Remotle: Security
This page describes how Remotle protects sessions and workstations. It is for IT and security teams.
Connections
Section titled “Connections”- Workstations never accept inbound connections. They do not listen on any network port. Both your device and the workstation connect outbound to Computle, which introduces them.
- Every session is encrypted end to end with TLS 1.3, between your device and the workstation. When a session passes through a Computle relay, the relay forwards encrypted data and cannot read it.
- Before a session starts, your device checks the workstation’s certificate. The certificate must be issued by Computle for that exact workstation and your organisation. If it is not, Remotle stops and shows “This machine could not be verified. Do not enter credentials.”
- Your device and the workstation then prove to each other that they hold the same single-use session secret. A copied certificate is not enough to impersonate a workstation.
- Each connection is authorised by a token that lasts 5 minutes and can be used once.
- Workstation certificates last 30 days and renew themselves.
Sign-in
Section titled “Sign-in”- Users sign in with their Microsoft work account, or with a single-use email link that expires after 15 minutes. On iPad and iPhone, users can also sign in with Apple.
- Microsoft sign-in follows your organisation’s Conditional Access and multifactor authentication policies.
- On Windows, the saved sign-in is held in Windows Credential Manager.
Workstation access
Section titled “Workstation access”- Users can only connect to workstations their administrator has assigned to them.
- Administrators can turn off USB devices, and copy and paste in each direction, for the whole organisation. See Device Features.
Updates
Section titled “Updates”Every update must be confirmed by three independent sources before it installs, must match its SHA-256 checksum, and must be signed by Computle Limited. Windows drivers are signed by Microsoft.
See Privacy and Data.