Security & permissions
How Helm keeps remote control safe.
- Encryption: every connection is TLS 1.3. The phone trusts only the exact certificate from the QR it scanned.
- Keys: each phone has its own key in Android Keystore. The PC’s key is protected with Windows DPAPI.
- Pairing: the QR’s one-time token expires after 5 minutes; repeated wrong attempts lock pairing out.
- No accounts and no cloud login.
Access tiers
| Tier | Can |
|---|---|
viewer | See state: apps, media, stats, screen. |
remote | Also control: input, launch, media, deck. |
admin | Also power, terminal, deleting files, devices, relay. |
Admin actions ask for your fingerprint on the phone first and are written to audit.log on the PC.
Revoking a phone
On the PC: helm-agent devices lists paired phones, helm-agent revoke <device_id> removes one. On the phone: Forget this PC.