Security

Last updated October 19, 2026

Remote access means someone can use your computer from somewhere else, so it has to be locked down. This page describes the ORelay service as we run it: how it protects your computers and how to tell us about a problem.

The short version

Nothing on your computer is open to the internet. The ORelay app only reaches out, so there’s no port to open on your router.
Everything travels encrypted, and only computers holding a certificate we issued can connect.
The person at the computer can turn off any kind of remote access, at any time.
Anyone can make an account, but only with an email address they confirm, and two-step sign-in is there for every account.
The screen and what you type during a session are never recorded. Who connected, and any quick commands they ran, are logged.

The details, for IT folks, follow.

Connections

The ORelay agent on each computer only makes outbound connections to the ORelay service. Nothing on the computer listens for connections from the network, so there is no port to open.
Agents connect over mutual TLS 1.3, using certificates from our own certificate authority, and the service accepts only agents that hold one. The web viewer and the apps connect over HTTPS.
A computer joins an organization only with a one-time code that expires after 24 hours, or by being claimed from a phone: an owner or administrator of the organization approves the claim within 20 minutes, and an administrator of the computer confirms it there. The computer then identifies itself with a credential of its own, and the service keeps only a hash of it.
Removing a computer ends its connection at once, and every agent connection is checked again every 30 seconds.
Screens, terminals and file transfers travel through the ORelay service, encrypted between it and each end. They are not end-to-end encrypted.

Accounts and sign-in

Anyone can make an account. On the web, signing up asks you to tick a CAPTCHA (Google reCAPTCHA); in the ORelay apps, it asks your phone to show it is running the genuine app, through Google Play Integrity or Apple App Attest. A new account has to confirm its email address before it can sign in, and sign-ups are limited by network address and by the hour. Nobody joins an organization unless its administrators add or invite them.
Sign in with Google can make a new account for an address Google has confirmed, once you accept the terms. Sign in with Apple, Microsoft or GitHub signs in only to an account it was added to (on that account’s page, with its password); otherwise it starts an ordinary sign-up, email confirmation included.
A passkey can be added beside the password. Signing in with one needs the device’s face, fingerprint or PIN check. Adding one asks for the password, and removing one signs the account out everywhere else.
Passwords are stored only as salted Argon2id hashes. Repeated wrong passwords lock an account for 15 minutes.
Anyone can turn on two-step sign-in with an authenticator app, and gets one-time recovery codes for when their phone is lost.
You can change your password whenever you like, and reset a forgotten one with a link sent to your email address.
Access tokens expire after 15 minutes. They are renewed with refresh tokens that are replaced every time they are used and can be revoked.
Signing out revokes your refresh tokens on every device. Another device stays signed in until its current access token runs out, within 15 minutes, and a terminal or remote desktop open there stays open until it is closed.
The web viewer keeps its tokens in memory only, never in browser storage. The Android app keeps them in encrypted storage protected by the Android Keystore, and the iPhone app in the iOS Keychain.
Terminals, remote desktop and live status carry the token in a request header, never in the web address.
Taking away someone’s access to a computer closes their open terminal and remote desktop sessions on it straight away.

Keeping organizations apart

Each organization’s computers, metrics, alerts, scheduled tasks and software inventory are kept in a database of its own.
Every request to a computer’s address is checked before it reaches any feature: a computer that is not in your organization, and has not been shared with you, is simply not found. A test in our suite sends every such request to another organization’s computer and fails if any gets through.
Sharing a computer gives the other person that one computer, with a role and an optional expiry, and nothing else in your organization.
A share code made at the computer needs an administrator of that computer to approve it, each time, in the system’s own prompt. The access it gives lasts 24 hours, and a code never shortens or lowers access someone already has.

An administrator of a managed computer can switch off screen viewing, remote control, commands, file access or power actions, or all remote access at once. The agent itself refuses whatever is switched off. Every switch is on when ORelay is installed.
On Windows and macOS the switches are in the ORelay window; on Linux they are set from the command line as root. Once all remote access is switched off, no remote user can switch it back on.

What is recorded, and what is not

Each organization’s audit log records remote commands and their text, remote desktop sessions and who had control, file transfers, power actions, sign-ins, and changes to who can reach a computer. Entries are not deleted automatically: they go only when the organization itself is deleted.
What is typed into a terminal, the keyboard and mouse input sent to a remote desktop, and the screen itself are never recorded. The log shows that a session happened, who had control and when, and whether Ctrl+Alt+Delete was sent.
Each organization sees only its own log, and our own platform administrators can read all of them. Nobody can edit or delete entries from within ORelay.

The agent

The agent is written in Rust and the service in Go, both memory-safe languages. The agent uses unsafe Rust only where it calls the operating system, such as for screen capture and input.
Windows and macOS builds are signed by ORelay Studios LLC, on macOS with its Apple Developer ID. The Linux .rpm and .deb packages are signed with our package signing key, orelay-packages.asc (fingerprint A86F D8DF 6BF6 01B8 E65C 7627 2781 1DE2 BE7A 3757). For the .rpm, import it with sudo rpm --import https://orelay.io/keys/orelay-packages.asc and rpm -K checks the package. The .deb carries a debsigs origin signature, which debsig-verify checks; apt and dpkg do not check a signature inside a package, so check it before installing.
Agents update themselves by default, including while remote access is switched off. Updates are downloaded over HTTPS from the ORelay service. An agent installs one only if it comes with a release statement signed with our release key, naming each file with its size and SHA-256 checksum, so a download that is not exactly what we published is refused. On macOS the agent also checks Apple’s code signature for our developer team before installing. On Windows it also checks the update’s code signature and refuses one that is not ours, wherever the agent already installed passes the same check; a computer that cannot verify our signatures at all records and reports the result instead, so it is never left on an old version.
Our administrators can hold every agent update at once, hold a platform or pin it to a version, and send a new version to chosen computers first. Each change is recorded.
On Windows the agent runs as a system service, so commands, terminals and file access have full rights unless you choose to run a command or terminal as the signed-in user. On Linux it runs as its own account under a restricted system service, and a separate step installs its updates.
The agent keeps its credentials in files that only it and the computer’s administrators can read.

Your files

Files you back up to the cloud vault are encrypted on the device they come from (the managed computer, or your browser or phone) before they leave it, each with its own AES-256-GCM key wrapped with RSA-4096, and kept in your own Google Drive or OneDrive. Restoring one to a computer passes it through the ORelay service decrypted; it is not stored there.
Files you copy off a computer are kept in the service’s file store until the computer is removed, reset or uninstalled, or the organization is deleted. The database and the file store cannot be reached from the internet.

Backups

The service’s databases, its file store, and its settings and certificates are backed up every night. Each backup is encrypted on our server before it leaves it, and stored with Cloudflare, which cannot read it.
Nightly backups are kept for 35 days and monthly ones for about 13 months, and none can be deleted in its first 30 days (a monthly one, its first year).
We test restoring them by rebuilding the service on a separate server. The last test was on October 9, 2026.

How we build it

Changes to the service’s code are checked by SonarQube Cloud™ static analysis, and Dependabot proposes updates to the service’s and the agent’s dependencies.
More than 5,000 automated tests across the service, the agent, the web viewer and both apps, including the one that sends every request to a computer’s address to another organization’s computer.
Internal security reviews, including testing against an isolated server.

Report a vulnerability

If you think you have found a security problem in ORelay or on our websites, please tell us privately first. Email our security team, and say what you found, how to reproduce it and what it affects: the link starts the email with those three questions. You may report anonymously. Please do not paste anyone else’s personal data into the email; describe it instead. We do not run a bug bounty.

Scope

The ORelay agent and its installers; the ORelay service, including its API and the web viewer; the Android app and the iPhone app; and orelay.io. On orelaystudios.com, only the content and settings we control are in scope: do not scan or attack its hosting, WordPress itself or its plugins, and report problems in those to their makers. Anything not listed here is out of scope.

What we will do

Acknowledge your report within five business days. If you have not heard from us by then, please write again.
Work with you to understand and confirm it, and keep you informed while we work on it.
Fix confirmed problems as quickly as we reasonably can, most serious first, and tell you when a fix is out, or explain why we will not change something.
Credit you publicly once it is fixed, if you would like that.
Not share your name or contact details without your permission. We may share the technical details with a company whose component is affected.

What we ask of you

Test only with accounts and computers that are yours, or with their owner’s written permission. Never test against another customer’s organization or their computers.
Never run a command, open a terminal or remote desktop, move a file or view the screen on a computer that is not yours and that you do not have written permission to test, even if a flaw in ORelay would let you. Show that you could, and stop.
If you reach data that is not yours, stop. Access no more than you need to show the problem, do not keep or share it, and tell us straight away.
No denial-of-service testing, and nothing that damages or degrades a system or its data.
No social engineering, phishing or physical testing.
Do not keep access, move on to other systems, or use a problem beyond showing it exists.
Give us 90 days to fix a problem before you disclose it publicly, and keep the details between us until then. If that is too long for a particular issue, tell us why and we will try to agree a date.
Do not ask for payment in exchange for keeping a problem quiet, and follow the law.

Safe harbor

If you make a good-faith effort to follow this policy, we will treat your research as authorized as far as our own systems are concerned. We will not start or support legal action against you under the Computer Fraud and Abuse Act or similar state laws, including Arizona’s, or for getting around technical protections under the DMCA, and we waive the parts of our terms of service that would stand in the way of that research. If this policy and our terms disagree about security research, this policy applies. If someone else takes legal action against you for research that followed this policy, we will make it known that you acted in line with it.

This covers only claims that ORelay Studios LLC controls; it cannot bind anyone else, and nothing in it stops us from meeting a legal obligation, such as a subpoena or court order. If you are unsure whether something is allowed, ask us before you go further.

SonarQube Cloud is a trademark of SonarSource SA. ORelay is not a Sonar™ product and is not affiliated with or endorsed by SonarSource.