The short version of how GoodLink keeps your fleet safe. For the full detail, see the security page.
Outbound only, zero inbound ports
Enrolled machines dial out to the GoodLink gateway and never accept inbound connections. There are no ports to forward, no firewall holes to open, and the controlled machine is never exposed to the public internet.
Keys, not passwords
Every machine gets its own device keypair at enrollment. The private key stays on the machine with owner-only permissions and never leaves it. The agent authenticates each connection with a short-lived token signed by that key — there are no standing passwords for the agent to leak.
No standing engine credential in the cloud
Engine credentials are minted one-time, per session, and applied to the machine just in time. Your browser never holds an engine password; it only ever holds a short-lived, single-use session token that expires within a minute.
TLS on every hop — stated honestly
Every hop is protected with TLS in transit. GoodLink does not claim end-to-end encryption in v1: the gateway terminates the session in order to drive the remote-desktop engine, so it is a trusted component in the path. We say so plainly rather than overstate it.
Read the full security page for the complete picture.