ARIVARAN REACH

Reach your laptop from any browser.

When a direct path is available, Arivaran Reach connects a supported browser directly to an enrolled laptop without putting a remote-desktop relay in the session data path. The control plane still performs discovery, authorization, policy, and connection setup; protocol support and endpoint prerequisites remain explicit.

Your laptop. Any supported browser. No session-data relay—when direct.

Setup neededManaged remote access

Open the canonical product panel Products

Reach Managed

Setup needed

The diagram shows the mechanism, its current result, and the limit that remains in force.

Step 1 of 3Policy before connection
Identity and device scope are evaluated before the selected protocol is carried over the outbound-only transport path.
Step 2 of 3Browser-tab managed access
The evidenced path supports governed access to enrolled endpoints without opening an inbound endpoint port.
Step 3 of 3Evidence boundary
Outbound transport is a Beam capability. This panel does not imply every protocol, platform, or powered-off state is accepted.

Mechanism

Identity and device scope are evaluated before the selected protocol is carried over the outbound-only transport path.

Platform state

Protocol and endpoint-state coverage vary by operating system and deployment; pre-OS and out-of-band paths remain separate.

Evidence boundary

Outbound transport is a Beam capability. This panel does not imply every protocol, platform, or powered-off state is accepted.

Before you start

Enrollment, tenant policy, authorized identity, endpoint reachability for the selected state, and configured Beam transport.

Evidence reviewed 2026-08-26

Reach products

Overview
Reach Managed — Setup needed
The endpoint and browser use outbound Beam transport while Reach applies the session policy, protocol, consent, and audit boundary.
1. Mechanism
  Policy before connection
  Identity and device scope are evaluated before the selected protocol is carried over the outbound-only transport path.
2. Current outcome
  Browser-tab managed access
  The evidenced path supports governed access to enrolled endpoints without opening an inbound endpoint port.
3. Evidence boundary
  Evidence boundary
  Outbound transport is a Beam capability. This panel does not imply every protocol, platform, or powered-off state is accepted.
Platform state
Protocol and endpoint-state coverage vary by operating system and deployment; pre-OS and out-of-band paths remain separate.
Before you start
Enrollment, tenant policy, authorized identity, endpoint reachability for the selected state, and configured Beam transport.
Reach Invite — Beta
A short code or reviewed invite path is designed to bind a technician to an attended, time-bounded session over the shared transport.
1. Mechanism
  Ephemeral session pairing
  The invite ceremony keeps managed enrollment paths off, establishes one session, and plans cleanup of the temporary runtime afterward.
2. Current outcome
  A bounded support handoff
  Implementation and isolation tests exist for the pairing path while public release remains tied to security sign-off.
3. Evidence boundary
  Evidence boundary
  The v1 sign-off records a no-go pending control work, so this panel offers no start-session or download action.
Platform state
The evidenced Windows code path is ahead of macOS and Linux scope; platform readiness must be reported independently.
Before you start
Accepted rate limiting and authentication controls, signed runtime distribution, a technician policy, and end-user consent.
MyDesk — Beta
The beta path serves a pruned view of live endpoint files and can proxy supported office editing through a loopback-only Collabora boundary.
1. Mechanism
  Secret-pruned served view
  A frozen exclusion policy removes secret paths and content before the browser-visible workspace is prepared; merge-back reapplies the same guard.
2. Current outcome
  Live owner file access
  Evidence covers the served-view planner, office-editing configuration, route decisions, and secret-prune round trip.
3. Evidence boundary
  Evidence boundary
  Own-device browse does not authorize peer access, and internal no-auth seams must never be exposed through Beam.
Platform state
MyDesk is beta; editor, endpoint, and owner-assignment parity remain deployment and platform specific.
Before you start
An enrolled live endpoint, owner assignment, supported file/editor path, secret filtering, and Beam connectivity.
Reach Data Center — Planned
The Data Center panel keeps infrastructure topology, protocol, identity, and audit requirements visible while packaging remains evidence-gated.
1. Mechanism
  Scoped infrastructure path
  A role and target boundary select an approved protocol and route; every handoff remains attributable to its Reach and Beam owner.
2. Current outcome
  A reviewable deployment shape
  Buyers can inspect the intended trust and topology model without receiving a false setup path.
3. Evidence boundary
  Evidence boundary
  This is a production-dark profile and exposes no provision, download, or session CTA.
Platform state
No Data Center profile is claimed released until its deployment package and acceptance matrix are approved.
Before you start
Accepted topology, identity integration, target protocol matrix, audit design, packaging, and operator runbook.
Reach Embed — Unavailable
The intended API and SDK surface preserves identity, policy, consent, and accountable session state inside a partner workflow.
1. Mechanism
  Bounded host integration
  A host application requests an allowlisted Reach action and receives explicit session state without taking ownership of transport or authorization.
2. Current outcome
  Context-preserving support UX
  The canonical contract is discoverable while unpublished packages remain non-actionable.
3. Evidence boundary
  Evidence boundary
  This panel does not expose an API key, token minting path, package install, or live embedded session.
Platform state
No language, browser, or native Embed package is claimed available without published distribution and compatibility evidence.
Before you start
Published SDK/API contract, delegated-auth model, consent ceremony, origin policy, signing, and integration guidance.
Reach mobile technician and admin app — Unavailable
The intended mobile experience keeps target, role, consent, and audit context visible when a technician or administrator moves from dashboard to device.
1. Mechanism
  Context-bound native handoff
  A signed deep link would reopen an approved workflow with bounded context rather than silently creating a session or entitlement.
2. Current outcome
  Accountable work on the move
  This panel explains the intended Reach-owned mobile job while native acceptance remains owned by the mobile programme.
3. Evidence boundary
  Evidence boundary
  The native path remains production-dark and provides no store badge, download, or start-session CTA.
Platform state
No iOS or Android store release, signed download, or supported device matrix is claimed by this page.
Before you start
Accepted signed builds, store or enterprise distribution, sign-in and deep-link tests, permissions review, and supported workflow evidence.