ZynoMSPZynoSuite family
Join the program
ZynoMSP
SecurityAcross the stack

If your RMM is compromised,every client is.

You are the single point of failure for every client you manage. That's not a compliment — it's a threat model, and it's the one this stack was designed against. Built as though somebody is already inside: how ZynoRMM decides what to run, how documentation is stored, and where your clients' calls actually go.

ZynoRMMCryptographic trust

A passkey here isn't a login.It's a signature on every command.

This is the distinction that matters, and it is easy to skim past — so it's worth being precise about.

Authentication
Answers "who are you" once

You prove yourself at the door. The system hands back a session, and from then on it trusts whatever arrives carrying that session. A passkey used this way is a very good door — but it's still just a door.

Steal the session, or compromise the server that honors it, and every command after that point is indistinguishable from yours.

Cryptographic trust
Proves "this exact instruction" every time

There is no session standing in for you. Each command, script and configuration change is individually signed on your own device, with a key that has never left it — and the endpoint checks that signature itself before executing anything.

There's no token to replay, and no server whose "yes" carries any weight. Authority lives in the key, and the key lives in hardware you're holding.

Technician device
Holds the key · signs this command
Trusted
ZynoRMM bridge
Relays the payload · holds no key
Untrusted
Endpoint agent
Verifies the signature · then runs it
Trusted

The middle of that diagram is the part an attacker takes. It is also the only part with no authority to give them — our infrastructure can delay or drop your instructions, but it cannot invent one your agents will run.

The key never leaves the device — hardware-backed, non-exportable. There is no credential to phish, reuse, or lift out of a database.
Agents enroll the same way — an endpoint has a cryptographic identity too, so an impostor agent can't quietly join your fleet.
Screenshots are encrypted end to end — between the endpoint and the technician. The bridge relays bytes it cannot decrypt.
Why this matters hereRMM is the target
01
The tool is the target
An attacker doesn't need to breach fifty small businesses if the company managing all fifty has one console that reaches every one.
02
They come in through the middle
A stolen technician credential, a session token replayed, or the vendor platform itself. Any of them, and a conventional console answers.
03
Deployment does the work
Pushing to every endpoint is a feature, not an exploit. The same button that patches a fleet also encrypts one.
04
It arrives looking like you
Signed by your tooling, trusted by your agents. From the endpoint's point of view, it was you.

Every RMM vendor's answer to this is a promise about their own security. That promise is worth something right up until the day it isn't — and on that day it's the only thing between an attacker and your whole book of clients. We would rather you didn't have to take ours.

ZynoKBIn development

The crown jewels,and we can't read them.

Think about what's actually in your documentation: network diagrams, recovery procedures, which cabinet the spare keys are in, how to get into the firewall at 3am. An attacker who reads your knowledge base doesn't need to break anything — you've written them a manual.

ZynoKB keeps structured client data in ZynoCMS, the same typed content store the rest of the platform uses — so encryption happens at the field level rather than on the disk underneath. The part that matters is who holds the keys: your technicians do. Sensitive fields decrypt on their device, with a key we were never given.

It's the same instinct as the RMM, applied to storage. Our infrastructure holds ciphertext and nothing that turns it back into plaintext — so the guarantee doesn't rest on our servers never having a bad day.

Your technicians hold the keys — sensitive fields are decrypted client-side by the people authorized to see them. We store ciphertext and no means of reading it.
Encrypted per field, not per disk — full-disk encryption protects a stolen drive. It does nothing about a query against a running database, or about a copy of it that gets out.
Structured, so sensitivity is declarable — entries are typed rather than a wall of prose, so a field can be marked sensitive and stay that way everywhere it appears. The rest of a runbook remains searchable.
Client record · Northgate
In development
Site nameNorthgate — Main St
Primary contactRobin Vega
Firewall admin••••••••••••••Encrypted
Recovery passphrase••••••••••••••••••••Encrypted
Alarm code••••••Encrypted
Circuit IDNG-FIBRE-8841
Three of these six fields are ciphertext in our database — and the key that opens them isn't ours.
Call path
Encrypted throughout
Desk phone
SIP over TLS for signalling · SRTP for the audio
Browser & mobile app
WebRTC with DTLS-SRTP — keys negotiated per session
Out to the carrier
Encrypted on every hop we control, through the carrier handoff
Recordings, voicemail, transcripts, SMS
Encrypted at rest, all of it
Transcription and summarization run on our own GPUs. No recording is sent to an external AI provider.
ZynoTalkEncrypted & not shared

Their calls don't goanywhere you didn't agree to.

A phone system hears everything: the medical practice's patients, the law firm's clients, the payment details somebody reads out loud because it was easier than typing them. Whoever runs it inherits all of that.

ZynoTalk is encrypted on every hop we control — from the phone through the carrier handoff — encrypted at rest once it lands, and shared with nobody. Even the AI is ours.

TLS and SRTP to the carrier — SIP signalling over TLS and encrypted media on every leg we control, for desk phones as well as the apps.
DTLS-SRTP for browser and mobile — WebRTC media with per-session keys, so a softphone call is not the weak leg.
Encryption at rest on everything stored — recordings, voicemail, transcripts, summaries, SMS and fax. Not just the sensitive-looking parts.
Self-hosted AI — transcription and summarization run on hardware we operate. Your clients' calls are never handed to a third-party model provider.
No data sharing, full stop — nothing is sold, brokered, or used to train somebody else's product. There is no analytics partner in the middle of this.
Blast radiusIf something does go wrong

One bad day shouldn'tcost you every client.

Cryptography handles the vendor-compromise case. The rest is ordinary discipline about scope — who can reach what, with which capability, and how recently they proved it was really them.

One client cannot see another
Every client is a separate organization — its own endpoints, technicians, knowledge base and numbers.
A manager decides who reaches what
Technician and organization-user access is granted against a specific endpoint scope. Technicians register their own devices, and secure actions still demand one of them.
Scoped to the endpoint, both ways
Technicians — and your clients' own staff — get specific machines and specific capabilities, not a console that reaches everything.
Everything is on the record
Who connected, to which endpoint, when, and what they ran — a full audit trail, for your own review or a client's auditor.
Read the whole thing, not the summary

The trust model, the key hierarchy and the authorization framework are documented in full. If you have someone who evaluates this properly, point them at it.

Security modelArchitecture
Judge it yourself

Ask us the hardquestions first.

We would rather spend the first call on the trust model than on a feature list. Bring your worst scenario — the one that actually keeps you up — and let's walk through what happens.

Join the programExplore ZynoRMM