Remote Access Away From Home

A paired phone keeps working when you leave the house. Nexus bridges the phone and the PC through a relay, then upgrades to a direct peer-to-peer connection whenever it can - and in both cases the session is end-to-end encrypted, so nothing in between can read your traffic.

End-to-end encryption

Encryption keys are derived on your two devices from the pairing, and they never leave those devices. Every frame the phone and PC exchange is sealed on one end and opened on the other; anything in the middle carries only ciphertext. The same encryption also protects the session on your local network, with no relay involved at all.

The relay forwards bytes it cannot read

When the phone cannot reach the PC directly, both sides connect to a Nexus relay. The relay does exactly one thing: it matches the two connections and copies encrypted frames between them. It holds no keys, never decrypts, and never stores your data - what it can observe is limited to connection metadata (addresses and byte counts), which any forwarding node must see to do its job.

Going direct: the peer-to-peer upgrade

Relaying every byte through a data center adds latency, so once a relayed session is up, Nexus tries in the background to open a direct connection between the phone and the PC, punching through your home routers. The negotiation itself travels inside the already-encrypted relay tunnel, and the direct channel carries the same end-to-end encryption. Once the direct path is confirmed, the relay connection is closed; if the direct path ever drops, the session falls back to the relay automatically. Most remote sessions end up as a direct, encrypted, device-to-device link.

The controls

Both switches live in the Pair remote dialog under Connection options:

• Cloud relay - "Lets paired phones connect over the internet when they can’t reach this PC on the local network."
• Allow remote control - the killswitch. Turning it off disconnects every connected remote control panel immediately and blocks reconnection on every path, including over the relay. Paired devices stay in your list and can resume when you turn it back on.

Browser-based sessions are deliberately shorter-lived than app sessions; see iOS & Android Apps. For the full technical walkthrough - key derivation, the relay design, and NAT punch-through - read How Nexus Secures Your PC.