Architecture & encryption
Nobody can read your sessions. Not even us.
Every session is encrypted end to end with a key that exists only for that session. Our servers carry the traffic without being able to read it, and the network only speaks on port 443.
How a session is encrypted
Every connection follows the same path, from the first byte to the last.
- TLS 1.3 everywhere — no legacy protocol versions, no exceptions.
- AES-256-GCM for session data — every packet is encrypted and authenticated.
- ECDH key exchange — keys are negotiated directly between the two endpoints, never through our servers.
- A unique key per session — a key is never reused, and our servers cannot decrypt the content.
- Network limited to port 443 — one controlled, encrypted channel.
- Direct P2P whenever possible — otherwise, regional relays forward the stream without reading it, keeping latency low.
- Security whitepaper — read the Trust Center or contact security@ubidesk.io.
Accounts protected before the first session
A session’s best defense starts at sign-in.
- Mandatory MFA for all accounts — TOTP, passkeys, or FIDO2, with no way to opt out.
- SAML and OIDC SSO on Business — connect your teams through Entra ID, Google, or Okta.
- SCIM provisioning (beta) — create and revoke accounts from your own directory.
- Granular roles — each member only sees what they need.
- Just-in-time access — privileges that rise for one task, then close again.
- Second-admin approval — sensitive actions require two people.
- Network restrictions — IP allowlists, geographic zones, and time windows.
Your infrastructure, your rules
For organizations that must control everything, the Enterprise plan runs on your own premises.
- On-prem or private cloud — your servers, your network, your policies.
- Air-gapped mode (beta) — for environments disconnected from the internet.
Contact sécurité
Security
FAQ
Frequently asked questions
What happens when P2P is not possible?
The session goes through regional relays that forward an already-encrypted stream. They cannot read it, because the keys exist only on the two endpoints.
Why a unique key per session?
If one key is compromised, only one session is exposed. Mass decryption becomes impossible, including for our own teams.
Can I restrict who connects?
Yes: IP allowlists, geographic restrictions, and time windows, on top of SSO and mandatory MFA.
Is MFA really mandatory?
Yes, for all accounts. It cannot be switched off: one weak account would put your customers’ sessions at risk.
Nobody can read your sessions. Not even us.
Every session is encrypted end to end with a key that exists only for that session. Our servers carry the traffic without being able to read it, and the network only speaks on port 443.
No credit card · Free for personal use