Secure remote desktop with end-to-end encryption
Karnex remote desktop sessions are end-to-end encrypted between the agent on the remote computer and the technician's Viewer. Karnex's servers relay the session without being able to read it, every computer has its own identity key that the Viewer checks, and access is limited by roles, groups, optional local approval and a complete audit log.
Start a free trial · Read the security architecture
Why it matters
A remote support tool can reach every computer you manage, so it's one of the most sensitive things you run. Buyers rightly ask who can see a session, how the tool knows it's talking to the right computer, who is allowed to connect, and what record is left afterwards.
How Karnex protects a session
- End-to-end encryption. The screen, input, clipboard, session file transfers, chat and sound are encrypted between the agent and the Viewer. Karnex brokers the connection and relays the encrypted traffic; it can't decrypt it.
- Computer identity. Each agent has a permanent identity key. The Viewers check it against the one registered with Karnex, remember it from the first connection, and stop and ask if it ever changes, much like an SSH host key.
- No inbound ports. The agent connects out to Karnex, so the computer doesn't need open firewall ports, port forwarding or a VPN.
- Signed software. Agents and Viewers only install updates signed by Karnex.
What isn't end-to-end encrypted: commands and scripts, the web console's background tools (such as its file browser and live shell), and account data are processed by Karnex over TLS, as in any hosted service. The security architecture page describes each part in detail.
Who can connect
- Roles and groups. Org Admins, Admins and Technicians, with technicians limited to the groups (clients or sites) they work on.
- Sign-in protection. Two-factor with an authenticator app, email codes or security keys; Microsoft and Google sign-in; IP allow-lists; trusted-device windows.
- Enterprise Identity add-on. Your own identity provider over SAML 2.0 or OpenID Connect, SCIM provisioning, custom roles and just-in-time access to a group for a set time.
- Ask before connecting (Enterprise Identity). The person at a chosen computer gets a window naming the technician and organization, with Allow and Don't allow; nothing reaches the technician until they allow it.
- Connected notice. While someone is connected, the computer shows who it is (on by default).
- Privileged Access (Elevate). Let people work as standard users and run what they need as administrator, approved by a person or by your rules.
What's recorded
Every session, command and admin change is in the audit log, which the Audit Streaming add-on can send to your SIEM. Sessions can be recorded; on Elevate, recordings are archived and can be encrypted on the technician's PC before upload.
Who this is for
Security-conscious IT teams, MSPs whose clients ask hard questions, and anyone who wants remote support without opening ports. See remote support software and RMM software for what you can do once connected.
Frequently asked questions
Is Karnex peer-to-peer?
No. Karnex is a hosted service that brokers and relays connections, so neither side needs open ports. The session is end-to-end encrypted, so the relay can't read it.
Does Karnex hold compliance certifications?
Karnex doesn't claim formal certifications today. The security architecture page lists the controls so you can assess them yourself, and the reviews it has had.
What happens if a computer's identity changes?
The Viewer stops and asks before trusting the new key. A reinstall changes it legitimately; anything else is worth investigating.