Your screen is nobody else’s business.
Sessions are encrypted end to end between the two devices. Our servers help them find each other — and when they relay, they only carry data they cannot read.
Three locks on every session
Each layer works on its own, so a weakness in one never opens the others.
A pinned TLS connection
Every device talks to our servers over TLS and checks their certificate against the one built into the app, so a fake server is refused.
End-to-end encryption
The two devices agree on fresh keys for each session. Screen, input, files, chat and port forwarding travel encrypted with AES-256-GCM, whether direct or through the relay.
A yes from the person — or a password
Nothing starts until the person at the desk accepts, or until you prove the unattended password set on that PC. The password itself never travels in plain text.
The person at the desk stays in charge
See who is asking
Every request shows the name and ID of who wants to connect before anything is shared.
Choose what is allowed
View only, control, files — the person at the desk decides, and can change it mid-session.
End it in one click
A small panel stays on screen during the session, with a button that ends it at once.
No forgotten sessions
If the other side goes silent, the desk ends the session by itself within seconds.
A history on every PC
Each PC keeps its own list of who connected and when; Team and Business add a shared audit log.
Signed updates
Updates and maintenance packages are signed and checked before they install — and rolled back if a step fails.
What we keep
- Your account: name, email and team members
- Your devices: desk IDs, names and online status
- Session records: who connected to which desk, when and for how long
- Billing records and invoices, as the law requires
What we can’t see
- What is on the screen during a session
- What you type or click
- The files you send or the messages you write
- Unattended passwords — they stay on the PC that set them
The technical details
For the IT person who has to sign off on remote access.
- SESSION KEYS
- A fresh ECDH P-256 key pair on each side for every session. HKDF-SHA256 turns the shared secret into separate keys for each direction.
- SESSION ENCRYPTION
- AES-256-GCM for screen, video, input, files, chat and port forwarding — the same whether the path is direct or through the relay.
- TO OUR SERVERS
- TLS, with the servers’ certificate pinned in the app, so a look-alike server is refused.
- IDENTITY
- Each operator signs with its own ECDSA P-256 key; corporate-managed PCs accept management only from their admins’ keys.
- UPDATES
- Update and maintenance packages are signed and checked against a pinned signer before they install, and rolled back if a step fails.
- AUDIT TRAIL
- Every PC records who connected and when; commands sent to a PC are shown on its screen and kept in the audit log.
Where your data is
Every company that runs a part of VVDesk for us, what it does and where. All servers that handle your account are in Germany.
| COMPANY | WHAT IT DOES | WHERE |
|---|---|---|
| Hetzner Online GmbH | Connection and relay servers, and the account server | Germany |
| Amazon Web Services | Account database; installer and update downloads; passes encrypted connections through for installs that still use our old server address | Frankfurt, Germany |
| Hostinger | This website, and the emails we send you (codes and invitations) | Website in Frankfurt, Germany |
| reCAPTCHA: checks that sign-ups and contact messages come from people | Google’s network |
Our connection and relay servers run in Germany. On Business you can run VVDesk Server inside your own network instead.
Certifications
VVDesk is not ISO 27001 or SOC 2 certified yet. Instead, this page describes exactly how it works — ask us for anything your own audit needs.
Found a weakness?
Tell us privately at support@vvoffice.co with “Security” in the subject. We answer within two working days and credit you once it is fixed.
Our security.txt →Leaving VVDesk
Write to support@vvoffice.co from your account’s email and we delete your account, team and device list. Invoices are kept as long as tax law requires.
Privacy policy
How VVOffice handles personal data across VVOffice and VVDesk →