Vexaro Desk Supplement

1. Introduction & Precedence

This Vexaro Desk Supplement (the “Supplement”) refines and supplements the Terms of Service for Vexaro Desk, the Product that provides remote desktop access, remote support, and related session capabilities. It applies whenever the Customer or any Authorized User uses Vexaro Desk, in addition to the Terms of Service and the policies referenced there.

Capitalised terms used in this Supplement have the meanings given in the Definitions of the Terms of Service. In this Supplement, Vexaro, we, us, and our mean Vexaro, LLC, a limited liability company organized under the laws of the State of Delaware, USA, unless a different Vexaro contracting entity is expressly identified in your Order Form, Statement of Work, invoice, or account record.

This Supplement forms part of the agreement between the parties. If this Supplement conflicts with an Order Form, the Order Form controls. To the extent of any conflict on a matter specific to Vexaro Desk, this Supplement prevails over the Terms of Service; in all other respects the Terms and the referenced policies continue to apply, in the order of precedence set out in the Terms of Service. Where this Supplement is silent, the Terms of Service govern.

---

2. Authorised Devices

Vexaro Desk lets an Operator view, control, and support a remote device through screen streaming, remote keyboard and mouse input, clipboard exchange, and file transfer. These capabilities may be used only against devices, systems, and sessions that the Customer owns or that the Customer is explicitly authorised to access, control, monitor, record, and support.

The Customer is responsible for establishing that authorisation before any session begins. The presence of a technical capability in Vexaro Desk is not, by itself, authorisation to use it against any particular device. Use of Vexaro Desk remains subject to the Acceptable Use Policy, including its authorisation requirement and its prohibition on unauthorised access, monitoring, and control. If the Customer is unsure whether it is authorised to access a device, it must not connect to that device.

---

3. Attended Access

Attended access is a session that takes place while an End User is present at the host device. Vexaro Desk supports attended access through an explicit consent mechanism: the session is established only after the End User at the host explicitly approves the connection at the host device, in the manner offered by the Vexaro Agent. Today this is an on-screen request that shows who is asking and lets the End User accept or decline.

The Customer is responsible for ensuring that attended sessions are initiated only with that consent and only for a legitimate, authorised purpose. Consent given for one session does not authorise later sessions; each attended session relies on the consent or approval given for that session, except where unattended access has been configured under Section 4.

---

4. Unattended Access

Unattended access allows an Operator to connect to a device without an End User being present to approve the connection. It is turned on at the device itself: an access password is set in the Vexaro app on that device, and a connection that presents the password is accepted without an on-screen request. The access password can be limited further to a list of named Vexaro IDs; while that list is empty, anyone who knows the password can connect. On a machine-wide installation, setting or removing the access password requires Windows administrator rights on the device; on a per-user or portable installation, the user of the device can set it. Vexaro does not currently offer a role or permission in the Customer’s organisation that controls unattended access.

The Customer must enable unattended access only on devices where an authorised administrator of the Customer has decided to allow it, and is responsible for:

• a. deciding which devices may be accessed unattended, and having the right to enable unattended access on each such device;
• b. choosing strong access passwords, giving them only to currently authorised Operators, and using the list of Vexaro IDs to limit who may connect; and
• c. changing or removing the access password, or updating the list of Vexaro IDs, promptly when a device or an Operator is no longer authorised.

The administrative privileges associated with unattended access must be granted and used in accordance with the Acceptable Use Policy.

---

5. Recording

Vexaro Desk includes session Recording on the Team, Business, and Enterprise plans (including the one-month Team trial). Session recording is off unless the Customer turns it on. On the Team, Business, and Enterprise plans (including the Team trial), an owner or administrator of the Customer’s organisation can turn recording on in the administrative console and choose where the recording files are kept: on the computer that is accessed, on the operator’s computer, or on both. The operator’s computer keeps a copy only when the operator connects with the Vexaro Windows app and is a member of the Customer’s organisation; otherwise the computer that is accessed keeps the file. The files are written on those computers by the Vexaro Windows app (version 0.2.15 or later; older versions do not record) and are never uploaded to Vexaro. Vexaro stores only each Recording’s details (the session, the time, which computer keeps the file and where on it, its size and duration) and its event timeline, retained for the recording-retention period of the Customer’s plan; each time the Vexaro app finishes a recording on a computer, it deletes the recording files older than that period from its recordings folder there. From version 0.2.13 the app shows on the host that a session will be recorded and marks a recorded session REC. The details are set out in the Recording & Monitoring Notice.

Live session media is encrypted in transit and is not stored by Vexaro. Between Vexaro apps the media is encrypted end-to-end, whether the devices connect directly (peer-to-peer) or through a relay because a direct connection is not possible: the two devices agree the keys of each session, no Vexaro component holds them, and a relay forwards data it cannot read. This needs version 0.2.13 or later of the Vexaro app on both devices; where one of them runs an older version, a relayed session is encrypted with a key the relay supplies and is not end-to-end encrypted against the relay. A browser-viewed session is opened by a Vexaro server component (the browser bridge) to deliver it to the browser, without being stored. Vexaro does not store or inspect the content of live sessions, and the video of a Recording stays on the Customer’s computers. When a session is recorded, the resulting Recording is Customer Content: its files stay on the Customer’s computers, and Vexaro keeps its details and event timeline for the recording-retention period of the Customer’s plan, accessible to the owners, administrators, and auditors of the Customer’s organisation.

The Customer is responsible for using Recording lawfully, including for any notice and consent its use of Recording requires. Further detail on how recording, monitoring, and logging work, and on the responsibilities that attach to them, is set out in the Recording & Monitoring Notice.

---

6. End-User Notice (Customer Obligation)

The Customer is responsible for notifying its employees, contractors, and other End Users in advance that their devices and sessions may be accessed, controlled, monitored, and logged through Vexaro Desk (and, on plans that include session recording, recorded), and for explaining the purpose and scope of that access.

The Customer must ensure that it has a lawful basis for the remote access, monitoring, logging, and Recording it carries out, and that it has provided all notices and obtained all consents required for its use in each place where its End Users are located. This obligation rests with the Customer because the Customer determines who is accessed, why, and on what terms; Vexaro acts on the Customer’s configuration and instructions. How Personal Data is handled in connection with the Service, and the Customer’s role in providing End-User notice, are described in the Privacy Notice.

---

7. Operator Conduct & Responsibility

An Operator is an Authorized User who initiates or controls a remote session. Within a session, the Operator may view the screen, control input, exchange clipboard data, and transfer files, subject to the permissions the Customer configures and to the consent or enrolment that authorised the session.

Vexaro is not responsible for the actions an Operator performs during a session. The Customer is responsible for the acts and omissions of its Operators and other Authorized Users in connection with Vexaro Desk as if they were the Customer’s own, including the commands they run, the changes they make, the files they transfer, and the data they access. The Customer must ensure that its Operators are authorised, trained, and supervised, and that they use Vexaro Desk in accordance with this Supplement, the Terms of Service, and the Acceptable Use Policy. Vexaro provides the means to record and audit sessions (Sections 5 and 8) so that the Customer can oversee its Operators; it does not direct or review what Operators do.

---

8. Emergency Access

Emergency or break-glass access is access used outside the Customer’s normal approval flow to address an urgent operational or security situation. Where the Customer’s configuration provides for it, each use of that access must be logged and auditable. Vexaro Desk records emergency-access events in the audit log alongside ordinary session events, so that the Customer can review who invoked emergency access, when, and to which device.

The Customer is responsible for defining when emergency access may be used, for restricting it to authorised Operators, and for reviewing the resulting audit records. Emergency access does not relax the authorisation requirement in Section 2 or the Customer’s responsibilities under this Supplement; it changes only the approval path, not the duty to be authorised. Audit-log retention follows the Customer’s plan, as described in the Privacy Notice.

---

9. File Transfer & Clipboard

Vexaro Desk supports bidirectional file transfer and clipboard exchange between the Operator and the remote device. These features may be restricted by the Customer’s policy: the Customer may, through its configuration, enable, limit, or disable file transfer and clipboard exchange for particular roles, devices, or sessions.

File transfer and clipboard exchange remain subject to the Acceptable Use Policy. The Customer and its Operators must not use these features to transfer malicious code, to move content they are not authorised to access or distribute, or otherwise in breach of the AUP or applicable rules. The Customer is responsible for the files and data transferred through Vexaro Desk by its Authorized Users.

---

10. Beta Clients & Downloads

Vexaro may make Vexaro Desk client software, agents, and related downloads available, and may offer some of them as beta, preview, early-access, or evaluation releases. Releases identified as Beta are provided “as is” and “as available”, without production, service-level, or warranty commitments, as set out in the Terms of Service. The Service Availability Policy does not apply to Beta clients or features, and a Beta release may be changed, limited, or discontinued, and may never become generally available.

The Customer should not rely on Beta clients or features for production or business-critical purposes and should keep its Vexaro Desk clients and agents reasonably up to date. Use of any client or download remains subject to this Supplement, the Terms of Service, and the Acceptable Use Policy.

---

11. Contact

For questions about this Supplement or about Vexaro Desk:

• Legal & contracting: [email protected]
• Support: [email protected]
• Privacy / data-protection contact: [email protected]
• Abuse reports: [email protected]

Contracting and notice details are provided on invoices and Order Forms.

---

This document is part of the Vexaro Legal Center.