NodalDesk
ES Sign in

Security

Only your devices can read your sessions.

This is what the NodalDesk code does, plainly: how a session travels, what the relay sees, when the connection is P2P and what an AI can do on your machine.

Over the internet

End-to-end encryption, always.

Key agreementECDH P-256 with fresh ephemeral keys for every session
IdentityECDSA P-256 signature over the handshake in both directions: machine and app prove themselves to each other
Key derivationHKDF-SHA256, a separate key per direction and per channel
EncryptionAES-256-GCM with replay protection
CoverageScreen, input, audio, clipboard, notifications, terminal, browser and files
What the relay seesOnly encrypted frames. It has no keys and cannot read the session
If something failsNo encryption, no session: the connection closes and never falls back to a readable route
Machine keyChecked against the one published in your account before it is pinned; if your account does not answer, nothing is pinned. If the device has not published its key yet (older versions, or before its first check-in with the account), the first one it presents is pinned. A later change blocks the connection

P2P

Direct between your devices when the network allows it.

TransportP2P v2: UDP hole punching with STUN discovery
EncryptionAES-256-GCM under a key derived from the encrypted handshake; the relay never sees it
What goes directThe video. Input and everything else stay on the encrypted channel
DefaultYes, in the desktop app and on Android, both as viewer and as machine
If the network blocks itIt continues through the relay, still encrypted
BrowserNo P2P: browsers have no UDP. It goes through the relay, encrypted

Local network

At home, direct and with the machine certificate pinned.

On your local network the app talks to the machine directly over TLS. Before trusting its certificate, the machine signs a challenge with its key, the same one your account knows. Only then is the certificate pinned, and any later change raises a warning. If your account cannot confirm it, the app asks you before trusting it.

AI channel

An AI can operate your machine, with your permission.

ConnectionMCP, with an account or machine token; no QR or PIN
Tools45, by organ: see, touch, capture audio, clipboard, execute, browse and carry files, plus proprioception
On arrivalView-only. You choose to give it control or keep it watching, and you can block or revoke at any time
EncryptionThe same end-to-end channel a person uses

The full tool list is in llms-full.txt and the house rules in the letter to the AI.

The cloud

What the cloud keeps and what it does not.

The NodalDesk cloud, hosted in the EU, keeps your account, machine inventory, permissions and activity logs. It does not keep your screen, your keystrokes, your files or your terminal: those travel encrypted between your devices.

Questions

Frequently asked questions.

Does NodalDesk encrypt sessions end to end?

Yes. Over the internet every session is end-to-end encrypted between your devices: screen, input, audio, clipboard, files and terminal. The NodalDesk relay only forwards encrypted data it cannot read. If encryption cannot be established, the session does not open.

Does NodalDesk support P2P connections?

Yes. With P2P v2 the video travels directly between the machine and the app (UDP hole punching with STUN), encrypted with AES-256-GCM under a key the relay never sees. The desktop app and Android try it by default; if the network does not allow it, the session continues through the relay, still encrypted. Browsers cannot use P2P because they have no UDP.

What does the NodalDesk cloud store?

Your account, your machine inventory, permissions and activity logs, hosted in the EU. The content of your sessions never passes through the cloud in the clear and is not stored.

Can an AI control my computer with NodalDesk?

Yes, with your permission. An AI agent connects over MCP with 45 tools (see the screen through accessibility, touch, capture audio, clipboard, execute, browse and carry files). It starts view-only until you choose to give it control, and its traffic uses the same encrypted channel.