Peer-to-Peer (P2P)
Screen, audio and input flow directly between client and host. Only connection brokering (signaling) runs over our Swiss server — media data never touches it.
Features
Everything remote support needs — nothing it doesn't.
Every feature was developed by asking: «Do IT providers and support teams in Switzerland actually need this?» No bloated feature set, no hidden limits. Current version: 0.5.4.
Connection & Architecture
AES-256-GCM, end-to-end
Each session uses an ephemeral AES-256-GCM key that is discarded once the session ends. The key exchange happens per session via ECDH (P-256).
NAT traversal (UDP hole punching)
Connection setup via STUN and UDP hole punching — in most home and corporate networks without port forwarding. Multiple paths are tried in parallel, the fastest wins. Own STUN server in Switzerland.
Own, adaptive codec
Our own, content-adaptive screen codec: hardware-accelerated (AVX2, multi-core, GPU), efficient when idle and smooth when active. The frame rate adapts to network and content (up to 60 FPS).
Productivity
Multi-monitor support
Switch between the host's screens — via keyboard shortcut or dropdown. Also detects monitors plugged in later.
Multiple sessions in parallel
Several hosts open at once in tabs, each connection with its own monitor, audio and file manager. Tabs can be torn out into their own window and dragged back in.
File transfer
Drag-and-drop onto the stream plus a file manager over the local and the remote filesystem (list, create folder, rename, delete) — with progress display and cancel.
Clipboard sync
Text is synchronised bidirectionally between client and host.
System audio
Audio from the remote device is delivered in the stream (music, conferences, system sounds) — Windows WASAPI loopback and macOS ScreenCaptureKit.
Session history
Every connection is logged: who, when, how long, which host.
Unattended access (Pro)
Always-connected hosts
Install the host as a service — access without anyone on site, 24/7.
Hardware-bound device tokens
Each device receives a token bound to the hardware (TPM on Windows, Secure Enclave on Apple Silicon, TPM 2.0 on Linux with tpm2-tools). Copying the token file to another machine renders it invalid.
Host management
Central overview of all devices in the portal: online status, last connection, OS version, IP. Drag-and-drop into folders.
Groups & roles
Sort hosts into logical groups (customers, sites, servers). Roles: admin, supporter, read-only.
Passkey support
Hardware-bound authentication instead of passwords (WebAuthn/FIDO2).
90-day token rotation
Device tokens renew automatically without user action. Auditable in the portal.
Admin & user management
Company administrator
The Pro subscription includes one administrator account with full control over the organisation. Additional users are added via email invitation (link valid 24h); MFA setup is enforced on first login.
Named logins instead of shared accounts
Every user gets their own login. Account sharing is explicitly forbidden in the terms — audit trail, offboarding and compliance all depend on individual accountability.
Role-based permissions
Three roles: admin (full access, billing), supporter (sessions, host groups), read-only (session logs only). Admins can change roles at any time.
Per-user pricing
Every user beyond the base admin costs CHF 4.90/month — as an add-on to the Pro plan. Scales linearly, no bundle tiers.
Session logs & audit trail
Immutable record of connections, file transfers and permission changes. Filterable by user. GDPR Art. 30 ready.
SSO ready
SAML and OIDC are on the Pro roadmap for 2027. Until then: passkey login as a phishing-resistant alternative.
Two-factor mandatory
Required for admin roles, recommended for supporter/read-only. New users must set up MFA on first login (TOTP or passkey).
Remote kill switch
Admin can remotely disconnect a connected host and remove it from the account. Also for emergency offboarding of individual users on suspicion.
Platforms
Windows 10/11
EV-signed installer, automatic updates, hardware-bound device tokens via TPM.
macOS (Apple Silicon)
Apple Developer ID signed + notarised by Apple. ScreenCaptureKit for picture and system audio. Details.
Linux & Pi
.deb for Ubuntu/Debian, .rpm for Fedora/RHEL, arm64 for Raspberry Pi 4/5. Wayland and X11. Details.
Web portal
Invoices, host management, team management — modern and mobile-friendly.
Frequently asked questions
Does screen data ever travel through WinDesk servers?
No. Screen, audio and input flow only directly between the devices (peer-to-peer). Only connection brokering (signaling) runs over our Swiss server — media content never reaches it.
Which platforms does WinDesk run on?
Windows 10/11, macOS (Apple Silicon) and Linux (x86 and arm64, incl. Raspberry Pi 4/5) — under X11 and Wayland. In Windows service mode the host also captures the lock screen and UAC dialogs.
Is there an API?
A REST API for host management and session logs, plus webhooks for session events, are on the Pro roadmap.