Security you can check, stated plainly.
Remote-access tools have burned their users for two decades with vague badges and claims they can’t back. GoodLink takes the opposite approach: we describe the trust boundary exactly, we don’t claim protections we don’t have, and the honesty is enforced in how we build. Here is precisely how it works.
How your sessions are protected
Each of these is a mechanism that exists today, not a roadmap promise. Where a limit matters — like the fact that the gateway decodes protocol — we say so.
TLS on every hop — not end-to-end
Every connection — operator to console, browser to gateway, agent to gateway — runs over TLS. We do not claim end-to-end encryption: the gateway decodes the remote-desktop protocol to render your session, so the media is briefly in plaintext there. In v1 that gateway runs on hardware you control, so that plaintext never touches GoodLink’s cloud. We would rather tell you exactly where the trust boundary sits than sell you encryption theater.
Zero inbound ports
Controlled machines never listen for the public internet. The agent dials outbound only to reach the gateway — no port-forwarding, no firewall holes, no exposed listener to scan or attack. There is nothing inbound to find.
Per-device keys, per-connect tokens
Each machine generates its own Ed25519 keypair at enrollment and authenticates every control connection with a short-lived, per-connect JWT signed by that key. There are no standing passwords on the wire and no shared secret across the fleet.
One-time, short-TTL session tokens
To start a session the control plane mints a single-use connect token with a tight time-to-live and a one-time identifier. Engine credentials are one-time and bound to a single session — no standing engine credential ever lives in the cloud, and the browser never sees a credential, only the short-lived token.
Operator login: argon2 + TOTP
Console sign-in verifies an argon2 password hash and a TOTP second factor, sets an httpOnly session cookie, and enforces a CSRF origin check on every state-changing request. Passwords are stored only as an argon2 hash — never in the clear.
Fixed command allowlist
The agent executes only a fixed allowlist of commands — there is no arbitrary remote code execution path. A command that is not on the list simply cannot run, and every command that does run is written to the audit trail.
A mandatory audit trail
Accountability is not optional. The audit schema is mandatory from day one — the following events are recorded whether or not anyone remembers to turn logging on, because there is no switch to turn it off:
-
Session start and end
-
File transfer
-
Power action (reboot / power-cycle)
-
Device enrollment
-
Every allowlisted command
What we do not claim
Honesty means being clear about the edges, too. During v1:
- No end-to-end encryption. The gateway decodes the session protocol, so we do not and will not market E2EE while that is true.
- No third-party compliance certification. We hold no external audit certification today and will not claim any status we do not have. When that changes, this page will say so with evidence.
- Unsigned installers in v1. While GoodLink is invite-only, v1 installers are unsigned or self-signed with documented bypasses; code-signing lands before we open public signups.
Responsible disclosure
Found a security issue? We want to hear about it. Email us directly and we will work with you in good faith to confirm, fix, and credit the report. Please give us a reasonable window to remediate before any public disclosure.