Building remote support for air-gapped and segregated networks
In public sector, finance, healthcare and manufacturing sites, you often have to support PCs and equipment on networks that are cut off from the internet or separated from the business network. Cloud-style remote support tools may not fit, because license checks and sign-in need to reach an outside service. This guide lists what to check before bringing remote support into such a network, and how SupportReach (consent-based attended support) and EdgeReach (unattended device management) are deployed offline.
Five checks before bringing it into an air-gapped network
- Server location — do the connection servers, web console, and recording and audit storage all sit inside the network?
- License validation — can licenses be verified without internet access?
- Identity — can operators sign in with your existing internal identity provider (IdP)?
- Consent and audit — are user consent, session recording and tamper-evident audit records in place?
- Operations — can installation, backup, restore and upgrade be carried out inside the network?
SupportReach: consent-based remote support
SupportReach is a helpdesk and MSP tool in which a session opens only after the user gives explicit consent with a support PIN. Sessions are end-to-end encrypted, screen and input streams are stored as session recordings, and lifecycle events such as start, consent, control and end are written to a hash-chained audit log that can be independently verified and exported. External vendors can be given scoped, time-limited, approval-required, always-recorded access (PRA). Agents connect through a browser web console with nothing to install, and the console is self-hosted inside your own trust boundary.
EdgeReach: unattended device management
EdgeReach manages unattended devices such as kiosks, digital signage and industrial PCs without a VPN, with bulk provisioning, remote execution, configuration and firmware rollout, and a live view in the browser. It is the unattended sibling of SupportReach.
Offline licensing and OIDC identity
Both products ship as a turnkey self-hosted package: operations server and web console, a bundled authentication server (or integration with your IdP), and install, backup, restore and upgrade scripts. Licensing uses an offline license file (RVLIC1), so it works without depending on any outside service. SupportReach controls seats, concurrent sessions and features through the license; EdgeReach is licensed by the number of managed devices. Operator sign-in is OIDC-based, so you can use the bundled authentication server or your own IdP. Other integration methods such as LDAP are handled by agreement, depending on your environment.
If you need desktop remote control (Classic)
For installable, always-on control of many PCs, Classic can be deployed on a dedicated server for your organization. Classic also supports offline licenses (RVLIC1). For other products, closed-network configurations are advised after an environment review.
How an engagement runs
Consultation, then a review of server, network and identity (IdP) environment and scale (seats or devices), a small proof of concept, the full build, administrator training and handover, and finally updates and support. There is no list price; you get a quote built from build fee, license and support. See the Self-hosted page for details.
Frequently asked questions
Do licenses work when the internet is completely cut off?
The EdgeReach and SupportReach turnkey packages run on an offline license file (RVLIC1) and do not depend on outside services. Closed-network setups for other products are advised after an environment review.
Can operators sign in with company accounts?
EdgeReach and SupportReach support OIDC identity providers, either the bundled authentication server or yours. LDAP and similar methods are handled by agreement.
Where are support records kept?
Recordings and audit logs stay on servers your organization operates and do not leave. The audit trail is hash-chained so tampering can be detected, and it can be verified and exported independently.