1. Security posture
Remote2You is a remote access platform, which makes it a high-value target by definition. The platform is designed on zero-trust principles: no component is trusted by default, every connection is authenticated and encrypted, and every privileged action is recorded. Compliance statements on this site describe platform controls and architecture; formal attestations and completed security questionnaires are provided to clients and qualified prospects under NDA.
2. Key controls
| Area | Control |
|---|---|
| Network exposure | Endpoint agents initiate connections to the platform over TLS. No inbound ports need to be opened on client networks or endpoints for management traffic. |
| Operator authentication | Multi-factor authentication by authenticator-app code or passkey. Roles can require MFA before access is granted; privileged administrator roles require it. |
| Transport security | Connections to the platform require TLS 1.2 or later. Older protocol versions are refused. |
| Tenant isolation | Each client operates in its own organization, kept strictly separate from every other client's computers and records. |
| Authorization | Role-based access control. Administrators decide which sites and devices each technician can reach. |
| Audit | Append-only audit log of administrative and session actions, protected so that alteration or deletion is detectable. |
| Software integrity | Endpoint installers are code-signed. |
| Status | Service status is published at status.remote2you.com. |
3. Responsible disclosure
We welcome reports from security researchers and treat them seriously. If you believe you have found a vulnerability in Remote2You, please report it to [email protected]. Include a description of the issue, steps to reproduce, affected hostnames or components, and any proof-of-concept material. If you would like to encrypt your report, request our PGP key at the same address.
We do not currently operate a paid bug bounty program. We do credit researchers who report valid issues, with their permission, once the issue is resolved.
4. Scope
In scope: remote2you.com, app.remote2you.com, status.remote2you.com, and the Remote2You endpoint agent and installer packages.
Out of scope: client-owned devices and networks on which an agent is installed (these belong to our clients and are not ours to authorize testing on); third-party services we rely on (report those to the vendor); social engineering of our staff or clients; physical attacks; denial-of-service testing; and findings that require a compromised operator account or physical access to an endpoint.
5. Rules of engagement
- Only test against accounts, tenants, and devices you own or have explicit permission to test. Never access, modify, or exfiltrate data belonging to anyone else, including other tenants.
- Do not attempt to connect to, enroll, or control any device you do not own.
- Do not perform denial-of-service, resource exhaustion, or automated high-volume scanning against production systems.
- Stop immediately and report if you encounter personal, health, or financial data; do not retain it.
- Give us reasonable time to remediate before any public disclosure. We ask for 90 days from acknowledgment, and will work with you on a coordinated timeline.
6. Safe harbor
We will not pursue legal action against researchers who make a good-faith effort to comply with this policy, who avoid privacy violations and service disruption, and who report findings promptly. If legal action is initiated by a third party against you for activity conducted in accordance with this policy, we will make it known that your actions were authorized. This safe harbor does not extend to testing against client-owned devices or networks, which we are not in a position to authorize.
7. What to expect
| Stage | Target |
|---|---|
| Acknowledgment of your report | Within 2 business days |
| Initial assessment and severity | Within 7 business days |
| Remediation of critical and high severity issues | Targeted within 30 days; interim mitigations sooner where possible |
| Status updates | At least every 14 days until resolution |
| Client notification | Affected clients are notified as required by law and by our agreements |
8. Documentation for clients
Clients and qualified prospects may request our security architecture overview, completed standard questionnaires, penetration test summaries, and data processing or business associate agreements by contacting their account representative or [email protected]. These materials are provided under NDA.