A signed agent on each endpoint, an outbound-only encrypted connection, and a browser console for your team. No on-premises servers to maintain, no inbound firewall rules, no VPN dependency.
There are only three moving parts, which is deliberate. Fewer components means fewer failure modes and a shorter security review.
A code-signed service installed on each managed device. It collects performance and inventory data, evaluates the policies assigned to that device, executes approved scripts and patch jobs, and brokers remote sessions. It is visible in the installed-programs list and can be removed with a documented command.
Hosted in United States data center regions for US accounts. It stores telemetry, inventory, policies, scripts and audit records; runs the alerting and automation engines; and serves the console API. Multi-tenant isolation is enforced at the data layer, not only in the interface.
Works in current versions of Chrome, Edge, Firefox and Safari. No plug-in, no desktop client required. Technicians authenticate with MFA, see only the tenants their role allows, and can launch a remote session directly from an alert or asset record.
Every agent initiates its own connection outbound to the platform over TCP port 443 using TLS 1.2 or higher. That single design decision removes most of the network work usually associated with deploying an RMM:
If an endpoint loses connectivity, the agent continues evaluating local policies, queues results, and uploads them when the link returns, so a laptop that spent a week offline does not create a gap in your patch evidence.
This is the plan our onboarding team walks through with new accounts. It is included with every plan; we do not charge implementation fees.
Choose whatever already works in your environment. The installer is per tenant, so devices land in the correct client automatically.
| Environment | Method | Notes |
|---|---|---|
| Windows domain | Group Policy software installation or startup script | MSI with silent switches and a tenant token |
| Microsoft Entra joined | Intune Win32 app deployment | Assign per device group; detection rule provided |
| Existing RMM in place | Push the installer as a script from your current tool | Agents can coexist during migration |
| macOS | Signed PKG, MDM deployment, or a single terminal command | Includes the profile guidance needed for screen recording and accessibility permissions |
| Linux | DEB and RPM packages, or a shell installer | Runs as a systemd service |
| Unmanaged / walk-up devices | Direct download link from the tenant | Useful for BYOD support and one-off servers |
macOS remote control requires the user or your MDM to grant screen recording and accessibility permissions; this is an Apple platform requirement, and we document the exact configuration profile keys needed.
Onboarding is not a hand-off into silence. Every account gets a documented escalation path and a review cadence.