Skip to content
Remotle Docs

Network and Security

Remotle: Security

This page describes how Remotle protects sessions and workstations. It is for IT and security teams.

Connections

Section titled “Connections”
WorkstationComputleYour deviceWorkstationComputleYour deviceSession, TLS 1.3 end to endOutbound connectionOutbound connectionIntroduction, single-use tokenCheck the workstation certificateProve the single-use session secretProve the single-use session secret
WorkstationComputleYour deviceWorkstationComputleYour deviceSession, TLS 1.3 end to endOutbound connectionOutbound connectionIntroduction, single-use tokenCheck the workstation certificateProve the single-use session secretProve the single-use session secret
Inbound connectionsNone. Workstations do not listen on any network port. Both your device and the workstation connect outbound to Computle, which introduces them.
EncryptionEvery session is encrypted end to end with TLS 1.3, between your device and the workstation. A Computle relay forwards encrypted data and cannot read it.
Workstation certificateChecked by your device before a session starts. It must be issued by Computle for that exact workstation and your organisation. If it is not, Remotle stops and shows “This machine could not be verified. Do not enter credentials.”
Session secretYour device and the workstation prove to each other that they hold the same single-use session secret. A copied certificate is not enough to impersonate a workstation.
Connection tokenLasts 5 minutes and can be used once.
Certificate lifetimeWorkstation certificates last 30 days and renew themselves.

Sign-in

Section titled “Sign-in”
MethodsMicrosoft work account, or a single-use email link that expires after 15 minutes. On iPad and iPhone, users can also sign in with Apple.
PoliciesMicrosoft sign-in follows your organisation’s Conditional Access and multifactor authentication policies.
Saved sign-inOn Windows, held in Windows Credential Manager.

Workstation access

Section titled “Workstation access”
Who can connectUsers can only connect to workstations their administrator has assigned to them.
USB and clipboardAdministrators can turn off USB devices, and copy and paste in each direction, for the whole organisation. See Device Features.

Updates

Section titled “Updates”

Every update must be confirmed by three independent sources before it installs, must match its SHA-256 checksum, and must be signed by Computle Limited. Windows drivers are signed by Microsoft.

Data

Section titled “Data”

See Privacy and Data.