How Secure Desk works — a support session, not VDI
A technician connects to a real Windows machine the user already has. Nothing is streamed from a datacenter desktop. Both ends dial out to the relay you run. The relay never gets a key.
Both ends dial out
The user runs the portable client; the console opens in a browser. Each side connects outbound over WSS and presents the session id plus its token. Neither needs a public IP or an inbound firewall rule. The relay pairs them and nothing else.
A 6-digit SAS
Both ends derive the same short authentication string from the agreed key material. Read it aloud to the user. A relay that tampered with the exchange is exposed immediately.
ECDH, then the relay forwards ciphertext
The two endpoints run an ECDH exchange through the relay and derive their own AES-256-GCM keys. Compare the 6-digit code, then view the screen, take mouse and keyboard, open a SYSTEM shell, move files, or start a voice call. Compromise the relay and you get pairing metadata and ciphertext, not screens or keystrokes.
AI-agent desktops
Enrol each Windows desktop once. The installed service stays up across logon and lock. Backstage opens a SYSTEM shell without taking the agent's screen. No inbound RDP to the agent subnet. Secure Desk does not run the agents; it is how you reach them.
Start free or read thesecurity model.