Security/how it works
Enforced where
the data lives.
Access, clipboard, file transfer and recording are enforced on the server side of the stream, not in the browser.
something enforced at every hop
Pixels, not files
Applications and their data stay on managed Windows hosts. Your users get a rendered stream, and files and clipboard cross only if your policy allows.
Policy on the server side
Clipboard and file-transfer rules are enforced by the broker that carries the stream, so a user can't switch them back on from the browser.
Revocation that takes effect now
Remove someone or change their role and their very next request is refused. Nothing waits for a token to run out.
Four hops.
Checked at every one.
Identity is checked on every request, not once per login.
- SSO over OIDC and SAML, or email and password (hashed with argon2).
- Roles (owner, admin, member and viewer) are scoped to your organization.
- Each request is checked against a token version. Demote or remove someone and their next request fails, with no waiting for a token to expire.
What happens
role change → tokenVersion bump → next request: 401 “token revoked”What you control.
Identity & SSO
Single sign-on over OIDC and SAML, or email and password hashed with argon2. Owner, admin, member and viewer roles, scoped to your organization.
Sharing without handing over control
Invite others to watch a live session through links with their own expiry and a viewer-only role. One person drives; control can be handed off or a viewer removed.
Clipboard & file transfer
Allow or block each, per app and per organization, for app sessions and full-desktop sessions alike.
Policy is read when a session launches. A change applies to new sessions, not ones already running.
Watermarks in the pixels
Show the viewer's email and the time across the stream. It's drawn into the frames, not layered over them in the page, so a photo of the screen carries it too.
Recording & replay
Record sessions per app or organization. Recordings are stored in object storage and replayed frame-for-frame through a short-lived signed link.
Audit trail
Account and automation events are written to an audit log, and every Copilot run keeps a step-by-step record of what it did on someone's behalf.
Honest about
the boundary.
Sessions are separated at the Windows account level: each gets its own local user on a managed host, and that account and its profile are removed (or scrubbed before reuse, when warm pooling is on) as soon as the session ends.
That is not a separate virtual machine for every session, and we don't describe it as one. If your threat model needs stronger separation, talk to us about dedicated hosts for your organization.