End-to-end encryption
Session streams are encrypted end to end with AES-256 and ephemeral keys. Relay servers forward encrypted packets they cannot read.
Security
Security is the product, not a feature
Remote access is a privileged connection into your organisation. InayaDesk is designed with zero-trust principles so only the right people reach the right devices.
Defence in depth
Protection at every layer
Encrypted transport
Every connection to InayaDesk services uses TLS 1.3 with modern cipher suites and HSTS.
Multi-factor authentication
TOTP, passkeys and SSO-enforced MFA. Admins can require MFA for every user in the organisation.
Device approval
New devices must be approved before they can sign in, stopping stolen credentials at the door.
Granular permissions
Role-based access control by team, device group and action, including view-only and file-transfer-disabled sessions.
User consent & visibility
Attended sessions require the user to accept, and a visible banner shows when a session is active.
Audit logging
Every session, file transfer and admin change is logged with who, what, when and from where, and can be streamed to your SIEM.
On-premise relays
Enterprise customers can route session traffic through self-hosted relays so it never leaves their network.
Data residency
Choose where account data is stored, with regional hosting options for the EU, US, UK, India and the Middle East.
Operations
How we run InayaDesk securely
Security practices that apply to every part of our infrastructure and every person on our team.
- Least-privilege access to production, protected by hardware security keys
- Infrastructure defined as code, reviewed and deployed through CI
- Encryption at rest for databases, backups and file storage
- Dependency and container scanning on every build
- Independent penetration testing of the platform and agents
- Signed agent binaries and verified auto-updates
- Documented incident response with customer notification
- Background checks and annual security training for staff
Responsible disclosure
Found a vulnerability? Email security@inayadesk.com with the details and steps to reproduce. We acknowledge reports within two business days, keep you updated while we fix the issue, and credit researchers who report responsibly.
Please give us reasonable time to fix an issue before disclosing it, and don't access other customers' data or degrade the service while testing.
Compliance & documentation
We support customers through vendor security reviews with a completed security questionnaire, architecture overview, data processing agreement and sub-processor list.
Have a security review coming up?
Our team will walk your security and compliance stakeholders through InayaDesk's architecture.