Security levels explained
Who can command your machines, and how that is decided. First the three security levels your account can use - Low, Medium and High - and moving between them; then the Endpoint on each station and its modes; then who may add stations, the roles in an organization, and the controls you keep at each station.
Low, Medium and High Security
Every command your assistant sends a station is signed with a ControlKey, and the station checks that signature before it does anything. The three security levels differ in where that ControlKey is kept, and who signs with it:
- Convenient, easy, and works well
- The only way ChatGPT on the web can connect
- Not best practice: we hold your key
- File transfers: encrypted once (SSL)
- Your ControlKey is never sent to us - we can't lose what we don't have
- A solid 2FA all the way to your stations
- File transfers encrypted twice: first with SSL, then with your ControlKey.
- Everything Medium gives you
- Maximum entropy: no password involved
- File transfers encrypted twice: first with SSL, then with your ControlKey.
| Level | How it works | Why you would use it |
|---|---|---|
| Low Security | Our servers generate and keep your ControlKey. It's convenient, easy, and works well, but we don't recommend it as best practice. The only reason we offer it is because this is the only way ChatGPT would allow us to submit our offerings. As soon as you can, migrate to at least Medium security mode which provides separation of our servers from your security keys and enables a solid 2FA all the way to your stations. | To get started quickly, or to work from an AI app on the web. New accounts start here. |
| Medium Security (the SupportFlow Client's default) |
Medium Security mode moves the ControlKey generation and issuance to your local machine. Although your regular username is still used to sign in, a trust is established between your stations and your local SupportFlow Client with the ControlKey as the key element. When in Medium (or High) security mode, these ControlKeys are never communicated to our servers and thus we don't store them. Even if your account was breached or our servers hacked, we can't lose your ControlKeys because we don't have them. And your stations and Endpoints will not respond to anyone without those signing keys. We call that good security design. | Most people, and anyone who moves between PCs and would rather remember a password than carry a key file. |
| High Security (Full ControlKeys) |
High security mode operates the same way as Medium Security mode, with one difference: the ControlKey itself is generated by a cryptographically secure RNG for maximum entropy as opposed to a user-entered password (which could theoretically be guessed) used in the Medium Security mode. In both Medium and High, the commands you send and your stations' replies are sealed, so not even we can read them, and your file transfers are fully encrypted while in flight - twice, once by the SSL channel and a second time with your ControlKey - so not even we can see the data. | The strongest protection: for Administrators and Managers, and for anyone happy to keep a key file safe. |
We recommend Medium or High Security for everyday use: your ControlKey then stays with you, and only you can sign commands. Whichever level you use, every station checks each command itself (see The Endpoint and its modes).
Which level am I using? Security Mode in your account menu marks the one in force On, and choosing another one tells you what it means before anything changes. In the SupportFlow Client, Options (the gear) › ControlKey shows High Security or Medium Security along the top. Low Security is chosen for a whole organization, by its Administrator. Once an organization has left it, each person chooses Medium or High for their own ControlKey, in their own SupportFlow Client.
Changing your security mode
You can move up from Low Security whenever you are ready, and between Medium and High as your needs change. Every move gives your stations a new ControlKey, so it is worth a little planning - see Best practices below.
What each level lets you use:
| What you can use | Low | Medium | High |
|---|---|---|---|
| AI apps on the web, such as ChatGPT (Direct MCP access) | Yes | No | No |
| Approving new stations by asking your AI app | Yes | No | No |
| SupportFlow Lite in a web browser | Yesno ControlKey password | Yeswith your ControlKey password | No |
| The SupportFlow Client, with Claude Desktop, Claude Code or ChatGPT's desktop app (Codex) | Moves you upsetting it up moves you up | Yes | Yes |
| Your ControlKey is never sent to our servers | No | Yes | Yes |
| The same ControlKey on any PC, from your ControlKey password | No | Yes | No |
| A ControlKey generated on your PC by a cryptographically secure RNG | No | No | Yes |
| Commands and their answers sealed end to end (stations on Endpoint 1.0.243 or later) | No | No | Yes |
| File transfers encrypted twice: SSL, then your ControlKey (stations on Endpoint 1.0.243 or later) | No | Yes | Yes |
Why you would change
- From Low to Medium or High - so that your organization's ControlKey lives on your own PC rather than with SupportFlow, and only you can sign commands to your stations. This is the move we recommend once you have finished trying SupportFlow out.
- From Medium to High - for the strongest protection: your key is made at random rather than from a password, it stays on your PC, and your commands and their answers are sealed end to end.
- From High to Medium - if you work from many PCs and would rather type a password than approve each PC or carry a key file, or you want to use SupportFlow Lite, which works with Medium Security.
- Back to Low - possible only before your stations trust a ControlKey of your own (see Choosing Low Mode).
What each move means
| Move | Who, and where | What happens |
|---|---|---|
| Low → Medium or High | The organization's Administrator, in the SupportFlow Client, by setting up a ControlKey. It is for good: Low Security cannot be turned back on. | Your stations are given your new ControlKey. The key SupportFlow kept is withdrawn at once and deleted when every station has moved. Apps connected through SupportFlow, such as ChatGPT on the web, are disconnected. Your stations stay in your organization - there is nothing to reinstall. |
| Medium → High | Each person, for their own key: Options › ControlKey › Change ControlKey Mode in the SupportFlow Client. | A new key is made at random on your PC, and your current key puts it on each of your stations. Everyone you have authorized keeps their access. Back the new key up straight away, with Export… under Manage ControlKeys. SupportFlow Lite is not available in High Security. |
| High → Medium | The same place. | A new key is made from the ControlKey password you choose, and put on each of your stations the same way. That password is now your key on any PC, so make it long and keep a copy safe. Your commands and your stations' answers stay sealed end to end, as in High Security (SupportFlow Client 1.5.44 or later). |
| Medium or High → Low | The Administrator, from Security Mode in the account menu. | Only while no ControlKey is set up and none of your stations trusts one. Once your stations answer to your own ControlKey they stay that way. |
Switching from Low to Medium or High Security
Only the organization's Administrator can switch, and the switch is for good: Low Security Mode cannot be turned back on. Your stations stay in your organization throughout - there is nothing to reinstall. The switch is made in the SupportFlow Client, because that is where your ControlKey will live; Security Mode › High / Medium Mode in your account menu lists these steps and offers the Client's download.
- Install the SupportFlow Client on your PC and sign in. It offers to install its local MCP connection for your AI assistant - say yes.
- The first time you sign in, the Client welcomes you and offers the switch: choose Yes, switch to Medium Security Mode, then set up your ControlKey. Your stations are then given your new ControlKey, and the key SupportFlow kept for your organization is withdrawn at once - nothing can use it again - and deleted as soon as every station has moved (within 24 hours). If you choose No, stay in Low Security Mode, nothing changes and the Client disconnects, because it works in Medium and High Security only: in Low Security Mode, connect your AI app to our public MCP or use SupportFlow Lite. Press Connect in the Client again whenever you are ready to switch.
- If you chose a ControlKey password, open the Client's Options (the gear icon) and switch to High Security: your ControlKey becomes a random key that only your PC holds.
A station that stays switched off or offline for the whole 24 hours keeps waiting for the old key: somebody at that station uses Reset Authorization in its status window, and you authorize it again from the Client. If you set up your ControlKey in the Client before switching was offered there, the Client asks when you next sign in; Switch to Medium/High Security in the Direct MCP access panel does the same.
From the moment you switch, every app connected through SupportFlow is disconnected and everyone in the organization uses the SupportFlow Client. People you invite later follow the organization's mode.
Switching between Medium and High Security
In the SupportFlow Client, open Options (the gear) › ControlKey › Change ControlKey Mode, pick the other mode and choose Switch. The Client first tells you what will happen, with the number of your stations and of the keys you have authorized; choose Start and a progress window works through each step, ticking it off. Every key you have authorized - your other PCs' own keys, and the people you approved - is re-signed with your new key, so nobody needs to do anything and nobody loses access. Switching modes describes each step.
Choosing Low Mode
New accounts start in Low Security Mode. An account or organization in High / Medium Security can choose it from Security Mode › Low Mode in the account menu, and confirm - but only while no ControlKey is set up for it and none of its stations trusts one. Once your stations answer to your own ControlKey, they stay that way: SupportFlow never takes over stations that trust a key you keep. In an organization, only the Administrator can choose.
Best practices when you change
- Choose a time when your stations are online. Switching between Medium and High, keep the SupportFlow Client open and connected until its progress window says it is done; a station that is switched off is brought over when it comes back online, as long as the Client is running then. Leaving Low Security, each station needs to come online within 24 hours to be moved.
- Back up the new key. Moving to High Security, export it (Manage ControlKeys › Export…) with a passphrase, to somewhere other than your PC. Moving to Medium Security, keep a copy of your new ControlKey password somewhere safe - we have no way to recover it. Administrators and Managers should also create a Recovery Key (see Backing up your ControlKey).
- Tell the people it affects. If you are a User, your new key reaches your stations through your Administrator's or a Manager's SupportFlow Client, so ask one of them to be connected. Any other PC of yours that used the same key shows Your ControlKey was changed on another PC at its next sign-in: choose Set up this PC there.
- Installers named with your organization's code (
setupEndpoint_...) ask our server for the current keys when they install, so they need nothing. An older installer named with your organization's name may still name the old key - download a fresh one before you install more stations. - If a switch between Medium and High is interrupted, nothing is lost. Open Change ControlKey Mode again and choose Continue the switch to carry on where it left off.
- Check the result. Ask your assistant “What trust mode is each of my stations in?” - each should be Enforcing - and ask it to list your organization's ControlKeys. Revoke any you do not recognise, such as a key from a PC you no longer use.
The Endpoint and its modes
The Endpoint is the program that runs on each of your stations. Whichever security level you use, it checks every command itself, and carries one out only when it is signed by a key the station trusts, addressed to that station, and fresh. Its mode says where it stands. Ask your assistant “What trust mode is each of my stations in?” to see them all. At the station, the Trust line of the Endpoint's status window (its icon by the clock, then Show Status) says the same, in the words shown in italics below.
| Mode | What it means | What to do |
|---|---|---|
| Onboarding Awaiting authorization | Newly installed. It trusts no key yet, and accepts only being authorized. | Accept it in the SupportFlow Client: Options › ControlKey › Pending Station Authorizations. |
| Enforcing 1 authorized key, 2 authorized keys… | The normal state. It carries out a command only when the command is signed by a key it trusts, addressed to it, and fresh. | Nothing - this is where every station should be. |
| Locked Reset - locked until… | Somebody at the station used Reset Authorization and chose the 48-hour lockout. It refuses everything, including a new authorization, until the lockout ends. | Wait, or have somebody at the station choose End lockout. |
| Corrupt Keystore corrupt - reset needed | Its list of trusted keys was damaged, so it trusts nothing rather than guessing. | Somebody at the station uses Reset Authorization; then accept it again. |
| Disabled DISABLED - no remote commands | Somebody at the station chose Cancel and Disable Endpoint when a rekey was requested. It keeps reporting in, but refuses every remote command. | Somebody at the station re-enables it: the Endpoint's icon by the clock, then Re-enable Endpoint. |
The same window shows the station's own Station key, which is what you compare when the Client asks you to accept a station. A station whose Endpoint is too old to know about ControlKey shows no mode; update its Endpoint.
Which new stations may join
On your account page, each organization (and your own estate) has a setting for new stations:
- Allow any - anybody holding your installer can add a station (it still has to be authorized before it obeys anything).
- Allow with code - the installer asks for an Installation Code and refuses without the right one.
- Deny all (Closed) - no new stations can join.
Authorizing a station
A new station obeys nobody until your organization's Administrator or a Manager accepts it in the SupportFlow Client. While one is waiting, the Client shows a popup by its icon near the clock - Approve, Decline or Defer 30 mins - and clicking the icon opens Pending Station Authorizations, where every waiting station is listed with its Status: a green check once accepted, a red cross when denied. If the station is slow to answer the first time, the Client tries once more by itself. The Client will not let you accept a station whose clock is more than 15 minutes out - signed commands are time-stamped, so a station with a wrong clock would refuse them anyway. Fix its clock first.
Roles in an organization
| Role | Can do |
|---|---|
| Administrator | Owns the organization - there is exactly one. Everything a Manager can do, plus the plan and handing the organization over (the old Administrator becomes a Manager). |
| Manager | Invites people, looks after stations, and approves or revokes Users' keys - from the SupportFlow Client, where each approval is signed with the Manager's own ControlKey. |
| User | Works on the organization's stations. |
Removing somebody from the organization - or their leaving it - withdraws their keys at the same time.
Watching a screen from the portal
A station's live screen, clicks, typing and File Transfer in a viewer need your SupportFlow Client, open and signed in on the same computer. The Client authorizes the viewer for a few minutes at a time and renews that by itself while you are signed in - file transfers included, with nothing extra to answer; when you sign out or close it, the viewer stops.
The first time a viewer asks, your Client can ask you. In the Client's My Organization tab, Portal miniviewer requests sets what happens:
- Ask (the default) - you are asked, per station; a yes lasts 30 minutes.
- Always Allow - allowed without asking, but you still see a notice every time, so nobody watches unseen. Its Deny button ends that viewer at once if it is not you.
- Always Deny - refused.
Signing out of the Client ends every authorization it gave.
Reset Authorization, at the station
If a station ever trusts a key it should not - or you are simply not sure - somebody standing at it can clear its list of trusted keys. Open the Endpoint's status window (its icon by the clock, then Show Status) and choose Reset Authorization. Optionally choose the 48-hour lockout, which refuses even a new authorization until it ends. Then accept the station again from the SupportFlow Client.
A rekey requested remotely
A station's trusted keys can also be cleared from afar - a rekey - for example when an administrator has lost their keys. The station never does this straight away. It waits five days, and the whole time its icon by the clock flashes between orange and blue. Clicking the icon opens a window that asks the person at the station to check with their system administrator that the rekey really was requested, and then to choose:
- Rekey Now - accept it at once. The station forgets its keys and waits to be authorized again from the SupportFlow Client.
- Cancel and Disable Endpoint - refuse it. The station keeps its keys and keeps reporting in, shown as Disabled, but accepts no remote command of any kind - not even another rekey - until somebody at the station chooses Re-enable Endpoint in its status window.
If nobody answers, the rekey is carried out when the five days are up.
Working in Low Security Mode
An account or organization in Low Security Mode lets SupportFlow keep its ControlKey and sign commands to its stations for it. That is what lets an AI app that runs on the web, such as ChatGPT, work with your stations: you sign in to SupportFlow from the app, and SupportFlow signs each command the app sends. Your stations still check every command's signature, exactly as they always do.
In Low Security Mode, anyone who signs in as you can control your stations, so use a strong password that you use nowhere else. SupportFlow Lite also works without a ControlKey password in this mode: you still allow each command that changes a station, in the chat. When you are ready to keep your ControlKey yourself, see Switching from Low to Medium or High Security.
NOTICE: We DO NOT recommend operating with the default plug-in installation that ChatGPT provides as it lacks the robust security protections offered with the full SupportFlow Client installations. We recommend removing the ChatGPT SupportFlow Plugin (from the Marketplace) and installing the SupportFlow Client from the website and signing in. It will prompt you to install its local MCP automatically. Once completed, you can then go into its Options (the gear icon) and switch to High Security mode which ensures only your local workstation can command stations.
In Low Security Mode the Direct MCP access panel - on the SupportFlow Client and other ways to access stations page, reached from your account page's Download button - shows the address to add as a connector in ChatGPT. Accounts in Medium or High Security cannot connect this way - the panel says so - and use the SupportFlow Client instead.
Approving new stations
In Low Security Mode your organization's Administrator and Managers choose, in the Direct MCP access panel, whether to Approve each new station (on by default):
- On - a newly installed station waits until it is approved. Ask your AI app: “Approve the new station LOBBY-01” or “Deny the new station LOBBY-01”.
- Off - stations installed with your organization's own Endpoint installer are accepted by themselves.
Connected apps
Every app you connect is listed in the Direct MCP access panel under Connected apps, with Disconnect beside it. We email you each time a new app is connected. If you see a connection you do not recognise, disconnect it and change your password.
If SupportFlow renews or withdraws your key
To keep your stations safe, KQS support can renew the ControlKey it keeps for you, or withdraw it at once. Your stations follow a renewal by themselves while they are online. Either way, your Administrator is emailed, everyone in the organization is told when they next sign in, and your account page lists any station that needs you, with the steps to bring it back - usually Reset Authorization at the station, then approving the station again. After a renewal, replace any older Endpoint installer named with your organization's name; one named with its code needs nothing. Support can also pause commands to your stations for a while: reading their status still works, and your account page says so.
Renewing the ControlKey yourself
Your organization's Administrator can renew the ControlKey SupportFlow keeps, at any time - do it if you think the old one may have been exposed. On your account page choose Download, and in the Direct MCP access panel choose Renew ControlKey (in SupportFlow Lite, Account › Renew ControlKey opens the same page). A new key is made, and every online station moves to it by itself; a station that is switched off moves when it is back online. The panel shows how far it has got. Once every station has moved - or after 24 hours, whichever comes first - the old key is destroyed, and everyone is told in the same way as above, including about any station that still needs you. An installer named with your organization's code needs nothing; an older one named with its name carries the old key, so download a fresh one.
Your account
- Portal sign-ins last 8 hours.
- Six wrong passwords in 15 minutes from one address lock that address out for 15 minutes.
- Keep your recovery phrase somewhere safe - it is the way back in if you lose your password.
- In Low Security Mode your password is what protects your stations, so choose a strong one you use nowhere else.