Our commitment to keeping your remote sessions private.
Every NetDesk session negotiates an ephemeral ECDH P-256 key exchange and encrypts all media with AES-256-GCM, per frame, with a fresh nonce. The relay server forwards only opaque ciphertext — it cannot decrypt your screen, input, files or clipboard. Only the two endpoints hold the keys.
The host password never leaves your machine in the clear: the viewer proves knowledge of it with a PBKDF2-HMAC-SHA256 (200,000 iterations) challenge/response, throttled on failure. Optional TOTP two-factor adds an authenticator code at connect. An optional registration key restricts which hosts may register with your server.
All traffic runs over TLS (WSS) to your server. We recommend a real certificate (Let's Encrypt); NetDesk ships automation for it. HTTP is available only for localhost/LAN testing.
NetDesk is self-hosted. There is no NetDesk cloud in the path. Your session metadata, accounts and audit logs live on your server. Nothing is sent to a third party.
The entire stack is open source and auditable. Don't trust our word — read the code at github.com/faysaliteng/netdesk.
Found a vulnerability? Email security@netdesk.space. We respond within 72 hours and credit reporters.