Consent-based secure remote support — self-hosted · E2E · audit-grade
An attended remote-support & MSP tool for the session a helpdesk agent or an outside vendor opens onto a live user's machine. A session starts only with explicit consent, and it ships with full recording, a tamper-evident audit trail, and scoped, time-boxed vendor access (PRA). It's the self-hosted · end-to-end-encrypted · audit-grade alternative to TeamViewer / AnyDesk / BeyondTrust PRA, built by assembling the NetServ Kits (ConnectKit · SessionKit · ServerKit · DeviceKit).
Attended (consent) End-to-end encrypted Recording & replay Tamper-evident audit Vendor PRA Self-hosted Built from the Kits
The agent (operator) connects from a browser web console, no install; the user gets a support PIN and consents to open the session. SupportReach is the attended sibling of EdgeReach (unattended devices).
Key features
🤝 Explicit consent (attended)
A session starts only when the person at the machine allows it (join → view → control), a consent handshake on top of SessionKit's control-approval gate.
⏺️ Session recording & replay
Persist the SessionKit frame / input stream keyed to a session id and replay it for audit.
🧾 Tamper-evident audit
Record session.* lifecycle (start · consent · control · end) in ServerKit's
hash-chained audit log, independently verifiable and exportable.
🛡️ Vendor PRA (privileged remote access)
Invite an outside vendor with a scoped, time-boxed, approval-required, always-recorded grant — no shared credentials, access revoked on end.
🌐 Browser operator console
Agents watch and control from a web console (ServerKit ViewerGateway), no install — gated by RBAC permissions, short-lived tokens, and a per-device ACL.
🔐 End-to-end encryption · self-hosted
ConnectKit J-PAKE · AES-256-GCM end-to-end, with servers, recordings and audit run by you — data never leaves your boundary.
🖧 MSP fleet (optional)
Extend to unattended assets with DeviceKit.Rmm — inventory, live metrics, remote command exec.
📋 Compliance pack
Audit export with independent integrity verification (no gaps), SIEM egress, access review, and retention policy.
🪟 Windows service agent · MSI installer
The Windows agent runs as a service and ships with an MSI installer (service registration, silent install, upgrade / uninstall). The host's system audio is streamed too, so it plays in the browser and is included in the recording.
🔗 Device enrollment · pairing · server-side recording storage
Quick support connects with a one-time PIN; standing-support devices are enrolled with a registration token and paired with a per-device secret. Recordings upload live to the server, are hash-verified and kept for the retention period; when a size cap is reached the first part is saved as a "truncated recording" and flagged in the console.
🎟️ Unified-account auth · billing integration · turnkey deploy
Operators sign in with OIDC (the NetServ unified account or your own IdP), and seats, concurrent sessions and features are controlled by license. Install it as a turnkey self-hosted package with a bundled identity server and install / backup / restore / upgrade scripts.
How it works — assembled from the NetServ Kits + a policy layer
SupportReach invents no new protocol — it assembles NetServ's developer SDKs (Kits). The Kits guarantee pipe / session / server / protocol; SupportReach owns the policy (consent, recording, session audit, vendor access).
🔌 ConnectKit — connection
The NAT-traversal, end-to-end-encrypted pipe linking agent and user PC directly and securely.
🗂️ SessionKit — remote desktop
Screen and input, with a built-in control-approval (consent) gate — the basis of an attended session.
🧩 ServerKit — servers · web console · audit
Coordinator/Gateway (NAT · relay) + ViewerGateway (browser console) + ControlPlane (RBAC · hash-chained audit · billing).
📟 DeviceKit — MSP fleet (optional)
Add inventory and remote exec when you also manage unattended assets.
Use it when
- Your internal / customer helpdesk supports user PCs with consent
- An MSP supports many client organizations and must keep an auditable record of every session
- You grant an outside vendor temporary, scoped access (PRA) that is always recorded
- Regulation / security demands self-hosting + E2E + audit grade (a TeamViewer / AnyDesk replacement)
Web viewer console access
Agents attach to a session from a browser web console (ServerKit ViewerGateway) — no install, gated by RBAC permissions, short-lived tokens and a per-device ACL. The console is self-hosted inside your trust boundary, so screen, recordings and audit never leave your org.
| Component | Role | Provided / access |
|---|---|---|
| Web console (ServerKit ViewerGateway) | Agent browser attach — view · control · consent | Self-hosted (on-prem) · ServerKit |
| Support host (SupportReach Host) | User PC — support PIN · consent · recording | Provided / deployed at onboarding |
| Admin console (Control/Portal) | RBAC · audit review · billing | Self-hosted |
The NetServ console hub lists this console under App operations too.
Enterprise / MSP · quoted to scale