Keep data from leaving
a remote session.
Putting an application behind a remote session keeps its files on the server, which is a good start. But people can still move information out through the clipboard, file transfer, screenshots and a phone camera. Each has a different answer.
Where data actually escapes
In remote sessions the usual routes are:
- Copy and paste out of the session.
- File upload and download.
- Screenshots and screen recording on the user's device.
- Photographing the screen.
Enforce it on the wire
Hiding a button in the interface is not a control, because anyone able to send the message can still send it. In Onscryn, clipboard and file-transfer policy is enforced by the broker that carries the stream, and blocked messages are dropped.
Policy can be set per application and per organization, so a finance app can be locked down while a training app stays open.
Watermarks
An optional watermark with the viewer's identity and the time is burned into the streamed pixels. Because it is in the picture itself, a photo or screen capture still carries it. That makes leaks traceable and discourages them, though it can't stop someone taking a picture.
See what happened and shut it off
Recording lets you replay a session after the fact, and the audit log records account and admin activity. If someone should no longer have access, removing them takes effect on their next request.
Be honest about the limits
No control is absolute. The goal is to make leaking harder, more visible and attributable. Data-loss controls are plan-dependent.
Different data, different rules
Not every application needs the same controls. A training app can allow copy and paste. A finance system might block the clipboard and file transfer entirely. Because policy is set per application and per organization, you can match the control to the risk instead of applying one blunt rule everywhere.
What the person sees
When something is blocked, the broker drops those messages. The person simply cannot paste into or out of the session. Nothing is exposed that they could bypass by changing the interface, because the control is on the stream rather than in the page.
Layers that work together
No single control is enough, so combine them.
- Sign-in and roles decide who can open the application at all.
- Clipboard and file-transfer policy decides what can cross.
- The watermark makes images of the screen traceable.
- Recording shows what happened inside the session.
- Instant revocation ends access when it should end.
What no tool can promise
A determined person with a phone can photograph a screen. The honest position is that you cannot stop that, but you can make it traceable and risky for them. Be wary of any product that promises to make leaks impossible.
Illustration
A worked example
Imagine a company that lets an outside team work in its claims system. The risk is a bulk copy of customer records.
They block the clipboard and file transfer for that application, turn on the watermark so every frame carries the viewer and time, and record sessions. The outside team can do the job, cannot move data out through the session, and any photo of the screen is attributable to the person who took it.
A data-control setup checklist
- List the applications that hold sensitive data.
- Decide per application whether clipboard and file transfer are allowed.
- Turn on the watermark for the applications where attribution matters.
- Decide whether to record, and who may watch recordings.
- Confirm how quickly you can remove someone's access.
- Check which of these controls your plan includes.
Related features
Questions.
Yes. Clipboard can be switched off per app or per organization, and the broker drops the messages.