Question 1

Is this RustDesk, or something else?

Accepted Answer

It is RustDesk. TraceMote is a fork of the client and of the rendezvous/relay server, with an identity layer added on top and everything else left alone. The capture pipeline, the codecs, the NAT traversal and the peer-to-peer transport are upstream's work, and upgrades from upstream are merged in rather than reinvented.

Question 2

What did you actually change?

Accepted Answer

A login requirement on the client (off unless the build turns it on), an authorization call in the rendezvous server on both of its connection paths, a registration owner check, and a signed-configuration trust anchor so a build can be preconfigured. The relay is untouched. Each patch is listed in a patch map in the repository, and the complete diff against upstream is one git command.

Question 3

Does the login layer slow a session down?

Accepted Answer

No. Authorization happens once, during the introduction, before the two devices talk to each other. Once they are connected the session is ordinary RustDesk — direct peer-to-peer where the network allows it, relayed only as a fallback — and nothing in the media path was changed.

Question 4

What happens if the auth backend goes down?

Accepted Answer

New connections are denied. There is no silent fallback to anonymous behaviour, because a fallback that opens the door during an outage is the same as not having a door. Existing sessions keep running, registration keeps working so devices stay reachable, and an operator can still get onto a machine using a pre-issued break-glass capability that the rendezvous server verifies on its own.

Question 5

Is the connection end-to-end encrypted?

Accepted Answer

Yes — that is upstream's design and we kept it. Sessions are encrypted between the two devices using keys the rendezvous server never holds; it introduces peers and signs public keys, it does not sit inside the media stream. We additionally encrypt the rendezvous channel itself, which upstream's open-source server leaves in the clear, because that is where the login token travels.

Question 6

Can the relay server read my session?

Accepted Answer

No. The relay pairs two streams and copies bytes; the payload is encrypted between the endpoints. It is also the only component we refuse to modify, precisely so that it stays a dumb pipe with one job.

Question 7

Who can end a live session?

Accepted Answer

An administrator, from the console, either by force-disconnecting the session or by revoking the grant behind it. Both take effect within about three seconds, and both are recorded.

Question 8

What do I need to run it?

Accepted Answer

One host with a public address for the rendezvous and relay servers, a MongoDB for the auth backend, and a TLS terminator in front of the API and the console. The rendezvous server keeps its own small database. Everything ships as containers, and a compose file is in the repository.

Question 9

Which ports have to be open?

Accepted Answer

21116 on TCP and UDP for rendezvous, 21117 for the relay, 21114 for the API, and 21118/21119 if you want the WebSocket transports. Port 21115 is the NAT-type test listener and doubles as a loopback console — keep that one off the internet.

Question 10

Can I keep using clients I have already deployed?

Accepted Answer

A stock RustDesk client can still register and be controlled, but it cannot sign in against your backend, so it cannot start a connection once login is required. Roll the branded build out to the controlling machines first; controlled devices can follow.

Question 11

What licence is this under?

Accepted Answer

AGPL-3.0, inherited from upstream, and we treat that as a feature rather than a footnote. The client fork and the server fork are public, each release is tied to a public source tag, and the client's About screen carries the licence and the offer of source.

Question 12

What does it cost?

Accepted Answer

Nothing to self-host: it is AGPL source, with no seat count, no licence server and no feature locked behind a key. Managed plans, where we run your deployment and hand you signed clients, start at $49 a month for three technicians and 50 devices. MSPs can white-label it from $12 per technician, and on-premise licences start at $4,000 a year.

Question 13

Is the free version missing anything?

Accepted Answer

No. The login gate, the grants, the audit trail, break-glass and force-disconnect are all in the published source, and there is no build flag that turns a paid feature on. A plan buys operations and support, not capability — which is also why moving from managed to self-hosted later is a supported path rather than a penalty.

Questions, answered properly

Product questions

Security questions

Operations questions

Licensing questions

Still deciding?