The security model

It refuses before it downgrades.

Encryption is only worth the words if the client is willing to hang up. This page is the whole chain: what carries the pixels, what proves the far machine is the one you asked for, what the host decides at the door, and what happens when any of it does not add up.

The four layers At the door
The chain

Four layers, and the last one is a refusal.

Each of these is a separate thing that can fail, and each failure ends the session rather than continuing it in a weaker form. That is the whole design in one sentence.

  1. The carrier

    Ciphertext on the wire

    The stream is sealed with XSalsa20-Poly1305 under a key agreed for that session alone. A relay forwards bytes it cannot read and holds no key that would open them.

    XSalsa20-Poly1305
  2. The proof

    A signed identity

    The rendezvous server signs each peer’s identity with an Ed25519 key. The client checks that signature against the public key built into it, then checks that the identity inside it is the device you actually dialled.

    Ed25519
  3. The agreement

    A key per session

    Only after the proof holds do the two ends establish the symmetric key. Nothing before that point carries a pixel, a keystroke or a file.

    1 key · 1 session
  4. The refusal

    And no branch that continues

    Wrong key, wrong identity, wrong message type, no answer: the client aborts. There is no path that falls back to plaintext — which is precisely the path an attacker would aim for.

    The session is refused
At the door

The host decides, every time.

Everything above is about the machine you are calling being the right machine. This is about the person at it agreeing — and about what exactly they are agreeing to.

A click, not a password
Turning on host mode forces every incoming connection through an explicit accept on the machine being connected to, even from a caller who already holds a valid password. The password gets you to the dialog; it does not get you past it.
Five switches, before anything is granted
Keyboard, clipboard, audio, files, restart. The host sets them for that connection, in the moment, and they are off the visitor’s side of the table entirely.
A countdown, not an open offer
An unanswered request expires. Nobody has to be at the machine to decline it correctly.
And a second factor if you want one
A time-based code checked before the accept, and a list of devices that got past it. Delta cannot add to that list; only a successful two-factor login from the hardware in question can.
Delta’s incoming-connection dialog on the host: the visitor’s name and ID, a countdown, five permission switches for keyboard, clipboard, audio, files and restart, and the Decline and Accept buttons.
Host Mode → an incoming connection
What stays put

The things that never leave.

A support tool sees more of a company than most software does. The honest answer to “where does it go” is usually “nowhere”, and where that is true, it is true because there is no code that would send it.

  • Recordings

    Sealed with AES-256-GCM under a key generated for that recording, and the key is handed to the operating system’s keyring. The plaintext file is removed after the sealed one is written. There is no upload path.

  • The address book

    A file on your disk, exported and restored by you. No server copy exists, because no server for it exists.

  • Statistics and history

    Written locally from sessions that really happened. They are there so you can answer a question about last month, not so we can.

  • Keys and tokens

    The gateway key and the per-recording keys go to the OS keyring rather than into a config file sitting beside the data they protect.

The route

And the path stays in Europe.

Two machines and something in the middle when the network will not let them speak directly. Most tools are quiet about the middle.

Direct first
Delta tries a direct peer-to-peer connection and falls back to the relay only when the network refuses. Fewer hops whenever the ports allow it.
Our hardware, in the EU
When the relay is needed it is relay-eu1.altovar.net: our machines, running an image we build, inside the EU. Nobody else sits in the middle of your support call.
Or your own
Point Delta at a rendezvous and relay you run, and it talks to your infrastructure instead of ours.
Delta’s Host Mode card on the machine being connected to: host mode running and registered with the rendezvous, and the connectable ID underneath.Delta’s Host Mode card on the machine being connected to: host mode running and registered with the rendezvous, and the connectable ID underneath.
Host Mode — registered, and ready to be dialled

The rest of it.

The security model is one page. What the client actually does with the session it has protected is another — and so is what it does with AI.

Walk a session How the copilot works Download for Linux