End-to-end encryption
Each session uses an ephemeral AES-256-GCM key negotiated via ECDH (P-256). The key is discarded after the session — even we cannot decrypt content afterwards.
Security from the ground up — not as an afterthought.
WinDesk has been designed as a security product from day one: peer-to-peer data flow, end-to-end encryption, hardware-bound tokens, Swiss hosting. No cloud bridge, no CLOUD Act, no need to trust us — the crypto guarantees it.
Security layers
Hardware-bound device tokens
Device tokens are encrypted with the Secure Enclave (Apple), TPM (Windows) or TPM 2.0 + tpm2-tools (Linux). Copying the token file to another machine renders it invalid. A hardware-fingerprint pin prevents token replay after hardware swaps.
Peer-to-peer data flow
Screen, audio and input flow directly between client and host. Our infrastructure never sees them — only the connection setup (signaling) passes through our Swiss server, and it carries no screen content. There is no media relay by design: if both endpoints sit behind symmetric NAT a direct connection may not establish, but your screen data never leaves the peer-to-peer path.
Two-factor mandatory for admin roles
TOTP or passkey (WebAuthn / FIDO2). New users must set up MFA on first login. Sensitive actions (revoke device, change role, cancel subscription) require a fresh password or passkey re-confirmation (10 min freshness).
Audit trail & session logs
Immutable record of connections, file transfers and permission changes. Filterable by user, exportable as CSV. GDPR Art. 30 ready.
Hosting in Switzerland and the EU
Servers in certified data centres in Falkenstein (Hetzner DE) and Helsinki (Hetzner FI), no US cloud. Swiss GmbH with no US parent — the CLOUD Act does not apply.
Compliance & standards
revFADP / GDPR
The Swiss revFADP (revised Federal Act on Data Protection) is largely equivalent to the GDPR. Our privacy notice documents processing per Art. 13 GDPR and Art. 19 revFADP.
GDPR Art. 32(1)(a)
Encryption at the state of the art: AES-256-GCM, ECDH P-256, perfect forward secrecy per session.
Code-signing certificates
Windows: DigiCert EV code-signing via SafeNet eToken. macOS: Apple Developer ID + Apple notarisation. Linux: signed .deb/.rpm packages via repository keys.
External audit
External security audit planned for Q4 2026. ISO 27001 certification as a medium-term target.
Protection against remote-support scams
Remote-desktop software is misused in an underground economy for tech-support scams, banking hijacks, romance scams and findom operations — AnyDesk has been a documented target for years. WinDesk is technically hardened against these use cases:
- Capability-token model with default-off permissions. Clipboard, file transfer and input injection require active host consent per session. Remote-controlling a banking app or exfiltrating data is therefore visibly blocked.
- Permanently visible session indicator. Banner on the host screen, not hideable by the technician. Screen-blackout hijacks become impossible.
- Emergency-stop key combination. Terminates the session client-side immediately.
- Anomaly detection. Atypical connection patterns trigger automatic reviews.
Plus: Lightnet Multimedia GmbH pursues abuse criminally, also internationally via the Budapest Convention and bilateral mutual legal assistance treaties. If you are a victim of a remote-support scam or want to report abuse: Report abuse + victim help page.
Frequently asked security questions
Can WinDesk staff read sessions?
No. End-to-end encryption technically guarantees that session content is unreadable to us. We only see metadata (who, when, how long, which IP) for billing and security auditing.
Does screen data ever pass through your server?
No. WinDesk uses no media relay. Screen, audio and input flow only peer-to-peer between the two endpoints. Only the connection setup (signaling) passes through our Swiss server, and it carries no screen content.
Is WinDesk subject to the US CLOUD Act?
No. Lightnet Multimedia GmbH is a Swiss limited-liability company seated in Graben (CH-3376). No US parent, all servers in Switzerland and Germany/Finland. The CLOUD Act does not apply.
How are device tokens stored?
Hardware-encrypted: Apple Silicon uses the Secure Enclave, Windows TPM 2.0, Linux tpm2-tools. Where no TPM is present (e.g. Pi 4) we fall back to libsecret keyring (DBus Secret Service).
Can you bypass my 2FA codes?
No. TOTP runs client-side, passkeys are hardware-bound. Without the second factor neither you nor we can get past login. If both factors are lost (password + auth device), recovery is only granted after identity verification.
Security without leap of faith
Free plan with no account, no credit card. AES-256-GCM applies to every session — including Free-plan sessions.