---
title: "Clipboard and file transfer"
description: "Copy text, images, and files between your computer and an endpoint during a remote session, end-to-end encrypted, with directions and limits set by policy."
url: "https://support.outpostplatform.com/remote-access/clipboard-and-file-transfer/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Clipboard sync (Sync clipboard turns it off), Type clipboard, and file and folder transfer in a remote desktop session, end-to-end encrypted with a six-digit Secure transfer code. Policy: clipboard_text, clipboard_images, and file_transfer directions, size caps, audit detail for names, sizes, and hashes, e2e_require_verification. Framework floors and the reasons the viewer shows."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux", "macos"]
  permission: "remote:initiate"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/remote-access/clipboard-and-file-transfer.md"
license: "CC BY 4.0"
---

# Clipboard and file transfer

During a remote desktop session you can sync the clipboard with the endpoint,
type your clipboard as keystrokes, send files and folders to the endpoint, and
copy them back. Everything you transfer is encrypted end to end between your
browser and the endpoint, and every transfer is audited. This page shows how
to use each one and how policy shapes them.

## How it works

Transfers travel inside the session, on channels of their own beside the video.
Before anything moves, your browser and the endpoint agree a set of keys that
your Outpost cannot work out, and the endpoint signs the exchange with an
identity key that never leaves it. From then on your Outpost relays only
ciphertext. Keys exist in memory for the session only, and a change of signed-in
user at the endpoint starts a fresh exchange. The cryptography is P-256, SHA-256,
HKDF, and AES-256-GCM, all FIPS-approved algorithms.

Your browser remembers each endpoint's identity key the first time it connects.
If the key is different next time, for example after the agent is reinstalled,
the viewer stops transfers until you confirm the code with the person at the
endpoint. The memory is per browser, so a different browser or a private window
counts as a first connection.

The screen video and ordinary keystrokes are not end-to-end encrypted. See the
[security model](/remote-access/#security-model).

## Before you begin

- The endpoint's agent must support transfers. If it does not, the viewer says
  **Update the agent to use clipboard and file transfer**.
- Sending anything to the endpoint needs **Control** on. With **Control**
  off, the viewer says **View only. Turn on Control to send to the endpoint**.
- Clipboard sync works on Windows, macOS, and Linux X11 sessions. On Wayland,
  a text console, or the sign-in screen, the viewer says **Clipboard sync is
  not available for this session type**. **Type clipboard** still works there.
- On the sign-in screen, before anyone has signed in, only **Type clipboard**
  works. Files need a signed-in user.
- Policy decides which directions are allowed. See
  [Directions and limits](#directions-and-limits).

## Check the secure transfer code

Select **File transfers** in the viewer's toolbar to open the **Transfers**
panel. The top of the panel shows the
**Secure transfer code**, six digits, and the Outpost tray app at the endpoint
shows the same code. If the two match, nothing sits between you and the
endpoint.

The endpoint does not pop the code up. The person at the endpoint finds it in
the tray app's card and, on Windows, in the tooltip of the Outpost icon in the
notification area. Ask them to open the tray app and read it to you.

Under the code, the panel says one of these:

| Message | Meaning |
| --- | --- |
| **First session with this endpoint, key pinned.** | Your browser had not seen this endpoint and has remembered its key. |
| **Endpoint key matches your last session.** | The key is the one your browser remembered. |
| **Code confirmed.** | You, or policy, confirmed the code. |
| **The secure transfer key for** the endpoint **changed since your last session.** | Transfers are stopped. Ask the person at the endpoint to open the tray app and read you the code. If it matches, select **Confirm code matches**. |
| **Policy requires you to confirm this code matches the one on the endpoint screen.** | `remote_access.e2e_require_verification` is on. Confirm the code with the person at the endpoint, and select **Confirm code matches**. You are asked again at every change of signed-in user. |

**Setting up a secure channel...** means the exchange has not finished yet.
Transfers wait for it.

## Copy and paste text and images

With **Control** on, press <kbd>Ctrl</kbd>+<kbd>V</kbd> (or
<kbd>Shift</kbd>+<kbd>Insert</kbd>) in the viewer. The viewer sends your
clipboard to the endpoint first, then the keystroke, so the endpoint pastes
what you copied. Selecting the viewer window also sends your clipboard.

When someone copies text or an image on the endpoint, it arrives on your
clipboard while the viewer window has focus, or the next time you select it.

The clipboard button in the toolbar shows the state when you point at it,
and at the top of its menu:

| State | Meaning |
| --- | --- |
| **Clipboard sync on** | Clipboard sync is working. |
| **Clipboard connecting** | The secure channel is being set up. |
| **Clipboard waiting for focus** | The endpoint copied something. Select the viewer window to receive it. |
| **Clipboard sync off** | You turned off **Sync clipboard**. |
| **Clipboard off** | Policy, the session type, or the agent version rules out clipboard sync. |

Your browser asks for permission to read the clipboard the first time. Allow
it. A clipboard larger than 64 MB is not sent.

The **Clipboard** tab of the **Transfers** panel lists text, images, and files
in each direction with **On** or the reason they are blocked.

### Turn clipboard sync off

To keep what you copy on your own computer, and what is copied on the
endpoint on the endpoint, open the clipboard menu in the toolbar and turn off
**Sync clipboard**. The button is struck through while sync is off, and the
**Clipboard** tab of the **Transfers** panel shows **Clipboard sync is off**.
Select **Sync clipboard** again to turn it back on. Anything copied while sync
was off is not sent afterwards.

Turning sync off affects only the clipboard. **Type clipboard** and file
transfers keep working. The choice applies to this viewer window and stays
across reconnects.

## Type the clipboard

**Type clipboard**, in the clipboard menu in the toolbar, types the text on your clipboard into the endpoint as
keystrokes, up to 4,096 characters. Use it where a paste does not work: the
sign-in screen, a password field that refuses paste, or a session with no
clipboard sync. It counts as text sent to the endpoint, so it follows
`remote_access.clipboard_text`.

## Send files and folders to the endpoint

1. Drag files or folders from your computer onto the endpoint's screen in the
   viewer. Alternatively, open **Transfers** > **Queue**, and select
   **Upload** or **Upload folder**.
2. Wait for the transfer to finish in the queue. The files land in a transfer
   folder on the endpoint and on the endpoint's clipboard.
3. On the endpoint, paste them where they belong with
   <kbd>Ctrl</kbd>+<kbd>V</kbd>, or <kbd>Cmd</kbd>+<kbd>V</kbd> on a Mac.

:::caution
The transfer folder is deleted when the session ends. Paste or move the files
out of it before you disconnect.
:::

To put files straight into a folder of your choice, open **Transfers** >
**Files**, browse to the folder, and select **Upload here**. Files written this
way stay after the session ends.

On Windows, files you send are marked as downloaded from the internet, so
Windows treats them as it would a browser download.

## Copy files from the endpoint

- **From the endpoint's clipboard.** Copy files on the endpoint. The **Queue**
  tab shows **Remote clipboard has** the number of items, with **Download**.
- **From any folder.** Open **Transfers** > **Files**, browse to the folder,
  select the files, and select **Download selected**. On a Mac, shortcuts to
  **Home**, **Desktop**, **Documents**, and **Downloads** are listed.

Your browser asks where to save. Choose or create a folder: browsers do not let
a page save straight into your **Downloads** or **Desktop** folder itself.
Browsers that cannot save into a folder receive a single zip file instead.

Each transfer in the **Queue** shows its progress, and **Cancel** stops it.
Transfers yield to the video and input, so a large copy does not freeze the
session on a slow link.

Files on the endpoint are read and written as the signed-in user, so a
transfer cannot reach a file that user cannot open. On a Mac, macOS can ask the
user to allow access to protected folders. The transfer stops until they select
**Allow**. See [macOS agent](/agent/macos/).

## Verify a file against the audit log

By default, the audit log records each file's hash as a keyed hash that only
the endpoint can reproduce. To check whether a file on your computer is the one
that was transferred:

1. Open **Transfers** > **Verify**, and select **Verify a file**.
2. Choose the file. Your browser computes its SHA-256, and the endpoint returns
   the keyed hash.
3. Compare **Audit hash** with the hash in the audit entry.

A keyed hash cannot be checked once the endpoint's key is lost, for example
after the agent is reinstalled. Where a permanent match matters, set the hash
settings to `plain`.

## Directions and limits {#directions-and-limits}

Each kind of transfer has its own setting, and each setting lists the allowed
directions: `to_endpoint` (technician to endpoint) and `to_technician` (endpoint
to technician). An empty list turns that kind off. A direction is allowed only
where every applicable profile allows it.

| Setting | Controls | Default |
| --- | --- | --- |
| `remote_access.clipboard_text` | Plain and rich text in the clipboard, and **Type clipboard** | Both directions |
| `remote_access.clipboard_images` | Images in the clipboard | Both directions |
| `remote_access.file_transfer` | Files and folders by drop, paste, upload, or download, and the **Files** browser | Both directions |
| `remote_access.file_transfer_max_file_mb` | Largest single file, in MiB | `0`, no limit |
| `remote_access.file_transfer_max_session_mb` | Total file data in one session, both directions together, in MiB | `0`, no limit |

Browsing folders on the endpoint shows their contents, so the **Files** tab
needs `to_technician`. Uploading into a browsed folder needs both directions.

Framework baselines set floors on these settings:

| Framework | Clipboard text and images | Files |
| --- | --- | --- |
| CJIS | Off | Off |
| PCI DSS, ISO 27001 | To the endpoint only | To the endpoint only |
| HIPAA, SOC 2, NIST 800-53, NIST 800-171, CMMC Level 2 | No floor | To the endpoint only |
| DISA STIG, Microsoft security baseline | Recommends to the endpoint only | Recommends to the endpoint only |

A setting a baseline locked is shown in the viewer as, for example,
**Locked by PCI DSS baseline**. See
[Compliance framework baselines](/compliance/framework-baselines/).

## What is audited

Every clipboard sync, file transfer, folder listing, refusal, and code
confirmation is recorded in the audit log against the session and the
technician. See [Audit logs](/depot/audit-log/).

- Clipboard events record the direction, the formats, and the total size,
  never the content or a hash of it.
- File transfers record the direction, the outcome, the number of files, the
  total size, and, for each file, its name, size, and hash as policy allows.

Six settings decide how much each file event reveals, separately for each
direction:

| Settings | Choices, most revealing first | Default |
| --- | --- | --- |
| `remote_access.audit_file_names_to_endpoint`, `remote_access.audit_file_names_to_technician` | `full_path`, `file_name`, `path_hash`, `name_hash` | `full_path` |
| `remote_access.audit_file_sizes_to_endpoint`, `remote_access.audit_file_sizes_to_technician` | `exact`, `summary` (rounded, such as 2.1 MB) | `exact` |
| `remote_access.audit_file_hash_to_endpoint`, `remote_access.audit_file_hash_to_technician` | `plain` (SHA-256), `keyed`, `none` | `keyed` |

When profiles disagree, the least revealing choice wins. Keyed hashes use a key
that never leaves the endpoint.

The tray app at the endpoint also lists each transfer of the session, newest
first with its time, such as "Technician copied text from this PC". The list
appears only in the tray app's card: the endpoint shows no pop-up or
notification for a transfer, in any session mode. See
[Consent prompts and session notices](/tray/consent-and-notifications/).

## If something goes wrong

The viewer gives a reason wherever a transfer is unavailable or fails:

| Reason | Cause | Fix |
| --- | --- | --- |
| **Blocked by profile:** and a direction | A profile does not allow that direction. | Change `remote_access.clipboard_text`, `clipboard_images`, or `file_transfer` in the profile. |
| **Locked by** a framework **baseline** | A framework floor forbids it. | Not changeable while the framework applies to the endpoint. |
| **Over the transfer size limit** | A file, or the session total, is over the limit policy sets. | Send less, or raise the limit. |
| **Confirm the secure transfer code first** | Policy requires the code check, or the endpoint's key changed. | Confirm the code with the person at the endpoint. |
| **Not available on the sign-in screen** | Nobody is signed in at the endpoint. | Use **Type clipboard**, or sign in first. |
| **The session is paused because no input reached it for a while.** | The session paused for technician inactivity. | Turn on **Control** and select the screen to resume. |
| **The Windows user changed** | The signed-in user changed during the transfer. | Start the transfer again. |
| **The endpoint user cannot open this** | The signed-in user has no access to that file or folder. | Use a location the user can open. |

## Next steps

- [Remote access policy settings](/remote-access/policy-settings/)
- [Troubleshoot remote access](/remote-access/troubleshooting/)