# Security and privacy

> How IZT Blink keeps remote support and access safe: a customer who sees who is helping and can end a support session at any time, clear records, always-on two-factor, roles and groups, an activity log, and the choice of cloud or on-premises.

Canonical page: https://blink.izt.app/security · Markdown: https://blink.izt.app/security.md

## Your customer stays in control

In a support session the customer starts it, sees who is helping and can end it at any time.

- **The customer starts every support session.** Nothing connects until the customer types the code and opens the tool themselves. When it ends, nothing stays installed.
- **The customer sees who is helping.** In a support session on Windows a banner on each viewed screen names the technician; on a Mac the menu bar item says who is viewing. The banner can never be made to claim nobody is viewing.
- **End at any time.** End on any banner, Exit in the tray, or End session in the Mac menu bar ends the support session for every technician.
- **Admin rights need the customer’s Yes.** Run as administrator on Windows always needs the customer to click Yes. Admin credentials are used once and never stored.
- **Mac permissions stay with the person at the Mac.** Only the person at the Mac can grant Blink’s two permissions, and they can turn them off at any time.

What your customer sees: https://blink.izt.app/join

In the documentation: https://docs.blink.izt.app/use/what-customers-see/

## What is recorded, and what is kept out

A record of every session, with secret messages masked and typed or copied text kept out of the logs.

- **Session history on every plan.** Every ended session is listed with who, what, when and how long.
- **Recordings with Blink Pro.** With Blink Pro, sessions are recorded automatically. In Windows support sessions, the banner and tray show when the session is recorded. Terminal transcripts and a detailed session timeline come with it.
- **Secret messages.** Passwords and codes can be sent as secret messages: revealed once, for 30 seconds, and never kept in history, recordings or logs. The screen and the recording show only a grey Secret block.
- **Logs without the private parts.** Logs record what happened, not what was typed or copied. Chat events are logged, never their content.
- **Push-only diagnostics.** IZT only ever receives what someone on your team sends. IZT cannot fetch anything from your Blink, and sending gives IZT no access to it.

History and recording features: https://blink.izt.app/features#group-records

## Every person signs in as themselves

Own accounts, two-factor that cannot be turned off, and fresh proof for anything risky.

- **An account for every person.** Every console user has their own account, so every action is tied to a named person. Nobody has access until they are given a role, and Disable signs someone out everywhere.
- **Two-factor, always on.** Every sign-in needs a password plus a passkey or a code from an authenticator app. It cannot be turned off, and passkeys cannot be phished.
- **Fresh proof for high-risk actions.** Opening a terminal, a Safe Mode reboot, Install Access, revoking or deleting a device, and changes to roles, users and security settings ask for a fresh passkey or code, so a stolen sign-in alone cannot do them.

In the documentation: https://docs.blink.izt.app/configure/sign-in-and-two-factor/

## Exactly the access each person needs

Roles, rules and alerts decide who reaches which computers, from where, and owners see what changes.

- **Roles and groups.** Give each person exactly what they need, down to a group of devices. Nobody can build a role stronger than their own.
- **Terminal rights are granted on purpose.** Remote terminal and Backstage with full control are never granted by ticking a whole area, nor by instance ownership alone. Only the Owner role has them out of the box.
- **IP and country rules.** Limit where the console can be used from, for every user including the Owner, and where each organization’s Access devices may connect from. Customers joining Support are never restricted.
- **Revoke a lost computer.** Revoke a lost or stolen computer and its credential stops working, its connection drops and open sessions end.
- **Owner alerts.** Owners are alerted to new owners and role changes, sign-in resets, failed high-risk confirmations, blocked agents, reached limits and security changes that could silence alerts.
- **An activity log.** Who did what, newest first, per organization and across the instance. Every alert is an activity record too.

Organizations and roles for MSPs: https://blink.izt.app/msp

In the documentation: https://docs.blink.izt.app/configure/roles/

## You choose where it runs

Talk to us about the option that fits your policies.

- **Cloud or on-premises.** Same features either way. In the cloud, IZT runs Blink for you. On-premises is Blink Pro, billed annually: it can run in closed networks, and you decide how long recordings are kept.

On-premises terms: https://blink.izt.app/pricing#on-premises

In the documentation: https://docs.blink.izt.app/get-started/what-is-blink/

## Get started

- Start a trial: https://blink.izt.app/trial (a short request form; there is no self-serve sign-up, and we set the trial up with you in the cloud or on-premises)
- Talk to us: https://blink.izt.app/contact
- See plans and pricing: https://blink.izt.app/pricing
- Customers with a code: https://blink.izt.app/join
- Documentation: https://docs.blink.izt.app

---

IZT Blink is made by IZT Apps and is available in the cloud or on-premises. Start a trial: https://blink.izt.app/trial · Talk to us: https://blink.izt.app/contact · Documentation: https://docs.blink.izt.app
Everything about the product: https://blink.izt.app/llms-full.txt · Index: https://blink.izt.app/llms.txt · JSON: https://blink.izt.app/api/facts.json