1. Core principle
You may use Remote2You only to support and administer devices that you are explicitly authorized to manage, in a manner that the device's owner and its users would reasonably expect. If you would not be comfortable with the user seeing exactly what you did and why, do not do it.
2. Authorized devices only
- Enroll only devices owned or managed by your organization, or for which you hold written authorization from the owner.
- Never enroll, access, or attempt to access a personal device, a device belonging to another organization, or any device whose owner has not agreed to remote management.
- Remove or disable agents promptly when a device leaves your management or when authorization ends.
3. Notice and consent
Each Client is responsible for providing the notices and obtaining the consents that applicable law and its own policies require before accessing a user's device. The platform provides consent prompts and an active-session indicator to support this. Where a Client chooses to reduce visible indicators (for example, hiding the tray icon on managed devices), the Client remains fully responsible for ensuring its users have been informed through other means, such as an acceptable-use agreement or employment policy. A complete audit trail is retained regardless of indicator settings.
4. Prohibited uses
You must not use the platform to:
- Access any device, account, tenant, or data without authorization, or beyond the scope of your authorization.
- Monitor, record, or collect information about individuals for purposes unrelated to legitimate IT support and administration, or in violation of privacy, wiretap, or employment law.
- Deceive a user about who is connecting, why, or what is being done, or impersonate a vendor, authority, or colleague.
- Install, distribute, or operate malicious software, or disable, evade, or tamper with security software on any device.
- Exfiltrate, sell, or misuse data encountered during a session, including credentials, personal information, or protected health or financial information.
- Attempt to defeat tenant isolation, authentication, rate limiting, or any other security control of the platform.
- Resell, sublicense, or provide access to the platform to any third party except as permitted by your Client agreement.
- Use the platform for any unlawful purpose, or to facilitate scams, harassment, or unauthorized surveillance.
5. Sensitive features
Certain capabilities carry elevated responsibility and are role-gated and audited:
| Capability | Expectation |
|---|---|
| Unattended access | Connect only to computers your organization is authorized to manage, and only for legitimate support or maintenance. All sessions are logged. |
| Quick Support sessions | Start a session only when the person has asked for help. Never use a Quick Support code to access a computer without the user's knowledge. |
| Command-line access | Use only for legitimate maintenance. Do not run commands that damage, conceal, or exfiltrate data. Activity is logged. |
6. Data handling
Information observed during a session is confidential to the device owner. Do not copy, photograph, or retain such information except as strictly necessary to resolve the support request and as permitted by your organization's policies and applicable law. Protected health information and cardholder data are subject to additional obligations under your Client agreement.
7. Monitoring and enforcement
The platform maintains a tamper-evident audit trail of sessions, commands, and transfers. We may review audit data to investigate suspected violations, respond to Client requests, or meet legal obligations. Violations may result in suspension or termination of user accounts or tenants, notification to the affected Client, and referral to law enforcement where appropriate.
8. Reporting misuse
If you believe the platform has been used in violation of this policy, contact [email protected]. End users who see a Remote2You session indicator and did not expect it should contact their organization's IT department, and may also contact us. Security vulnerabilities should be reported under our responsible disclosure policy.