Peer-to-Peer (P2P)
Screen, audio and input flow directly between client and host. Only connection brokering (signaling) runs over our Swiss server — media data never touches it.
Swiss company · GDPR-compliant
Features
Everything remote support needs — nothing it doesn't.
Every feature was developed by asking: “Do IT providers and support teams in Switzerland actually need this?” No bloated feature set, no hidden limits. Current version: 0.5.7.
Signaling · Switzerlandconnection setup only
Connection & Architecture
AES-256-GCM, end-to-end
Each session uses an ephemeral AES-256-GCM key that is discarded once the session ends. The key exchange happens per session via ECDH (P-256).
NAT traversal (UDP hole punching)
Connection setup via STUN and UDP hole punching — in most home and corporate networks without port forwarding. Multiple paths are tried in parallel, the fastest wins. Own STUN server in Switzerland.
Our own adaptive codec
Our own, content-adaptive screen codec: accelerated with AVX2 and multiple cores (on Windows the GPU detects changed screen areas), efficient when idle and smooth when active. The frame rate adapts to network and content (up to 30 FPS).
0
hops via the cloud
30
FPS when active
256
bit AES-GCM, ephemeral
CH
location of signalling
Productivity
Multi-monitor support
Switch between the host's screens via the selection list. Newly connected monitors appear the next time you open the list.
Multiple sessions in parallel
Several hosts open at once in tabs, each connection with its own monitor, audio and file manager. Tabs can be torn out into their own window and dragged back in.
File transfer
Drag-and-drop onto the stream plus a file manager over the local and the remote filesystem (list, create folder, rename, delete) — with progress display and cancel.
Clipboard sync
Text is synchronised bidirectionally between client and host (not in service mode).
System audio
Audio from the remote device is delivered in the stream (music, conferences, system sounds) — Windows WASAPI loopback and macOS ScreenCaptureKit (not in service mode).
Session history
Every connection is logged: who, when, how long, which host.
Unattended access (Pro)
Always-connected hosts
Install the host as a service — access without anyone on site, 24/7.
Sign-in bound to the security chip
The host’s sign-in is bound to the device’s security chip where available (TPM on Windows and Linux, Secure Enclave on Mac), and every pairing is additionally tied to a hardware fingerprint of the host.
Host management
Overview of all hosts in the portal: online or not, last reachable, last connected. Drag-and-drop into folders.
Groups & roles
Sort hosts into logical groups (customers, sites, servers). Four roles: owner, admin, supporter, read-only.
Passkey support
Hardware-bound authentication instead of passwords (WebAuthn/FIDO2).
One-click revocation
Every link can be revoked in the portal at once. Each new link triggers a security email.
Admin & user management
Company administrator
The Pro subscription includes one administrator account with full control over the organisation. Additional users are added via email invitation (link valid 24h); administrators and all accounts with Pro set up two-factor authentication right after their first login.
Named logins instead of shared accounts
Every user gets their own login. Account sharing is explicitly forbidden in the terms — audit trail, offboarding and compliance all depend on individual accountability.
Role-based permissions
Four roles: owner (everything, incl. billing), admin (manage team and hosts), supporter (start sessions), read-only (view hosts and session history). Hosts you mark as private are visible to no one else on the team. Admins can change roles at any time.
Per-user pricing
Every user beyond the base admin costs CHF 7.90/month — as an add-on to the Pro plan. Scales linearly, no bundle tiers.
Session logs & audit trail
Sessions, new and revoked pairings and role changes are logged. Filter the session history by host and date.
SSO ready
SAML and OIDC are on the Pro roadmap for 2027. Until then: passkey login as a phishing-resistant alternative.
Two-factor mandatory
Required for admin roles, recommended for supporter/read-only. Administrators and all accounts with Pro set up two-factor authentication (TOTP or passkey) right after their first login.
Revoke access at any time
You can revoke a host pairing in the portal at any time; the host then loses unattended access. If you remove a team member, their pairings end too.
Platforms
Windows 10/11
EV-signed installer, automatic updates, host sign-in bound to the TPM where available.
macOS (Apple Silicon)
Apple Developer ID signed + notarised by Apple. ScreenCaptureKit for picture and system audio. Details.
Linux & Pi
.deb for Ubuntu/Debian, .rpm for Fedora/RHEL, arm64 for Raspberry Pi 4/5. Wayland and X11. Details.
Web portal
Invoices, host management, team management — modern and mobile-friendly.
Frequently asked questions
Does screen data ever travel through WinDesk servers?
No. Screen, audio and input flow only directly between the devices (peer-to-peer). Only connection brokering (signaling) runs over our Swiss server — media content never reaches it.
Which platforms does WinDesk run on?
Windows 10/11, macOS (Apple Silicon) and Linux (x86 and arm64, incl. Raspberry Pi 4/5) — under X11 and Wayland. In Windows service mode the host also captures the lock screen and UAC dialogs.
Is there an API?
A REST API for host management and session logs is on the Pro roadmap.
Ready to try WinDesk?
The Free plan is free for good — no account, no credit card, 2 hours of session time each month.