Security questions to ask any remote access vendor before you buy

Encryption and how sessions are protected

Ask what encryption standard protects a session in transit, and whether that applies to screen data, keystrokes and file transfers equally. AES-256 is a widely used, well-regarded standard, and a vendor should be able to state clearly which algorithm and key length they use rather than answering only with a general claim of encryption. Ask too whether encryption keys are managed by the vendor or can be controlled by the customer, since that affects who could theoretically access session content.

It is also worth asking whether the connection is end-to-end encrypted or whether it passes through a relay that can, even briefly, see unencrypted content. Most cloud-brokered remote access tools use a relay for connectivity reasons, which is not inherently a problem, but you should know whether that relay point ever has access to plaintext data.

• What encryption standard and key length is used for session traffic
• Does encryption cover file transfer as well as screen and input data
• Does any relay point in the connection path ever see unencrypted content

Authentication and account management

Ask whether the product supports named individual accounts per operator, rather than a shared login for a whole support team, since shared accounts make it impossible to attribute a session to a specific person after the fact. Ask whether multi-factor authentication is available, whether it can be enforced organisation-wide rather than left optional per user, and which MFA methods are supported.

It is also worth asking how quickly an account can be disabled, and whether that takes effect immediately or only at the next login, since a delay here directly affects how fast you can cut off a departing employee or a compromised credential.

• Are named individual accounts supported and enforced, not just available
• Can multi-factor authentication be mandated for every user, not left optional
• How quickly does disabling an account actually take effect

Logging, audit and retention

Ask exactly what a session log records: operator identity, target device, start and end time, and whether actions within the session, such as file transfers, are separately logged. Ask how long logs are retained by default, whether that period can be configured, and in what format logs can be exported for your own retention or audit purposes.

Ask, too, whether session content itself can be recorded as video, separate from metadata logging, and if so, who can access those recordings and how they are stored. A vendor that can answer these questions precisely, with figures rather than general assurances, is giving you something you can actually put in your own compliance documentation.

• What fields does a session log capture, and can it be exported
• What is the default log retention period, and is it configurable
• Is full session recording available, and who can access recorded content

Hosting, data residency and subprocessors

Ask where session data and metadata are actually processed and stored, and whether that location is fixed or can vary depending on how the service routes traffic. If your organisation has obligations around keeping data within the UK or the European Economic Area, this answer matters directly rather than being a background detail.

Ask which subprocessors the vendor uses, for example a cloud hosting provider, and whether the vendor can provide a data processing agreement that names them. A vendor unable to answer where data goes or who else touches it is not necessarily acting in bad faith, but it does mean you are buying without a complete picture.

Support, pricing and what happens if you leave

Ask how the vendor prices the product, whether that pricing is fixed and predictable or based on variable usage that could shift unexpectedly, and what happens to your access, your logs and any recorded sessions if you cancel. A vendor offering fixed, predictable pricing, of the kind organisations such as 247connect use, makes budgeting more straightforward than a variable per-session or per-minute model, though the right pricing model depends on your own usage pattern.

Finally, ask what security testing the vendor undertakes on its own product, such as penetration testing or vulnerability scanning, and how often. This will not always be information a vendor shares in full detail, but a vendor with a mature security practice should be able to describe its approach at a reasonable level even without disclosing every technical finding.