix is available. A formal bug-bounty programme is not currently offered.