Reach is designed so the user's computer initiates the connection outward; no inbound workstation port needs to be exposed to the Internet.
Each device receives a cryptographically random credential. The server checks both authenticated account ownership and the selected device before forwarding a tool call.
OAuth permissions are separated into profile, workstation read, workstation write and workstation execution scopes. The plugin starts with read-oriented base scopes; write and execution scopes are requested only when a tool needs them.
Arbitrary user-level process/PowerShell execution is disabled by default and can only be enabled in local Reach settings on that computer. It never bypasses Windows UAC/admin permissions. Credential/private-key restrictions and selected high-impact command blocks remain active.
New Windows agents default to the current user's home directory. Users can explicitly expand or narrow allowed directories. Credential stores and private-key locations remain blocked locally.
File contents and command outputs are relayed in memory and excluded from persistent audit logs. Redacted audit metadata is automatically deleted after 30 days.
To report a security issue, use ExamediX Reach Support and choose "Security", or email support@examedix.ch. Do not include passwords, private keys or sensitive file contents.