Consent first, encrypted end to end

Nobody connects without approval

Every session is approved by the person at the far end — a click or a device PIN. While anyone is connected, a red “being viewed — Stop” bar is shown across the desktop (one per monitor), it cannot be hidden, remote clicks on it are ignored, and Stop ends the session instantly. Unattended access for company devices is off by default and, when enabled, is still shown and logged.

End-to-end encryption

Two devices pair with a one-time 6-digit code shown on one and typed on the other, and pin each other’s long-term key. All traffic afterwards is signed and sealed with AES-256-GCM under a per-pair key, with a replay guard. The live screen travels directly between the two PCs where possible; our relay only helps them find each other and, as a fallback, carries already-encrypted bytes. A compromised relay can never watch your screen.

UAC the safe way

During an approved session, a small consented Windows service can show and operate the UAC / secure-desktop prompt so the technician can see it and click Yes — using the machine’s own local administrator. A password is never typed or transmitted from the remote side. If secure-desktop control isn’t available on a machine, the person simply clicks the prompt themselves while sharing. Every elevation is logged.

What we store

Session metadata — who connected to which device, when, for how long, in which mode, and the consent method — so you have an audit trail. We do not store the content of your screen, your files or your chat. Any data you choose to sync is stored as ciphertext only.

Where it runs

UCA Mesh is operated by a solo developer. The server is hosted at IONOS in Kansas City, USA; connections to it use HTTPS/WSS. A European relay (TURN) is planned as the service grows. See the privacy policy and imprint.