The PC is the authority
The unlock decision is made locally by the security engine, on the protected machine.
Trust centre
Architecture
The PC is the local authority. The website is never a control plane for the product.
Who decides what
The Companion asks
A paired phone supplies a Trusted Device proof. The PC verifies it and counts it as one family; phone biometrics do not create a second MFA family.
The website is not in the loop
The website, account, subscription, entitlement, and update server decide no unlock. The PC’s local Trust Engine retains that authority.
Network paths
- Local network first
- The native Companion can pair the phone and send commands directly over the LAN. PC protection and local authentication do not require Internet.
- HTTPS transport for the Web Companion
- The Web Companion uses an HTTPS tunnel that requires Internet. The relay supplies transport only; the PC retains trust and unlock authority.
- Reconnection
- A paired device can find the PC again after an interruption, with explicit connection states and a session resume using a fresh ephemeral key.