Deck connects straight to Pier.
Today the operator's network must provide the route. If Deck cannot reach Pier, no direct session forms.
Defence and engineering
Engineers work remotely. The operating boundary does not move.
Reach Linux, Windows, or Mac GPU workstations from macOS Deck while identity, trust, session policy and traffic remain in systems you operate.
The operating problem
Remote access fails the requirement when it adds an outside dependency.
A vendor identity service, connection broker, licence check, or certificate authority outside the operating boundary creates a system the operator must continuously reach and trust.
Your workstation account stays authoritative.
Linux Piers authenticate through PAM. Windows Piers use the operating-system credential path.
Pier and Deck are free software.
The source is published under AGPL-3.0.
Connection paths
Direct is current. Span is undecided.
Direct is the current one-to-one path over an operator LAN or VPN. Span is not part of the current product; whether it will be offered or what capabilities it might include has not been decided.
Trust before credentials
Use your PKI—or verify first contact yourself.
Pier supports an operator-provided certificate or a Pier-generated self-signed certificate. Both paths resolve trust before the workstation receives credentials.
Operator certificate
Trust follows your chain.
Deck validates the complete chain against trust anchors you control. A broken, expired, or untrusted chain ends the connection with no override.
Pier-generated certificate
Trust starts with a fingerprint.
Deck shows the SHA-256 fingerprint on first contact. Verify it out of band before acceptance; later change is a hard refusal.
Host-authoritative policy
The gates sit at the workstation.
Pier defines the permitted session channels. The connecting user cannot widen clipboard, audio, or microphone policy from Deck.
Permit the required flow.
Allow both directions, one direction, or disable clipboard completely.
Limit type and size.
Permit text, PNG images, or both within a host-defined transfer limit.
Open or close the egress channel.
Workstation audio is controlled independently in Pier configuration.
Control upstream audio separately.
Deck microphone input is independently configured. The packaged default is disabled.
These settings govern the corresponding Arcen channels. They do not prevent photography, endpoint capture, manual transcription, or modification through permitted keyboard, mouse, and pen input.
Operational ownership
Know what remains yours to operate.
Arcen removes runtime dependence on an Arcen service. It does not remove the operator's responsibility for identity, trust, network reachability, approved software, and deployment procedure.
Control how software enters the environment.
Assess installers, signing, update transport, rollback, and target-native validation against your process.
Keep existing lifecycle authority.
Workstation accounts and operator trust anchors remain the systems of record.
Use the software under AGPL-3.0.
Pier and Deck are free, open-source software in the public repository.
Operate the installed path locally.
Direct sessions and OS authentication do not require an Arcen-operated service or internet access.
Operational evidence
Ask to see the real control surfaces.
These frames remain reserved until genuine product captures can show the evaluator exactly what is installed, configured, and refused.
Evidence required
Connection state and diagnostics
Evidence required
Operating-system authentication
Evidence required
Pier policy configuration
Evidence required
Pier installation and version
Generated interfaces are never used as product proof.
Known limits
Controls are useful only when their boundary is explicit.
Does disabling clipboard create a view-only session?
No. View-only requires host-enforced suppression of keyboard, mouse, and pen input. Arcen does not currently make that claim.
Do channel controls prevent every form of extraction?
No. They control the corresponding Arcen channels; they cannot prevent photography, endpoint capture, or manual transcription.
Does Arcen claim certification for a classified environment?
No. Arcen makes no claim of certification, regulatory approval, compliance, or suitability for a specific classified environment.
Deployment status
macOS Deck with Linux and Windows Pier is the current platform path; macOS Pier is a preview. Span is under consideration and is not part of the current product. Operators must assess network architecture, endpoints, release signing, update procedures, and platform validation against their requirements.
Technical evidence
Inspect the connection and trust model.
Review the one-file installers, certificate paths, authentication, session policy and architecture.
Open the technical page