Security model

Nearshell protects remote access through account authorization, device pairing and encrypted connections. Manage devices under your account and revoke their authorization when needed.

Device identity and pairing

Devices use Curve25519 identity keys, with private keys stored in the local Keychain. Pair by scanning or pasting the code shown on the Mac to pin the peer’s identity. Controllers also require the corresponding account and device authorization.

Signed signaling and connection authentication

Signaling between paired devices uses signed envelopes and checks the session, endpoint identity, time window and sequence to resist forgery and replay. Realtime connections also authenticate the peer before transmitting the corresponding content.

Encrypted realtime content

Video, keyboard and pointer input, and terminal data travel over encrypted WebRTC connections. Direct connections are preferred; TURN relays forward ciphertext when needed.

Encrypting realtime content does not mean the service processes no account, device, connection or subscription data. Accounts, device authorization, subscription entitlements and relay metering require corresponding service data. The waitlist also processes submitted email addresses and uses Cloudflare Turnstile for abuse prevention.

System permissions

• Screen Recording: remote desktop and window video.
• Accessibility: keyboard and pointer input.
• Microphone and relevant speech permissions: requested by the system when using voice input.

Manage permissions in system settings. Terminal input ownership is also coordinated across controllers.

Protect your devices

Keep authorized devices and add-device codes secure, keep operating systems updated, and revoke devices you no longer use. End-to-end encryption cannot protect an endpoint that is itself compromised.

This page explains product security mechanisms and boundaries. See the Privacy Policy for data practices and rights requests, and the Terms of Service for use of the service.