Security
The user always knows.
Trust is the main reason to choose Core.Assist. Every session starts with consent, stays visible on screen and ends up in the audit log.
Consent first
Attended sessions need the user to accept and read a one-time 5-digit code to the technician. Nobody connects to a person who has not agreed.
- The prompt names the technician, the reason and the allowed features
- Requests expire after 60 seconds
- Deny is always one click away
Mara Jansen wants to view and control this computer
Reason: Printer driver problem on the finance floor
Allowed features
- View screen
- Mouse and keyboard
- Files
- Commands
- Clipboard
Request expires in 60 seconds
Read this code to your technician
One-time code. The session starts once it matches.
Always visible
A session bar shows for every session, including Manage sessions. The user can disconnect at any time.
- Remote control: a red bar with technician, timer, view-only toggle and Disconnect
- Manage: a smaller red banner that says the screen is not shared
- Red is reserved for this signal, so it always means someone is helping
Unattended, done safely
A per-PC unattended password unlocks access. The console sends only a cryptographic proof, never the password.
- Proof is derived with PBKDF2
- Failed attempts are locked out
- Manage sessions use the same unattended password
End-to-end encrypted
Session traffic is encrypted between the console and the PC. The relay server cannot read screens, files or commands.
- Applies to remote control, files and commands
- Remote Desktop runs through an encrypted tunnel
Signed updates
Every update is signed with an offline Ed25519 key and checked twice before it installs: by the update server and by the PC.
- Staged rollout and rollback
- Update feed served from Cloudflare
- Covers client, console and agents
Audit log
Every session, accept, deny, command and file action is logged on the PC and on the server.
- Review it in the admin panel
- Admin access is protected by 2FA
3
Active sessions
128
Clients online
9
Technicians
- 14:02Mara Jansen connected to DEMO-PC-014Accepted
- 13:47Sam Okafor managed DEMO-SRV-02Manage
- 13:20Request from DEMO-PC-033Denied
Self-hosted
Sessions, accounts and logs stay on your own server. Only signed update packages are served from a CDN.
- One small Rust service behind Caddy (HTTPS)
- Linux (Debian) or Windows, with Docker or systemd
- Designed with GDPR in mind
Want to see it for yourself?
We will show a live session, the session bar and the audit log on a demo server.