End-to-end encryption in VVDesk, explained

Three layers

• To our servers: every device checks that it is really talking to VVDesk’s servers, so a fake server is refused.
• Between the devices: the session itself is encrypted end to end, so our servers and relays only ever handle data they cannot read.
• At the desk: nothing starts until the person at the desk accepts, or until the PC’s own unattended password is given.

New keys for every session

When a session starts, the two devices agree on new keys that only they know, using standard, well-reviewed cryptography. The keys are never sent anywhere and are thrown away when the session ends. If anything in the middle tried to interfere, the session would stop instead of becoming readable.

Everything goes through the same lock

Screen, mouse and keyboard, file transfers, chat and port forwarding all travel inside the session, encrypted with AES-256-GCM — whether the devices are connected directly or through the relay.

Passwords our servers never see

An unattended password is sent only inside the end-to-end encrypted session, and the PC checks it itself. Our servers and relays never see it, and it is not kept on our servers — it stays on the PC that set it.

What we can and cannot see

To connect devices we keep account details, device IDs and names, and records of who connected to which desk and when. We never see what is on the screen, what you type, or the files and messages in a session.