# Remote access security
> Understand environment authority, one-time pairing, device credentials, account linking, and revocation.
Canonical URL: https://docs.zuse.sh/remote/security
Zuse's remote clients control an environment; they do not become the environment. Repositories, agent processes, terminals, provider CLIs, and their credentials remain on the computer running the desktop app or Zuse Serve.
## Local access [#local-access]
* Local browser and phone access is off until you enable it in **Settings → Devices**.
* Enabling or disabling it restarts the desktop app. Running agents stop during that restart.
* Pairing links are single-use and expire after five minutes.
* A redeemed browser or phone receives its own revocable credential.
* Nearby phone pairing checks the advertised encrypted transport identity and asks you to match a safety phrase on both devices.
Do not paste a pairing link into an untrusted chat or open it on a shared browser. Treat a live link like a temporary password.
## Hosted access [#hosted-access]
* Hosted access is optional and account-scoped.
* The environment registers to an account and advertises reachability; it remains the execution and data authority.
* A browser or phone must authenticate to the same account before it can list or connect to linked computers.
* Environment and client versions must be compatible.
* Turning off remote access or running `zuse serve logout` revokes the environment's account registration.
## Provider credentials [#provider-credentials]
Remote clients do not receive copies of provider credentials. Agent commands execute where the provider CLI is installed and authenticated. The model provider and any tools invoked by the agent still have their own network and data policies.
## Device lifecycle [#device-lifecycle]
Review the connected-device list in **Settings → Devices** periodically. Each identified browser or mobile device shows a label and last-connected time. Revoke devices you no longer use or recognize. Use **Revoke all** for older credentials that cannot be identified individually.
On iPhone, **Clear downloaded data** removes cached projects, chats, and messages but keeps connections and unsent messages. **Reset app** additionally removes account state, connections, device keys, cache, and unsent messages from that phone. Neither action revokes the phone at the environment; do that from the Mac as well.
Approval prompts are security decisions. Read the requested operation and choose the narrowest option that permits the intended task. A remote connection does not weaken the agent's normal permission model.
## If a device may be compromised [#if-a-device-may-be-compromised]
1. Revoke it from **Settings → Devices** on every environment it could access.
2. Turn off local or hosted access while you review linked devices.
3. Sign out the affected mobile or browser session.
4. Rotate provider, repository, and service credentials if the device may have observed them through an active session.