Security

GaiaDesk is built so that the people running the signaling servers — including us — can't watch your sessions.

End-to-end encryption

Screen, audio, input, clipboard, and files travel over an encrypted WebRTC peer connection (DTLS-SRTP) negotiated directly between the two machines. The signaling server only helps the two peers find each other; it never sees the media stream. When a direct path isn't possible, traffic falls back to an encrypted TURN relay that forwards packets without being able to read them.

Accounts are required

Both hosting and connecting require a signed-in account. There is no anonymous access — the signaling server rejects any connection without a valid token.

Access controls on the host

The host decides who gets in:

• One-time codes require an explicit Allow click for every session.

• Unattended passwords are rate-limited, with lockout after repeated wrong attempts to stop brute-forcing.

• Access allow-list — restrict connections to specific signed-in accounts, so even someone with the address and password is turned away unless they're on the list.

• Lock on disconnect — automatically lock the host's screen when a session ends, so the desk isn't left unlocked.

• Block local input — freeze the physical mouse and keyboard at the host during a session.

Your data stays yours

Session recordings are made on the controller and never leave your browser. GaiaDesk stores the minimum needed to route connections and keep an audit log of who connected to what.