End-to-end encryption

End-to-end encryption protects data between the two ends of a session so that only those endpoints can read it. Any intermediate relays carry an already-encrypted stream.

In Ubidesk, every session is encrypted end to end with TLS 1.3 for transport and AES-256-GCM for the stream. Keys are negotiated through a per-session ECDH exchange and never stored.

In practice

In practical terms, neither the network nor Ubidesk relays can read a session’s content. Encryption covers the screen, mouse, keyboard and file transfers.