What is SupportFlow and KnowledgeFlow
SupportFlow lets you and your AI assistant look after your computers, kiosks and screens from wherever you are - ask a question in plain words, and the answer comes from the machine itself.
What SupportFlow is
SupportFlow is remote support built for working with an AI assistant. You install a small program - the Endpoint - on each machine you look after. You install the SupportFlow Client on your own PC. The Client connects your AI assistant (Claude, or ChatGPT's desktop app) to your machines, so you can ask things like:
The assistant does the work - reading the machine's status, taking a screenshot, running a command, moving a file - and tells you what it found. You stay in charge: every change a station makes is signed on your PC (see ControlKey).
The parts, and what each one does
| Part | Where it runs | What it does |
|---|---|---|
| Endpoint | Each machine you look after | Reports how the machine is doing (health, disk, the applications you care about, a recent screenshot) and carries out the commands you send it - but only commands signed by a key it trusts. |
| SupportFlow Client | Your own Windows PC | Signs you in, connects your AI assistant to your stations, and holds your ControlKey - the key that signs every command. It also asks you before a new station is trusted, or before someone watches a screen from the portal. |
| Your AI assistant | On your PC | Claude Desktop, Claude Code or ChatGPT's desktop app. It talks to your stations through the Client. |
| The portal | This web site | Your account, your organization and its members, your plan, the installers, and a view of each station's screen. |
Plans. My Plan shows every plan on offer in one row. When there are more than fit, scroll it sideways or use the arrows at its ends. If we stop offering a plan you are on, it is marked Retired and stays yours, with everything it includes and its renewals, until you cancel it or switch to another plan. After that it cannot be chosen again.
KnowledgeFlow
KnowledgeFlow uses the same reliable, secured infrastructure as SupportFlow, but it is a version of the product focused on your organization's knowledge. Where SupportFlow is designed to support the workstations and the people who use them, KnowledgeFlow is designed to learn all it can about your organization, and then help you with that information.
That is why KnowledgeFlow includes additional tools, special MCPs and special utilities built to bring together information from hundreds of commercially available data systems and programs - database programs, accounting programs, design programs, raw documents, spreadsheets, Word documents and more - from across your entire organization, with no preparation work beforehand.
Shared notes: what your organization knows about its machines
Every site has its own details - where the kiosk application keeps its settings, which folder holds the logs, which service has to be restarted after an update. Your organization keeps them in a shared notebook that your AI assistant reads before it touches a file, and adds to when it works something out.
- Ask for “the configs” or “the logs” and the assistant looks up where they are for your machines, instead of guessing a path.
- When it finds something new - “on these kiosks the log is in D:\App\Logs” - it writes it down, so the next person (or the next conversation) does not have to find it again.
- It is private to your organization. Other customers never see it, and you never see theirs. There is also a common section of general notes from us that everybody can read.
- You can simply ask: “What do we know about where the kiosk logs are?” or “Remember that the price file on the STORE machines is C:\Kiosk\prices.xml.”
Organizations and private stations
Stations belong either to an organization - shared with everybody in it - or to you alone (a private estate, for your own machines). An organization has one Administrator (its owner), any number of Managers, and Users; see Security levels for what each can do. Every organization has a short organization code - five letters and digits - so you can tell two organizations with similar names apart when you join one. It is not a password; it is safe to read out over the phone.
Your organization's icon. The Administrator can give the organization an icon - its logo, say. On the account page, click the square to the left of the organization's name (or the icon itself, to change it) and choose a PNG or JPEG picture of up to 1 MB. Remove icon takes it away. Everyone in the organization sees it beside the organization's name, on the account page and in SupportFlow Lite. It is shown in a circle and made smaller automatically, however large the picture - so a square picture works best: one that is not square is cropped to its centre.
Groups for your stations
Groups sort your stations the way you think of them - by site, by floor, by customer. They are only for keeping the list tidy: a group changes nothing about who can reach a station. Anyone in the organization can make a group and file stations in it, and everyone in the organization sees the same groups.
- On your account page: right-click a station and choose Create Group…, or Assign to Group to file it in a group you already have. Right-click a group's name to rename or delete it; deleting a group keeps its stations, which go back to the top of the list.
- In SupportFlow Lite: right-click a station and choose Add to group: New Group… makes a group and files the station in it, the groups listed below it file the station there, and Remove from group takes it out again.
- In the SupportFlow Client: in the SupportFlow Stations window (below), right-click a station and choose Create group…, or Move to group and a group — or Remove from group.
A station is in one group at a time. The account page and SupportFlow Lite show a change straight away, and the Stations window the next time it refreshes.
The SupportFlow Stations window. Click the SupportFlow Client's icon beside the clock: while the Client is signed in, the SupportFlow Stations window opens (when nobody is signed in yet — just installed, say — the sign-in window opens instead). Show Stations on the icon's menu opens it too. It lists your stations as your account page does: your organization, under its name, and My Private Stations, each with its groups in alphabetical order, and every station marked online or offline.
- Finding a station: type all or part of its name in the box above the list, and only the stations whose name has those letters are shown. The box clears itself a minute after you last typed in it, or at once with its × or Esc.
- Right-click a station for Remote in… (its screen, for a station that is online and authorized — see below), Share access…, Edit tag…, Rename…, Create group…, Move to group, Decommission… and Properties. Each is offered only to whoever may use it, by the same rules as your account page, and Decommission… asks first — for a station another organization also has, it offers Detach instead (see below).
- Remote in… (Client 1.5.46) opens the station's screen in the viewer you chose in Options › My Organization › Viewer Type: the Native Viewer, where it starts, or the MiniViewer (Webbased) — the Support Viewer, in your browser. The Native Viewer needs Medium or High Security mode and a ControlKey on this PC; where it cannot be used, Remote in… opens the MiniViewer instead.
- The Native Viewer (called the Sealed Viewer before Client 1.5.46) shows the station's screen in a window
of the Client's own. On a station that supports it, everything you type there is encrypted for that station alone: nothing in
between, our server included, can read it — use it when you type a password at the station, such as at its Windows sign-in
screen. On other stations your typing is encrypted on each link of the way, as in the MiniViewer, and the padlock window says so:
avoid typing passwords there. Click on the picture to click on the station — a double click, a drag and the mouse wheel work
as they do there; just pointing at something moves the station's pointer too, so menus that open when you point at them, and
tooltips, appear (KQS Endpoint 1.0.259 or later). Close the window when you are done, which ends its link.
- Moving a window (KQS Endpoint 1.0.259 or later): drag it by its title bar as usual. An outline of the window follows your pointer straight away, and the window itself moves once, when you let go — nothing is redrawn on the way, so it is quick even over a slow connection. Press Esc before letting go to leave it where it was.
- More than one monitor (KQS Endpoint 1.0.259 or later): beside Actions, a monitor button shows the number of the monitor you are looking at — 1 is the station's main monitor. With two monitors, click it to see the other; with more, it lists each one with its size, so you can pick. Your clicks, drags and the mouse wheel land on the monitor shown. A station with one monitor has no such button.
- The padlock (Client 1.5.45): a green padlock beside Connected means the window is connected and authorized. Click it to see what protects each part of the connection — a diagram of this PC, our servers and the station, what travels between them and how it is encrypted — along with the station's key fingerprint, which you can compare with the one in the station's own Endpoint window. What an action did, or why it could not, shows on the bar beside it for a few seconds; click it to hide it sooner.
- Actions, at the far left of the bar, has what the Support Viewer's menu has: File Transfer…, Paste to remote, Copy from remote, Quality, View Size, Task Manager, Ctrl+Alt+Del (for a station that supports it), Reboot… and Disconnect. Files and clipboard text are sealed end to end: only this PC and the station can read them.
- File Transfer… (Client 1.5.46) opens a window with My Computer on the left and the
station on the right. Select files on one side and press the arrow between them that points to the other side: →
sends them to the folder open on the station, ← fetches them into the folder open on My Computer. You can drag
files from one side to the other, and drop files on the station's side from Explorer. Double-click a folder to open it, or
Up to go to the folder above. My Computer starts on your Desktop the first time, and after that where you left it for
that station.
- The box above each side's list is a drop-down. It starts with My Computer (the drives), Desktop, My Documents and Downloads, then your Favorites. The star beside the box adds the folder open there to Favorites, or takes it out — so does the last line of the drop-down. My Computer's Favorites are the same whichever station you open; each station keeps its own. You can still type a path into the box and press Enter.
- On the station's side, its Desktop, My Documents and Downloads are those of the person signed in at the station. That side offers them, and its drives, on KQS Endpoint 1.0.259 or later; on an older one it offers C:\ and your Favorites.
- Rename… (Client 1.5.41) gives a station a new name: letters, digits,
-and_, 3 to 100 characters. It is offered to your organization's Administrator and Managers (and to you for your own stations), while the station is online — the station renames itself. Its history, notes and screenshots move with it. - Double-click a station to open it at once — the same as Remote in…. When it cannot be opened (it is offline, or not authorized yet), the window says why.
- Tags: a station's tag — a short note you keep about it — follows its name in light grey, cut to fit the window. Edit tag… changes it; leave it empty to remove it.
- Properties opens a window of the station's own: its latest screenshot on the left and, on the right, its details — its system, processor, memory, mainboard, disks, display, network and the rest of what it reports. Under Network, Round trip to each of our servers says how long a request to it takes from the station, in milliseconds — measured by the station once a minute; (reports here) marks the server it sends to (KQS Endpoint 1.0.256 or later). A station shared with you starts with a Sharing section: Shared from names who shared it with you, and Shared permission says whether the share is Limited or Unrestricted (see Sharing stations). Below them you can change its tag and description and add a note. Nothing is saved until you press Save changes (or Add note).
- Who reads tags, descriptions and notes: they are shared, not private. Everyone in your organization who can reach the station sees them, and so do the AI assistants your organization connects, and KQS support. If the station is shared with another organization, that organization sees them too — Edit tag and Properties say so, in amber. Never put a password or anything else sensitive in them.
- Connected or not: the panel under the list shows a green dot while the Client is connected, a red one while it is not, and an amber one while it connects. Connect / Disconnect is the first item on the File menu; Sign out disconnects and opens the sign-in window.
- Also on the File menu: Hide offline leaves out stations that are offline; Show screenshot previews shows a station's latest screenshot, small, when you rest the pointer on it for a second (the Client remembers this choice); and Shared Stations… lists the stations your organization has shared. (About has moved to the Help menu.)
- Your profile (Client 1.5.42): the File menu shows the address you are signed in with, just above Sign out. Click it for the Profile window: your account's status (and anything that needs your attention, such as an expired service plan), your role, your organization, how many stations you can reach and how many of them are online now, your service plan and when the account was made. It only shows these and changes nothing; signing out closes it.
Closing the window only hides it: the Client keeps running.
Stations that share a name
Two of your machines can have the same station name - two buildings, each with its own LOBBY-01. Both are kept, and until you rename one they are told apart by a number: LOBBY-01 (1) and LOBBY-01 (2), numbered by which reported first. The numbers are the same on your account page, in SupportFlow Lite, in the Command Center and to your AI assistant, so you can ask for one by its number (“Restart LOBBY-01 (2)”). The plain name means the one that is responding; if both are, the assistant asks which you mean.
- By group: once a station is filed in a group, you can also call it by the group and its name - North/LOBBY-01.
- To end the numbering, rename one of them (Rename… in its right-click menu). Each machine keeps its own history, notes and screenshots.
- Only your own machines are listed. A machine of another organization that uses the same name is theirs, and is never shown to you or reachable by you.
- A new machine under a name you already use that was not installed with your organization's installer waits until your organization's Administrator or a Manager adds it: in SupportFlow Lite, right-click the station and choose Same-named stations…, then Add to this organization or Leave out. Add only a machine you recognize.
- An old entry left behind - a machine reinstalled, say - can be removed by the Administrator or a Manager in the same window: an entry that has been silent for an hour or more while another of its name is responding. Type its GUID to confirm; what it recorded goes to the one that is responding.
Use the SupportFlow Client 1.5.27 or later with stations that share a name: an earlier Client is told to update rather than sending a command to the wrong machine.
Removing a station: Decommission or Detach
When a station is no longer needed, your organization's Administrator or a Manager - or you, for your own stations - removes it: Delete / Decommission… in its right-click menu on your account page, or Decommission… in SupportFlow Lite or in the SupportFlow Client's Stations window (see Groups for your stations, above). Once you confirm, the station is told to remove its Endpoint, and it is deleted from SupportFlow when it has done so, which happens the next time it reports. Nobody can reach it from then on. To bring it back, install the Endpoint on it again. Your AI assistant does not decommission stations: ask it, and it tells you where to do it and whether you may.
Only that machine. Decommissioning removes the one machine you chose. Another of your machines with the same name, and a station of that name in another organization, keep everything — their place in the list, their group, their history and their notes (see Stations that share a name, above).
A station another organization also has. Decommissioning such a station would remove it for that organization too, so you are asked first, and offered Detach instead:
- Detach takes the station off your list only. Your organization stops seeing and reaching it; the other organization keeps it as it is. When it can sign for you - in SupportFlow Lite, or in Low Security Mode - Detach also takes your organization's ControlKeys off the station.
- Decommission for everyone removes the Endpoint, for every organization that has the station.
Sharing a station with another account
Your organization's Administrator or a Manager can let the people of another SupportFlow account work on one of your stations - a supplier, a contractor, a partner's help desk - without moving the station or giving them anything else of yours. Only a station that belongs to an organization can be shared.
- In your SupportFlow Client, open Devices, right-click the station and choose Share access…. Type the email address of their SupportFlow account, pick the kind of share from the drop-down - Limited Share (the default) or Unrestricted Share; the sentence under it says what that kind allows, and Sharing stations, below, explains the difference - and choose Share…. The station must be switched on, authorized, and running Endpoint 1.0.247 or later (1.0.252 or later for an unrestricted share).
- The Client shows the ControlKey fingerprints of the account you are sharing with. Say yes, and your Client signs the offer with your ControlKey and hands it to the station.
- The station shows up in their SupportFlow Client as a station waiting for approval (in SupportFlow Lite, with Accept). Once they approve it, they can run commands on it. The offer can be used once, and lasts 24 hours.
Your account page's right-click menu has Share access… too. In Medium or High Security mode it points you to the Client, because the offer is signed by your ControlKey, which never leaves your PC. In Low Security mode the account page shares the station itself: its Share access… asks for the address and has the same drop-down.
Either way, the station stays your organization's: your plan, your bill and your list are unchanged, they do not see your other stations, and your organization can still decommission it - its confirmation says when another account has unrestricted access. A limited share they have approved can be made unrestricted later: in the Client's list, right-click their account and choose Make unrestricted… (the same red confirmation). An unrestricted share is never turned back into a limited one.
Who has access. On your account page a shared station carries a Shared with N others badge: point at it to see who, or click it for the list, with Stop sharing beside each account. In the Client, Share access… on a shared station lists the accounts it is shared with.
Revoking access. In the Client's list, right-click an account and choose Revoke access… (on the account page, Stop sharing). It takes the station off their list at once, and your SupportFlow Client takes their key off the station - straight away, or as soon as the station is back if it is switched off. They can also remove a station shared with them themselves: Remove shared station… in its right-click menu, or Revoke access… on their own account in the Client's list - which first warns them that they are removing their own access, because only your organization can share it with them again.
An unrestricted share that has been approved cannot be revoked: in the Client its Revoke access… is greyed, and says why. The account it was shared with can give it up from the SupportFlow Client on the PC that holds their key - Share access…, then Revoke access… on their own account - which takes their key, and every key that came in through their share, off the station. In Low Security mode their account page can do it for them.
Good practice. Share only with people you know, and only for as long as they need it. If you can, compare the fingerprints with them by phone before you say yes. Look at the badges from time to time, and stop sharing when the work is done. Choose Unrestricted only for an account you would trust with the station as if it were their own - for a contractor or a help desk, Limited is enough.
Sharing stations
Every Share access… - in the SupportFlow Client, on your account page and in SupportFlow Lite - asks you to pick one of two kinds of share from a drop-down: Limited Share, which is chosen unless you change it, or Unrestricted Share. The sentence under the drop-down says what the kind you picked allows. The difference matters, because one can be taken back at any time and the other cannot.
What a Limited Share lets them do. The account you share with can run commands on that one station, as an operator. They cannot rename it, decommission it, share it with anybody else, or change which ControlKeys it trusts - and you can revoke their access whenever you like.
What an Unrestricted Share lets them do. Everything, on that one station: run commands, rename it, decommission it (for everyone), and share it with others in their turn, limited or unrestricted. They can also take it over: take your organization's own ControlKeys off the station, so that your organization can no longer command it or reach it through them. Once they have approved it, nobody can revoke it remotely - not you, not anybody in your organization, and not KQS support. For them, the station's right-click menu - in SupportFlow Lite and in the Client's Stations window - offers Rename, Decommission (for everyone, after a warning), Share access… and Give up my access….
| Limited Share | Unrestricted Share | |
|---|---|---|
| Run commands on the station | Yes | Yes |
| Rename it | No | Yes |
| Decommission it (for everyone) | No | Yes |
| Share it with others in their turn | No | Yes - limited or unrestricted |
| Take ControlKeys off it - your organization's included, leaving you out | No | Yes |
| You can revoke it | Yes, at any time | No - not remotely, by anybody |
| How it is undone | Revoke access… (or Stop sharing), or they remove it themselves | They give it up themselves; otherwise only Reset Authorization at the station itself |
| Before they approve it | You can withdraw the offer | You can withdraw the offer |
| Whose station it is | Your organization's - your plan, your bill, your list | Still your organization's on paper - but they can lock you out of it |
| Endpoint needed on the station | 1.0.247 or later | 1.0.252 or later (1.0.253 for taking it over) |
Why you might choose a Limited Share. For somebody who helps you with the station but should not own it: a technician looking into a fault, a vendor supporting their software on it, a colleague from a partner's help desk, temporary help while you are away. They get what they need to do the work, and you can take it back the moment the work is done - or at any time, for any reason.
Why you might choose an Unrestricted Share. For somebody who must be able to run the station on their own, without you: another business you are handing the station to, the buyer of a machine you have sold, a managed-service provider who will look after it from now on. Treat it as permanent - it is a hand-over, not a loan. They can lock you out of the station, and you cannot undo that from here.
How to undo each.
- A Limited Share: in the SupportFlow Client, Share access… on the station (or File > Shared Stations… in the Stations window), right-click their account and choose Revoke access…; on your account page, Stop sharing. The station leaves their list at once and their key comes off it.
- An Unrestricted Share: it cannot be revoked remotely. They can give it up themselves (Give up my access…), or somebody at the station itself can use Reset Authorization, which clears every ControlKey on it - after that the station is authorized again from scratch. Decommissioning the station also ends every share of it.
Taking a station over. If a station was shared with you without restrictions, Share access… on it in the SupportFlow Client also lists Keys on this station: every ControlKey it trusts, whose each is, and any offer still waiting on it. Right-click a key and choose Take off this station… - or Select all of the organization's keys first, to take them off together. A red confirmation says what it means before anything is signed. In SupportFlow Lite, the station's right-click menu has Keys on this station…, which does the same: tick the keys, or Select the organization's keys, then Take off…. An unrestricted share's key, yours or anybody else's, can never be taken off this way.
Before you choose Unrestricted. Give an Unrestricted Share only to somebody you would hand the machine's keys to - in person, for good. Check the address you type twice; the Client and the account page ask you to type it again. When the red confirmation shows their ControlKey fingerprint, compare it with them by phone or face to face before you say yes: it is how you know the key is really theirs. If somebody only needs to help for a while, a Limited Share is the right choice.
Your plan's speed
Each plan sets how fast each person may send to our servers and receive from them - through the SupportFlow Client, SupportFlow Lite and the MCP door together. It applies to each person on their own: everyone in your organization gets the full figure, however many of you are working at once. The free plan allows 512 KB/s each way. Large files take longer at a lower figure; a higher plan allows more. Your organization's Administrator's plan sets the figure for everyone in it.
Your plan's station limit
Each plan allows a number of stations: My Service Plan on your account page shows how many you have and how many your plan allows.
An organization can hold up to 50 stations more than its plan allows, but the extra ones are Inaccessible:
- They are the stations that joined last. Your account page lists them under Inaccessible, with a note, and your AI assistant sees their names and whether they are online - but no AI tool, viewer or file transfer can reach them.
- Increase your plan on My Service Plan, or retire stations you no longer need, and the oldest Inaccessible stations become accessible again by themselves. Nothing needs to be reinstalled.
- Once an organization holds 50 stations more than its plan allows, no more can be added until there is room.
The same applies to your own stations, against your own plan.