Security and privacy
Security your customers can see
Your customer sees who is helping and can end a support session at any time. Every technician signs in as themselves, with two-factor that cannot be turned off. Available in the cloud or on-premises.
Customer in control
Your customer stays in control
In a support session the customer starts it, sees who is helping and can end it at any time.
Viewed by technician: John S. 
-
The customer starts every support session
Nothing connects until the customer types the code and opens the tool themselves. When it ends, nothing stays installed.
-
The customer sees who is helping
In a support session on Windows a banner on each viewed screen names the technician; on a Mac the menu bar item says who is viewing. The banner can never be made to claim nobody is viewing.
-
End at any time
End on any banner, Exit in the tray, or End session in the Mac menu bar ends the support session for every technician.
-
Admin rights need the customer’s Yes
Run as administrator on Windows always needs the customer to click Yes. Admin credentials are used once and never stored.
-
Mac permissions stay with the person at the Mac
Only the person at the Mac can grant Blink’s two permissions, and they can turn them off at any time.
Records
What is recorded, and what is kept out
A record of every session, with secret messages masked and typed or copied text kept out of the logs.
-
Session history on every plan
Every ended session is listed with who, what, when and how long.
-
Recordings with Blink Pro
With Blink Pro, sessions are recorded automatically. In Windows support sessions, the banner and tray show when the session is recorded. Terminal transcripts and a detailed session timeline come with it.
-
Secret messages
Passwords and codes can be sent as secret messages: revealed once, for 30 seconds, and never kept in history, recordings or logs. The screen and the recording show only a grey Secret block.
-
Logs without the private parts
Logs record what happened, not what was typed or copied. Chat events are logged, never their content.
-
Push-only diagnostics
IZT only ever receives what someone on your team sends. IZT cannot fetch anything from your Blink, and sending gives IZT no access to it.
Sign-in
Every person signs in as themselves
Own accounts, two-factor that cannot be turned off, and fresh proof for anything risky.
-
An account for every person
Every console user has their own account, so every action is tied to a named person. Nobody has access until they are given a role, and Disable signs someone out everywhere.
-
Two-factor, always on
Every sign-in needs a password plus a passkey or a code from an authenticator app. It cannot be turned off, and passkeys cannot be phished.
-
Fresh proof for high-risk actions
Opening a terminal, a Safe Mode reboot, Install Access, revoking or deleting a device, and changes to roles, users and security settings ask for a fresh passkey or code, so a stolen sign-in alone cannot do them.
Who can do what
Exactly the access each person needs
Roles, rules and alerts decide who reaches which computers, from where, and owners see what changes.
-
Roles and groups
Give each person exactly what they need, down to a group of devices. Nobody can build a role stronger than their own.
-
Terminal rights are granted on purpose
Remote terminal and Backstage with full control are never granted by ticking a whole area, nor by instance ownership alone. Only the Owner role has them out of the box.
-
IP and country rules
Limit where the console can be used from, for every user including the Owner, and where each organization’s Access devices may connect from. Customers joining Support are never restricted.
-
Revoke a lost computer
Revoke a lost or stolen computer and its credential stops working, its connection drops and open sessions end.
-
Owner alerts
Owners are alerted to new owners and role changes, sign-in resets, failed high-risk confirmations, blocked agents, reached limits and security changes that could silence alerts.
-
An activity log
Who did what, newest first, per organization and across the instance. Every alert is an activity record too.
Where it runs
You choose where it runs
Talk to us about the option that fits your policies.
Same features either way. In the cloud, IZT runs Blink for you. On-premises is Blink Pro, billed annually: it can run in closed networks, and you decide how long recordings are kept.
Questions from your security team?
Talk to us. We will walk them through how Blink keeps your customers safe.