Security

How ZRemote protects a session.

A short, concrete summary of what protects a connection and what does not. Everything here describes the product as it works today.

Connection security

  • On your local network the phone and the PC talk over TLS, and the phone pins the PC certificate on first connect. If the PC is reinstalled its certificate changes, and the phone refuses the connection until you approve the new one — a reconnect that goes through silently would be exactly what an impostor would want.
  • Signing in uses your ZRemote Cloud account. The password is never sent in the clear to the PC: the phone derives a token from it and that is what travels.
  • Access tokens are short-lived and refresh tokens rotate on use, so a stolen refresh token stops working as soon as the real one is used.

Remote sessions

  • Away from your Wi-Fi, ZRemote first tries a direct route between the two devices.
  • When the network blocks that, the connection falls back to a relay in ZRemote Cloud. The two ends exchange keys and encrypt the traffic with AES-256-GCM, so the relay forwards two already-encrypted streams. It counts bytes to apply your plan allowance; it does not write the traffic to disk or to the database.
  • The signed entitlement the PC receives is verified with ECDSA, so a plan cannot be granted by editing a local file.

Stored versus transmitted

  • Stored on the server: your account, the computers you linked, and metadata about sessions — when they happened, over which transport, how many bytes were relayed.
  • Transmitted but not stored by us: screen frames, keyboard and mouse input, ZDrop file transfers and clipboard synchronisation. These are the session itself, and they are encrypted end to end.
  • On your phone, the account token lives in the operating system secure storage. ZDrop and clipboard history stay on the device and are never uploaded.

Device protection

  • Account isolation: the app only lists PCs signed in to your own account, so another computer on the same Wi-Fi never appears.
  • Visible by design: the PC shows a notice when someone connects, and the tray icon is always present. ZRemote is not built to run unnoticed on someone else’s machine.
  • Device limits per plan, so a leaked password cannot quietly attach an unlimited number of computers.
  • You can remove a linked computer, end an individual sign-in session, or sign out everywhere, from your account area.