How Dex keeps your company safe

Dex can change things on every computer in your office, so it is built to be trusted with that. This is how.

Every fix comes from a fixed list of approved actions. Windows on each PC enforces that list itself, so even a Dex server that was broken into could not run anything else there.
On a Mac, the Dex agent runs only Dex's own approved scripts, checks every value again before running one, and never runs a command it is sent.
The account Dex uses on Windows PCs is not an administrator.
Nothing runs without a person's approval, except the lowest-risk fixes if you allow them.
Administrator rights for installing a program always need your approval, last 15 minutes, and are taken away by themselves. Dex then checks that they really are gone.
The AI never runs commands. It can only suggest fixes from the approved list, and a person still approves them.

A laptop or Mac away from the office connects to your Dex through Dex Cloud. The connection is encrypted end to end between the computer and your office's Dex: Dex Cloud passes it on, but cannot read it, change it or send the computer anything.
Nothing on the computer accepts incoming connections; it always connects out.
Each computer proves who it is with its own key, made when it is set up, which never leaves it. No password is sent.

Requests, devices, history and the audit log are stored on the Dex PC in your office.
Your office opens no inbound ports: Dex connects out to Dex Cloud for your phone and your licence.
Saved passwords are encrypted by Windows and cannot be read on another computer.
AI diagnosis can be switched off, and then no request text ever leaves the office. When it is on, long details are shortened and your company name is not sent; with your own Anthropic key, requests go from your office straight to Anthropic.

When a computer is set up, it checks that it is talking to your real Dex server: the server's key is built into the setup you download, so an impostor on the network cannot take its place.
The Dex panel uses HTTPS, and you can require it for every PC.
After 5 wrong passwords, that address is locked out for 15 minutes.
Dex runs as a restricted Windows account, not as an administrator. If a PC cannot run it that way, setup says so and uses the standard system account.
The password of the Dex account on every Windows PC changes every 30 days. The PC makes the new one itself, so it never travels in readable form and never appears in a log.
Updates are installed by a separate Windows task that checks each one itself, and only ever installs a genuine Dex release.
Every release is checked automatically against attacks, among them malformed and forged requests, replayed or altered messages and fake servers.

Dex backs up its data every night and before every update. A second copy can go to another disk or your NAS.
Every action, approval, sign-in and update is written to the audit log.

Try Dex in your office this week

Free for 7 days on up to 15 PCs. No card, no sign-up.