Remote desktop, monitoring and alerts

Remote desktop

See any of your computers live, and use its mouse and keyboard when you need to.

Works on Windows, Mac and Linux (X11 or Wayland), from your browser or the Android and iPhone apps.
Every session starts view-only. Taking control of the mouse and keyboard is a separate step, and taking or giving back control is logged.
Ctrl+Alt+Delete works on Windows from the browser, so you can unlock a PC or open its security screen.
A Windows PC can be reached at its sign-in screen when nobody is signed in, so a restart overnight won’t cut you off.
Pop a session out into its own browser window, beside everything else you have open.
On Linux with Wayland under GNOME, the person at the computer approves the first session in the desktop’s own prompt.

Everything else you’d walk over to the computer to do.

Command window: open bash, sh, PowerShell or cmd in your browser. Idle sessions close on their own, and there’s a limit on how many can run at once.
Quick commands: run one command and see its output and whether it worked (stdout, stderr and the exit code). A short list of obviously destructive commands is blocked, to catch mistakes.
Files: browse folders, upload and download. Files travel over the same connection as everything else, so there’s no separate file server to open up.
Power: shut down, restart, sleep, hibernate, lock or sign out, now or up to an hour later. A later one waits on our server, where you can see it and cancel it.

For a family member, a client or a coworker who needs help with one computer.

On Windows and Mac, the person at the computer creates an eight-character code in the ORelay window and gives it to you. An administrator of that computer approves each code in the system’s own prompt.
You enter the code on the web or in the app and get that one computer and nothing else, either to help (use it) or to watch (view only).
Codes expire, and can be set to work only once. Access from a code made at the computer lasts 24 hours, and a new code never cuts short access you already have.
It works across accounts: the computer stays in its owner’s account, and you reach it from yours.

They decide what remote users can do, right at the computer.

On Windows and Mac, the ORelay window shows what remote users are allowed to do: see the screen, control it, run commands, move files or change power. On Linux, the same switches are set from the command line.
Any of these can be turned off at the computer, or all remote access at once, leaving only health monitoring and updates. Changes take effect within seconds.
In the ORelay window, changing the switches or sharing the computer needs administrator rights on that computer. Once all remote access is off, no remote user can turn it back on.

One small program on each computer. It runs in the background, starts with the computer and needs no attention once it’s installed.

It only connects out, never in. Nothing on the computer listens on the network, so there’s no port to forward and no VPN to set up. (Technical: gRPC over mutual TLS.)
It reports processor, memory, disk and network use as they change.
If it can’t reach the server, it saves its readings and catches up later, so an outage leaves no gap.
It reconnects on its own and updates itself when we publish a new version.

You decide what matters, and who hears about it.

Set an alert on any reading, such as processor use over 90% for 10 minutes, or on a computer that stops checking in.
Give alerts a severity, acknowledge them, and see a history of what fired and when it cleared.
Get notified by email, webhook (Discord, Slack or plain JSON), ntfy, or a notification in the Android app.
Every delivery attempt is logged, and a test button sends a sample message through the real channel.

Routine work, done on schedule and written down.

Schedule tasks on a timer or a cron schedule, with a time limit, a “run now” button and the full output of every run. They keep running even when the server can’t be reached.
See every installed program: Windows programs, Mac apps, Homebrew, and Linux packages (dpkg, rpm, Flatpak and Snap).
Search a computer’s list for a program, and export the list to a spreadsheet (CSV).

Built for more than one team from the start.

Each organization’s computers, readings, alerts, tasks and software lists are kept in a separate database. One person can belong to several organizations and switch between them.
Sign in with a password or a passkey, or with Google, Apple, Microsoft or GitHub once you have added it to your account. Two-step sign-in with an authenticator app is there for everyone, and sign-ins are short-lived and renew quietly in the background.

Keep important files safe, even if a computer dies.

Each file is encrypted with its own key. (Technical: AES-256-GCM, with the keys wrapped by RSA-4096.)
Restore a file straight back to a computer.
Files are kept in your own Google Drive or OneDrive (a personal, work or school Microsoft account). ORelay can only reach its own files there, and you can disconnect either one on the Vault page at any time.

Remote control means full access to a computer, so we designed ORelay by thinking about what an attacker would want and closing it off.

Every connection is encrypted: mutual TLS 1.3 between each computer and the service, with our own certificate authority, and HTTPS for the web viewer and the apps.
The screen is passed along live and is never recorded or stored.
What you type in a command window or remote desktop session is never logged. The log does show that a session happened, who opened it and when control was taken.
A remote desktop session ends when you close its window or lose the connection, and after eight hours at most.
Passwords are stored as Argon2id hashes, never as the password itself. The viewers use short-lived JSON Web Tokens with refresh tokens.
The ORelay app keeps its credentials in files only it and the computer’s administrators can read, and its local buffer holds nothing secret.
Notification secrets (webhook URLs and headers, ntfy tokens) are write-only: shown redacted, never logged.
Every webhook and notification address you enter is checked against server-side request forgery (SSRF), when it’s saved and again every time it’s used.
Repeated wrong passwords lock an account, failed sign-ins and password-reset requests are rate limited, and stalled connections are dropped.

Found a problem? Email our security team. We’d rather hear it from you first. The security page has the rest, including our disclosure policy.

Computers	Windows, Mac and Linux.
Web viewer	Any up-to-date browser. Nothing to install.
Mobile	Android and iPhone apps, both with remote desktop.
Service	Run by ORelay Studios LLC. Each organization’s computers and records are kept in a separate database.