Security & Responsible Disclosure

Last updated: September 3, 2026

1. Our Security Architecture

  • All remote sessions — screen, clipboard, file transfer, and input — are end-to-end encrypted with AES-256-GCM, keyed via X25519 ECDH so only the two devices in a session ever hold the shared key
  • Our relay servers facilitate connection establishment and, when peer-to-peer is unavailable, encrypted stream relay — they cannot decrypt session content
  • Passwords are hashed with BCrypt and never stored in plaintext; sensitive fields such as two-factor secrets are encrypted at rest
  • All data in transit to our servers uses TLS 1.2+
  • Rate limiting, device-ownership verification, and role-based access control (RBAC) are enforced on every session, command, and file-transfer request
  • Two-factor authentication (TOTP) is available on every account

2. Reporting a Vulnerability

We take security reports seriously and welcome responsible disclosure from researchers. If you believe you have found a security vulnerability in RemoteAI, please report it to:

security@remoteai.pro

Please include, where possible:

  • A description of the vulnerability and its potential impact
  • Steps to reproduce, including affected component (desktop, mobile, web, or backend)
  • Any proof-of-concept code or screenshots

3. Our Commitment

  • We will acknowledge your report within 3 business days
  • We will investigate and keep you informed of progress toward a fix
  • We will not pursue legal action against researchers who report in good faith, avoid privacy violations and data destruction, and give us reasonable time to remediate before public disclosure
  • We will credit researchers who wish to be credited once a fix ships, unless anonymity is requested

4. Safe Harbor

Testing conducted in good faith under this policy — limited to your own account and devices you own or are authorised to test, without accessing, modifying, or destroying other users' data, and without service disruption (no denial-of-service testing) — is authorised activity under our Acceptable Use Policy. Testing against accounts or devices you do not own or control is out of scope and not authorised.

5. Out of Scope

  • Social engineering or phishing of RemoteAI staff or users
  • Denial-of-service or load testing against our infrastructure
  • Automated scanning that generates significant traffic without prior coordination
  • Physical access attacks
  • Reports generated purely by automated vulnerability scanners without manual verification of exploitability

6. Contact

Security reports: security@remoteai.pro. General support: Help & Support in the app.