Remote desktop access
See the remote screen and work on it with full keyboard and mouse control, for support, administration and everyday work.
Black Vault Remote Desktop
Secure Remote Access. Protected by Citadel.
Remote desktop and IT administration for Windows and macOS, designed so that every session must be authorized by Citadel before it starts, and keeps being evaluated while it runs.
Pre-launch. In development, with early access coming soon.
- Mandatory Citadel authorization
- Fails closed
- Audit trail for every session
Protected by Citadel
Citadel is the security standard across the Black Vault family. In Black Vault Remote it is the engine that decides whether a session may begin, and whether it may continue.
What we are building
Remote access with the controls built in.
Black Vault Remote is pre-launch. These are the capabilities we are designing and building, not features you can use today.
Citadel security
Every session is authorized by Citadel before it begins and evaluated while it runs. If Citadel can't decide, the answer is no.
Attended and unattended access
Help someone who is sitting at the machine, or reach a device you have deliberately enrolled for unattended access. Both go through the same authorization.
Secure file transfer
Move files between machines under a permission of their own, separate from screen control. Each transfer is designed to be recorded in the audit trail.
Remote terminal
Open a command line on the remote machine, granted separately from desktop control. Elevated actions are designed to need their own explicit approval.
Multi-monitor support
See every display on the remote machine and choose which one to work on.
Cloud-managed
Enroll devices, manage people and set access policy from one central, cloud-based console.
Audit and session logging
Authorization decisions, sessions and administrative changes are designed to be written to an append-only audit trail you can review.
Citadel
Authorization first. Every session. Every time.
Citadel is the security engine at the center of Black Vault Remote. It is designed so that no remote session can begin, or continue, without its approval.
-
Mandatory by design
We are building it so there is no setting, mode or shortcut that skips Citadel, attended or unattended.
-
Fails closed
A check that fails, or can't be completed, never becomes access. Uncertainty means no.
-
Least privilege
Viewing, controlling, transferring files, using a terminal and elevating privileges are separate permissions. None implies another.
-
Honest about what it knows
Citadel keeps what it has verified separate from what a device merely reports, and never presents one as the other.
How Citadel authorizes a session
From request to authorization, in plain language.
This is how a session is designed to be authorized. Each step has to pass before the next one begins, and a failed check ends the request.
-
Someone asks to connect
A technician or administrator asks for a session with a specific device and says what they need to do: look, control, move files or open a terminal.
-
Citadel checks who is asking
The person is identified and must sign in with multi-factor authentication before anything else happens.
-
Citadel checks the device
The target must be an enrolled device with its own cryptographic identity, not just a name on a list.
-
Citadel weighs the evidence
Device health and software integrity are evaluated. Each result is labeled as verified, reported by the device, or unavailable.
-
Policy sets the scope
Your policies decide which abilities are granted, and whether the person at the machine has to approve first.
-
A short-lived pass, or a refusal
Citadel issues an authorization for that one session, and it expires. If any critical check fails, or Citadel can't decide, nothing is granted.
And it doesn't stop at yes.
While a session is live, Citadel keeps evaluating it. It can narrow what is allowed, end the session, or revoke trust in the device when conditions change, and every decision is recorded in the audit trail.
Attended and unattended access
Two ways in. One authorization path.
Whether someone is sitting at the machine or not, the request goes through the same Citadel checks and lands in the same audit trail.
Someone is at the machine
Attended access
- The person at the device is asked to approve the request before the session starts.
- They can see who is asking and what they want to do.
- Built for helping a colleague or customer in the moment.
Pre-authorized devices
Unattended access
- Designed for servers, kiosks and after-hours maintenance.
- A device has to be deliberately enrolled, with multi-factor authentication. It is never a hidden default.
- Every unattended session still has to be authorized by Citadel.
Platforms
Built for Windows and macOS.
Native software for both platforms is in development. Windows and macOS are the two platforms we are building for, and Black Vault Remote is designed to connect between them.
- WindowsEndpoint software in development
- macOSEndpoint software in development
Early access
Be among the first to use it.
Black Vault Remote is pre-launch. If you support users or manage devices and want to see it early, send us a note and tell us what you would use it for.
Request early access
Or write to early-access@blackvaultrd.com
This opens your email app. This website has no forms, no accounts and no third-party trackers.