Security by design
Our server can't see your session — it's designed that way.
Zero-knowledge server
Data flows directly between peers. The server is only on the introduction and, when needed, relay path; it never sees content, keys or passwords.
End-to-end encryption
All session traffic (screen, input, files) is end-to-end encrypted. Even while relaying, the server only forwards opaque bytes and can't decrypt them.
Local keys
Private keys never leave the device under any circumstances; generation and storage are entirely local.
Certificate pinning
The peer's identity is verified with signed certificates at session start; pinning is applied against MITM.
Tamper detection
Any tampering is instantly detected via AEAD tags.
Every connection under your control
Incoming connection prompt
On every attended connection, a visible notification and optional explicit approval on the host side.
Brute-force protection
Progressive delay/lockout on password attempts — both at the endpoint and the server.
Allow / Block list
Pro: allow only specific IDs or block specific IDs.
Secure password storage
Persistent access passwords are stored with Argon2id/scrypt; never in plain text.
Per-connection 2FA
Pro: optional second factor for persistent access.
Local audit log
Every connection is logged locally with ID, direction, time and duration.
Data residency and on-premise
GDPR/KVKK are first-class citizens. By running your own rendezvous/relay server you can deploy so no data ever leaves your organization.
- Fully on-premise, air-gapped operation
- Routing/relay can be restricted to permitted regions only
- Signed updates (Ed25519) and rollback protection
- Least-privilege principle — no unnecessary system permissions requested
Post-quantum ready
Optional hybrid post-quantum cryptography: ML-KEM for key wrapping, ML-DSA for signatures. Today's security against tomorrow's threats.
- Hybrid PQC key exchange (ML-KEM)
- ML-DSA signature option
- Security full in every edition — never tiered
See the security for yourself
Download ArmoConnect and set up your first end-to-end encrypted session in seconds.