ARIVARAN REACH

Reach your laptop from any browser.

When a direct path is available, Arivaran Reach connects a supported browser directly to an enrolled laptop without putting a remote-desktop relay in the session data path. The control plane still performs discovery, authorization, policy, and connection setup; protocol support and endpoint prerequisites remain explicit.

Your laptop. Any supported browser. No session-data relay—when direct.

Setup neededManaged remote access

Open this product's main page Products

Reach Managed

Setup needed

The diagram shows the mechanism, its current result, and the limit that remains in force.

Step 1 of 3Policy before connection
Identity and device scope are evaluated before the selected protocol is carried over the outbound-only transport path.
Step 2 of 3Browser-tab managed access
The tested path gives controlled access to enrolled endpoints without opening an inbound port on the endpoint.
Step 3 of 3Limits
Outbound transport is a Beam capability. This does not mean every protocol, platform, or powered-off state is supported yet.

Mechanism

Identity and device scope are evaluated before the selected protocol is carried over the outbound-only transport path.

Platform state

Protocol and endpoint-state coverage vary by operating system and deployment; pre-OS and out-of-band paths remain separate.

Limits

Outbound transport is a Beam capability. This does not mean every protocol, platform, or powered-off state is supported yet.

Before you start

Enrollment, tenant policy, authorized identity, endpoint reachability for the selected state, and configured Beam transport.

Evidence reviewed 2026-08-26

Reach products

Overview
Reach Managed — Setup needed
The endpoint and browser use outbound Beam transport while Reach applies the session policy, protocol, consent, and audit boundary.
1. Mechanism
  Policy before connection
  Identity and device scope are evaluated before the selected protocol is carried over the outbound-only transport path.
2. Current outcome
  Browser-tab managed access
  The tested path gives controlled access to enrolled endpoints without opening an inbound port on the endpoint.
3. Limits
  Limits
  Outbound transport is a Beam capability. This does not mean every protocol, platform, or powered-off state is supported yet.
Platform state
Protocol and endpoint-state coverage vary by operating system and deployment; pre-OS and out-of-band paths remain separate.
Before you start
Enrollment, tenant policy, authorized identity, endpoint reachability for the selected state, and configured Beam transport.
Reach Invite — Beta
A short code or reviewed invite path is designed to bind a technician to an attended, time-bounded session over the shared transport.
1. Mechanism
  Ephemeral session pairing
  The invite flow keeps managed enrollment off, sets up one session, and is designed to clean up the temporary support app afterward.
2. Current outcome
  A bounded support handoff
  The pairing flow is built and tested internally; public release waits on a security sign-off.
3. Limits
  Limits
  The first release review said not yet, pending more security controls, so there is no start-session or download button here.
Platform state
Windows is further along than macOS and Linux; each platform's readiness is reported separately.
Before you start
Still needed: validated rate limiting and sign-in controls, a signed support app, a technician policy, and end-user consent.
MyDesk — Beta
The beta serves a filtered view of live endpoint files and can proxy supported office editing through Collabora running only on the local machine.
1. Mechanism
  Secrets removed before viewing
  A fixed exclusion policy removes secret files and content before the browser workspace is prepared, and the same check runs again when changes are merged back.
2. Current outcome
  Live owner file access
  Tests cover the file view, office editing setup, routing, and removing secrets on the way out and back.
3. Limits
  Limits
  Browsing your own device does not give access to anyone else's, and internal services without sign-in are never exposed through Beam.
Platform state
MyDesk is beta; editor, endpoint, and owner-assignment parity remain deployment and platform specific.
Before you start
An enrolled live endpoint, owner assignment, supported file/editor path, secret filtering, and Beam connectivity.
Reach Data Center — Planned
This shows the infrastructure topology, protocols, identity, and audit requirements, while packaging is still waiting on validation.
1. Mechanism
  Scoped infrastructure path
  A role and target select an approved protocol and route, and every handoff is attributed to Reach or Beam.
2. Current outcome
  A reviewable deployment shape
  You can review the intended trust and topology model, with no setup steps that would not work yet.
3. Limits
  Limits
  This profile is not released yet, so there is no provisioning, download, or session button.
Platform state
No Data Center profile is released until its deployment package and test matrix are approved.
Before you start
Still needed: an approved topology, identity integration, a supported protocol list, an audit design, packaging, and an operations runbook.
Reach Embed — Unavailable
The intended API and SDK surface preserves identity, policy, consent, and accountable session state inside a partner workflow.
1. Mechanism
  Bounded host integration
  A host application requests an allowlisted Reach action and receives explicit session state without taking ownership of transport or authorization.
2. Current outcome
  Context-preserving support UX
  The planned interface is visible, while unpublished packages have no install action.
3. Limits
  Limits
  This panel does not expose an API key, token minting path, package install, or live embedded session.
Platform state
No language, browser, or native Embed package is claimed available without published distribution and compatibility evidence.
Before you start
Still needed: a published SDK and API, a delegated sign-in model, a consent flow, origin rules, signing, and integration guidance.
Reach mobile technician and admin app — Unavailable
The intended mobile experience keeps target, role, consent, and audit context visible when a technician or administrator moves from dashboard to device.
1. Mechanism
  Context-bound native handoff
  A signed deep link would reopen an approved workflow with bounded context rather than silently creating a session or entitlement.
2. Current outcome
  Accountable work on the move
  This describes the planned Reach mobile workflow; the native apps are still being validated.
3. Limits
  Limits
  The native apps are not released yet, so there is no store badge, download, or start-session button.
Platform state
No iOS or Android store release, signed download, or supported device matrix is claimed by this page.
Before you start
Still needed: validated signed builds, store or enterprise distribution, sign-in and deep-link tests, a permissions review, and tested workflows.