ManagedBit

Remote control
you can prove.

The MSP platform built on an end-to-end encrypted core. Remote access, RMM, PSA and automation, from any device you own.

See how a session is secured
frontdesk-02 LiveUnattended · control-plane authorizedAuthorized for 9 minEnd-to-end End

The ManagedBit Viewer, redrawn from the shipping app. Frame rate and latency move inside our measured range.

57–61 fpsat 1440p with encryption on, measured
0 keysheld by the relay in the middle
~100 msto end a session if its banner is hidden
5 ViewersMac, Windows, Linux, iPad and iPhone

Most remote tools ask for your trust. ManagedBit is built so you can check. Every session is encrypted from your device to the machine. The relay in the middle only ever carries noise. The person at the machine always sees you. And every step lands in a record nobody can quietly edit.

Security

What happens when you click Connect.

Seven things, in order, every time. Keep scrolling.

Signed before it starts.

Clicking Connect opens the Viewer with a single-use link and a grant your control plane signed. The Viewer verifies both first, and the grant fixes what you can use: here, screen, input, terminal and files.

The relay carries noise.

The Viewer and the machine meet through a relay and build an end-to-end encrypted session: Noise over QUIC, ChaCha20-Poly1305 on every channel. The relay holds no keys, no frames and no grants.

Your key has to be there.

On clients that require it, every connection waits for a touch of your own hardware key, bound to this exact handshake. A copied grant opens nothing, and the machine proves itself with its TPM too.

Nothing happens until they allow it.

The person at the machine gets a prompt the technician can't see or click. It names who is asking and what for, there's no keyboard shortcut to Allow, and an unanswered prompt denies itself.

Always on screen.

The banner names who is connected and what's in use, with Stop remote access one click away. Hide it, minimize it or move it off its display and the session ends in about 100 ms.

Keys that never sit still.

Session keys ratchet about every two minutes and a fresh Diffie-Hellman round runs every ten. Everything lands in a hash-chained record at both ends, and the person can read theirs from the tray.

Revoked in milliseconds.

Revoke a technician and the machine hangs up in about 18 to 35 ms. The Viewer says plainly what happened, and the tray keeps the last session on record.

Every device

From any desk.
Or no desk at all.

The Viewer runs on Mac, Windows, Linux, iPad and iPhone, and reaches Macs, PCs, Linux desktops and headless servers over the same encrypted session.

MacWindowsLinuxiPadiPhone
MacWindows PCLinuxServer
frontdesk-02 LiveUnattended · control-plane authorizedAuthorized for 9 minEnd-to-end End

Your Mac. Their Windows PC.

Answer UAC prompts, connect at the Windows sign-in screen, pick a user's session and keep working through lock, sign-out and restart.

Your PC. Their Mac.

Identity in the Secure Enclave, the real cursor over text and window edges, and capture that rebuilds itself in about 60 ms.

Linux on both ends.

The same native Viewer on Linux workstations, and Ubuntu and Debian desktops with screen, input, terminal, files and clipboard on one session.

An iPad that works like a workstation.

A full Viewer with keyboard and trackpad, direct touch, a monitor strip and an external display. Taking control is a Face ID decision every time.

The fix from your pocket.

Take control from your iPhone with Face ID, point like a trackpad, and type with a key row that has Esc, Tab and sticky modifiers.

Servers with no GPU at all.

A tiles-only software codec streams headless machines and VMs, and background SYSTEM sessions reach a server nobody is signed in to.

The Viewer

Fast enough to forget it's remote.

Rebuilt from the codec up for what technicians actually do: read text, scroll logs and move between monitors. Every number here was measured.

Text stays text.

Event 7036 · Service Control Manager
10:42:07 The Print Spooler service entered the running state.
10:41:55 The Print Spooler service terminated unexpectedly.
10:38:12 Group Policy settings applied successfully.
10:31:40 The Windows Update service entered the running state.
10:29:03 Disk C: free space 11.8 GB (9.6%).

Every 128×128 tile of the screen is sorted as it changes: text to a lossless codec, pictures to hardware HEVC, flat colour to a single fill command. Edge fidelity measures 1.0, against 0.88 to 0.95 for video-only codecs. Drag to compare.

60 fps, encrypted.

60frames per second
1440p · encryption on
57–61 fpsmeasured at 1440p on macOS and Windows
~20–30 msfrom capture to glass

Scrolling without smear.

10:31:40 wuauserv running
10:33:02 spooler running
10:35:17 disk C: below 12%
10:36:44 gpupdate applied
10:38:12 defender sigs 1.419.2
10:41:55 spooler terminated
10:42:07 spooler running
10:44:30 w32time synced
10:46:05 bits running
10:47:51 cpu 91% for 4 min
10:49:12 cpu back under 60%
10:50:40 wuauserv idle
10:52:18 dhcp lease renewed
10:53:55 defender scan clean
10:55:02 spooler running
10:56:47 winrm running
move · 13 bytes

A verified scroll ships as a 13-byte move record plus the rows that are actually new, so text stays sharp while it moves.

Every monitor, its own stream.

The monitor you're on runs at full rate. The others stay as live previews that pause under bandwidth pressure. Click one to switch.

One pair of hands.

KJKim JungOwnerDriving
CDChris DoyleObserver
Chris asks to driveDeclineGrant

Colleagues join a live session through the same checks as the first technician. Control passes between people and is never shared, and the banner at the machine names who is driving.

A real terminal.

PowerShellSYSTEM · Command Prompt+
PS C:\Users\kim> Restart-Service Spooler -PassThru

Status   Name      DisplayName
------   ----      -----------
Running  Spooler   Print Spooler

PS C:\Users\kim>

Up to eight real terminals per session, with full-screen tools working. Opening one as SYSTEM in the background session is its own permission, recorded on the machine every time.

Files, both ways.

This Mac~/Downloads
fee-schedule-2027.xlsx84 KB
printer-driver-v4.zip38 MB
intake-form.pdf212 KB
frontdesk-02C:\Support
logsfolder
inventory.csv12 KB
setup.log4 KB
printer-driver-v4.zip → C:\Support64%
resumes where it stoppedBLAKE3 check on arrival

Drag files either way. Transfers resume after a drop, every file is verified end to end, and a tenant can allow sending fixes in while nothing leaves the machine.

Heals in about 3 KB.

keyframe~200×
refresh~3 KB

A lost packet is repaired with a small reference refresh, roughly 200 times smaller than a keyframe, and parity fixes single losses with no round trip.

Wi‑Fi to hotspot, mid-session.

active roamheals in ~5 ms
NAT rebind130–500 ms

Change networks and the session moves with you. Anything longer resumes in about half a second, with authorization checked again.

Six digits. Two people.

Verify the session code

Confirm this code matches the consent banner on the remote machine before taking control.

482913
Codes match — start sessionThey don't match

In attended support, both ends derive the same six digits from the handshake and the machine's banner shows them. If they differ, someone is in the middle, and the Viewer says to stop.

Sign-in screens, no password shown.

LR Linda Reid •••••••••••• Filled from the vault · you never see it

Work a machine at its Windows sign-in screen or a UAC prompt, and let the vault type the credential. You use the password without ever knowing it, and it can rotate after every use so no standing admin is left behind.

Talk while you work.

Chat · frontdesk-02end-to-end encrypted
Is it fixed? We have invoices going out today.
Printing now. Try the intake form again?
It came out. Thank you!

A chat lane runs inside the live session, encrypted like the screen itself. Saving it to the ticket asks first.

The platform

Everything else your MSP runs on.

Clients, devices, tickets, patching, software, automation and billing share one console, one permission model and one audit trail.

ManagedBit All clients ▾⌘KKJ
DashboardExample data
Needs attention4
Real-time protection is offreception-01 · BillRecon
Open →
Disk C: below 10%fs-01 · East Coast Heat
Open →
18 devices waiting on a restartPatch deadline Friday 18:00 · ProSales Staff
Open →
Possible clone: train-pc-11Unattended access paused until someone clears it
Review →
Online24 h
1,187of 1,204
Patch compliance30 d
96.4%
Disk encryptioncoverage
98.9%
Desired state holding7 d
97.1%
MSPs

Built for MSPs from the first table.

MSP, client and site are the shape of the data. Row-level security makes a read across tenants a database impossibility. Access policy is real policy you can dry-run against live devices before you save it, and brand packs put your name on the console, the Viewer and the tray.

Clients › OrganizationsExample
NWNullWorriesMSP · 1,204 devices
BRBillRecon312
MOMain office188
WBWestside branch124
PSProSales Staff96
ECEast Coast Heat796
Dry run · draft rule for BillRecon
forbid (principal, action == Action::"connect_unattended", resource) unless { context.business_hours };
312devices affected
1live session would end
2parent rules still apply

Credentials

An admin account that exists for eleven minutes.

No standing admin passwords shared across your clients. Technicians and automations use credentials without ever seeing them, and they're gone when the work is done.

  1. Kim asks to use local admin

    On frontdesk-02, for ticket WI-2231, with a reason.

  2. An administrator approves

    From the phone app, with Face ID, because policy says so.

  3. A one-time admin account is created

    Its password is sealed to frontdesk-02's own key.

  4. The UAC prompt is signed in

    The agent types it on the secure desktop. Nobody sees it.

  5. Kim ends the session

    Every step is in the audit trail, with who, why and which ticket.

  6. The account is deleted

    The password it had no longer exists anywhere.

Example session: the account exists for 11 min 43 s and nobody ever sees its password. Windows LAPS passwords and short-lived SSH certificates go further: they are never stored at all.
Two places, ever

The password exists in the broker's memory and on the machine that uses it. Never on a technician's laptop, in a log or in a job queue.

One action when someone leaves

Offboard a technician and every credential they could have seen is rotated in one step.

Break-glass, witnessed

Revealing a critical secret takes a second administrator, tells your security contacts, and rotates it straight afterwards.

Reuse and breaches, caught

Reused and breached passwords are found using keyed fingerprints and Have I Been Pwned's range check, so no password is ever sent to be checked.

While you were asleep

The night shift runs itself.

Crashed services restart themselves, updates install in each client's window, and a machine that keeps dropping off becomes one alert instead of twenty. By morning there's one short list: what needs you.

  1. Disk C: fell below 10% freefs-01 · East Coast Heat

    Self-healing fixed the problem (attempt 1): the bound clean-up script freed 8 GB.

    fixed
  2. Print Spooler stoppedfrontdesk-02 · BillRecon

    Self-healing fixed the problem (attempt 1), inside its cooldown and daily maximum.

    fixed
  3. Maintenance window, 02:00 to 03:1018 devices · BillRecon

    Approved updates installed, with restarts held to the window.

    installed
  4. Went offline and came back 4 timestrain-pc-11 · ProSales Staff

    One alert, raised 4 times under one key. Nobody got four pages.

    ×4 flapping
  5. Real-time protection turned offreception-01 · BillRecon

    Raised as a critical alert and put at the top of the morning's list.

    attention
ManagedBitKJ
DashboardExample

Fleet, sessions and posture at a glance — every tile reads live data.

Needs attention1
Real-time protection is offreception-01 · BillRecon · since 04:26
attention
Patch compliance
96.4%
Disk encryption
98.9%
Example night. Every retry has a daily budget and an expiry, protected services are never touched, and each attempt is written to a tamper-evident trail.

Network

No probe box. The fleet is the sensor.

The managed computers already in the office listen to its network. They name what they find, watch the infrastructure, and say plainly what they can't see.

Say yes once.

Turn network monitoring on for a client, or for every new client. When three of their computers share a network on two different days, ManagedBit recognises the office, and an administrator confirms it with one click.

Only there, only listening.

Computers listen only on the confirmed office network, never from home or over a VPN. Phones with private addresses are counted, never named.

Every name shows its evidence.

Vendor, kind and confidence come with the reason for them. Correct a wrong one once and it's fixed at every client you manage.

Blind spots are sentences.

One status line says what is being watched, and anything it can't see comes with the reason and the fix.

Wake a sleeping machine through a neighbour on the same network, and open an SSH session to a switch with a credential nobody has to see.

Clients › BillRecon › NetworkExample
We see BillRecon's office network 10.1.0.0/24 behind a Cisco Meraki gateway, 14 computers there now.
Watch this networkNot now
Watching 9 infrastructure devices; 31 others named; last new device 2 h ago.
  • Cisco Meraki · gatewaycertain — this network's gateway, by its MAC maker
    watched
  • Ubiquiti · access pointprobable — MAC maker + its _ubnt network service
    watched
  • HP · printercertain — it announces an HP LaserJet M404 over IPP
    named
  • APC · UPSprobable — SNMP identifies a Smart-UPS
    watched
  • Unknown device · 10.1.0.87no name yet — nothing it announces matches the library
    Help identify

12 devices use private addresses, so they're counted, never named.

Your customers

Close to your customers. Hard to impersonate.

Scammers pretend to be IT. Give the people you look after one place where you really are, and a way to prove who's on the phone.

One conversation, wherever they are.

Every ticket is one conversation. Reply once and choose how it goes: tray chat, email, the portal, Teams or SMS, starting with wherever the person is right now. The tray chat wears your brand, shows each technician's verified name, and tells people exactly where you will and won't contact them.

Chat with NullWorries
NullWorries only chats with you here, in your ticket emails, and in a remote session they have asked to start. If someone on Teams or on the phone says they are NullWorries, check here first.
Kim Jung · NullWorriesThe printer's working again. Can you try the intake form?
It printed. Thank you!Seen
Send viaTray chatEmailPortalTeamsSMS

Know who you're helping.

Press Verify and every method is listed with its strength. The person types the code you show, so nobody gets used to tapping Yes. Resetting a password or MFA always needs a strong method, and “This wasn't me” raises an alert.

Verify Linda Reidfor a password reset · needs Strong
Face-verified passkey in the appStrongest
Sign in with her company accountStrongWaiting for Linda…
Okta Verify pushStrong
“Is this you?” in TeamsMedium
Code on her computerDevice
Code by text or emailWeakaddress added 2 days ago

Warn them before you call.

Press “I'm calling them” and the person's own computer names who is about to phone and why, using a name it checked with you. Anyone else claiming to be you is caught out before the call starts.

Kim Jung is calling you

Kim Jung at NullWorries is about to phone you about ticket WI-2231. This computer checked their name with NullWorries. If a caller says they're from NullWorries but isn't Kim, don't do what they ask.

Let their people sign off.

A client's own change board approves, votes or signs off from the phone app, the portal or an email link, with rules like two people, a majority or everyone, and ballots sealed until close. An approval locks to the exact plan, so a change can't run unless what was approved is what runs.

Replace the front-desk printerBillRecon change board · any two people · closes Fri 17:00
1 of 2
GN
Gary NovakOwner
Approved
LR
Linda ReidFront desk lead
Waiting
JR
Joe RussoOffice manager
Waiting
Joe or Linda can still approve it.

On their screen

What your clients see.

Your name in their menu, fixes they can run themselves and updates that ask first. And when someone who isn't a client yet needs help, nothing gets installed.

Settings—▢✕
SystemBluetooth & devicesNetwork & internetAppsAccountsPrivacy & security Windows Update
Windows Update
✓
You're up to date
Last checked: Today, 10:12 AM
Check for updates
Update history›
Advanced optionsManaged by your organization
Pause updates›
Search10:42 AM
9/27/2026

AI, on your terms

AI that works for you. Only when you say so.

Ask ManagedBit sees exactly what you can see and nothing more. It's off until an administrator turns it on, and it runs on your own model if you prefer.

Ask ManagedBitExample
Which of East Coast Heat's laptops haven't installed updates in 30 days?
Three East Coast Heat laptops haven't installed an update in 30 days: ech-lt-014 (41 days, restart pending), ech-lt-022 (37 days, offline since 12 September) and ech-lt-031 (33 days, the last install failed twice).
Records read · 3 devices · 1 patch planSuggested by Claude, 10:42
Settings › AIExample
AI for NullWorriesOff until an administrator turns it on
Ticket summaries and draft replies
Tickets and people's detailsWhat Ask ManagedBit may read, listed in full
ProSales Staff kept outNothing from this client reaches a model
ManagedBit's keyincluded allowance
Your own keyAnthropic · Bedrock · Azure · on-prem
Model calls, recorded before sending
10:42Ask · Kim Jungfp 7c1e…a90
10:31Summary · WI-2229fp 03bd…e17
Off by default

One switch for the MSP, one per purpose, and any client can be kept out entirely.

Your own model

Use our included allowance or bring Anthropic, Amazon Bedrock, Azure or a model on your own hardware.

Recorded first

Every call records the purpose, the model, where it went and a fingerprint of what was sent, before anything leaves.

Never your sessions

Remote-session content is end-to-end encrypted. The control plane has no way to send it to a model.

Always labelled

Anything a model wrote wears these colours and names the model. It never sends on its own.

Summaries and drafts

Ticket summaries, draft replies and triage suggestions a technician edits before anything goes out.

After-hours line

An AI phone line that says it's an AI, opens a ticket and offers a callback to the number on file.

In Teams

Your branded Teams app gives clients a chat, their tickets and a heads-up when you already know about an outage.

iPhone and iPad

Your whole desk, in your pocket.

Approve, answer and, when it matters, take control with Face ID. On an iPad with a keyboard and trackpad, it's a full Viewer.

studio-mac-miniLive · You're drivingEnd
NullWorriesApprovals
New device br-frontdesk-03 BillRecon · Windows 11 · enrolled 2 min ago
RejectApprove
Approved with Face ID
Change · WI-2244 Replace the front-desk printer Asked by Linda Reid. A decision is made once, and the ticket records who made it.
DeclineApprove
Take control with Face ID

Sessions open view-only. Taking control is its own Face ID decision every time, whatever the policy says.

Point your way

Use the screen as a trackpad or tap exactly where you want. Two fingers right-click and scroll, and a loupe shows what's under your finger.

Type anything

A key row with Esc, Tab, arrows, F-keys and sticky modifiers. Autocorrect stays off, because anything you type might be a password.

The rest of your day

Approvals, alerts, live sessions with End, tickets, asset scanning, site photos and onsite time that never tracks where you are.

Your infrastructure

Run the whole thing yourself.

One compose file stands up the control plane. The relay is a single binary on a node you choose. No platform dependencies, no calls out to CDNs.

$ docker compose up -d
[+] Running 6/6
 ✔ Container db         Healthy
 ✔ Container keycloak   Started
 ✔ Container migrate    Exited (0)
 ✔ Container control    Started
 ✔ Container broker     Started
 ✔ Container caddy      Started
$ # the relay is one binary on a node you choose.
$ # it forwards ciphertext and holds no session keys.
$
You're the recovery path

Break-glass accounts on hardware keys mean the vendor is never how you get back in. Self-hosted, there's no vendor in it at all.

Your region, if we host it

The US, Australia, the UK and the EU each run as a complete, separate deployment with their own database, sign-in, relays and keys.

Keys you hold

Recordings and artifacts wrap to a root key in your own key service, so recovery is your capability and never ours.

Everything in the box

One agent. One console.
The whole kit.

Remote access

  • 60 fps end-to-end encrypted desktop
  • Lossless text over hardware video
  • Every monitor as its own stream
  • Viewers for Mac, Windows and Linux
  • Full Viewer on iPad, control from iPhone
  • Terminal tabs, as the user or SYSTEM
  • Dual-pane files with resumable transfers
  • Clipboard, each direction permissioned
  • Several technicians in one session
  • Hand off or claim a session
  • UAC prompts and Windows sign-in screens
  • Encrypted chat inside the session
  • Quick Support app that leaves nothing behind
  • Branded support page and website launcher

Security and trust

  • Zero-knowledge relay
  • Keys in Secure Enclave and TPM
  • TPM attestation against 2,160 trust anchors
  • Passkey sign-in and per-action step-up
  • Nine separated signing keys
  • Hash-chained audit at both ends
  • A consent banner nobody can remove
  • Prompts at the machine the technician can’t see
  • Revocation in milliseconds
  • Clone detection
  • Network login policy
  • Break-glass accounts
  • Credentials you use without seeing
  • No standing local admin
  • Customer-held encryption keys

RMM

  • Inventory in 11 sections on every OS
  • Antivirus, EDR and MDR health
  • Monitoring evaluated on the device
  • Event-log monitoring
  • Self-healing remediation
  • Signed script library
  • Live metrics, one reading a second
  • Network discovery that names devices
  • Wake-on-LAN
  • What changed, why, and undo
  • Client sites on a map by worst alert
  • Compliance dashboards and reports

Patching and deployment

  • OS and third-party patching
  • Rings that stop on post-install health
  • Urgency from known-exploited vulnerabilities
  • Maintenance and freeze windows
  • Baselines and desired state
  • Signed, hash-pinned software catalog
  • Your own private apps
  • One-command agent install
  • Silent MSI, .deb and Mac packages
  • Install tokens that carry groups

PSA

  • Tickets, requests, projects and changes
  • Onboarding and offboarding
  • SLA clocks that pause when they should
  • Time suggested from real activity
  • Service plans and invoices
  • Tray chat, email, portal, Teams and SMS in one thread
  • Customer portal with photos and approvals
  • Verify the caller before you help
  • “I’m calling them” notices
  • Change boards made of the client’s own people
  • Knowledge with reviewed Known Fixes
  • Assets from the box to disposal
  • Stock, ownership and resale
  • Works beside your existing PSA

Automation and AI

  • Automations written in plain words
  • Alerts, schedules, events and webhooks
  • A trial week before anything changes
  • Per-run change limits and pause
  • Ask ManagedBit, scoped to what you can see
  • Ticket summaries, drafts and triage
  • An AI line for after-hours calls
  • A branded Teams app for your clients
  • Bring your own model
  • API and MCP access as yourself

Platform

  • MSP, client and site tenancy
  • Row-level security on every table
  • Access policy with a dry run
  • Your brand on console, Viewer and tray
  • Sign in with Microsoft, Google or Okta
  • Microsoft 365 and Google Workspace
  • Self-hosting with one compose file
  • Hosting in the US, Australia, the UK and the EU
  • Apps for iPhone, iPad and Android

Bring us your
hardest client.

Early access is open to MSPs who care how their tools are built. Tell us about your fleet and we'll set you up.

Back to the foundation

Request early access

Tell us about your MSP and what you'd like to try. A person reads every request.

Need help? Email support@managedbit.com.