


Any modern browser is a full client. Nothing to install on the machine you happen to be at.
Clu Chat with room to steer long-running work.
Read the output, approve the next step, stop a runaway job.
A native window for the machine you sit at every day.
- A VPN.
- A remote desktop.
- SSH in a browser tab.
Your own machines, reachable.Unreadable to us.
Look closer.

Real sessions,
anywhere.
Sessions live on your machine and survive every disconnect. Pick up right where you left off.

Browse and
edit your files.
A real editor with live markdown. Your files stay on your device, never on our servers.

Talk to
your devices.
Ask Clu to run things across your machines. It acts where the work actually lives.

Your agents,
rendered.
The surface your agents draw on, and where you build apps of your own. Hosted on your machines, not ours.

Everywhere.
All at once.
Every app on every machine, together on one screen you reach from anywhere.
We can’t read your data.
- 01Straight acrossthe default
Your browser and your machine hold the session open between themselves over WebRTC. Nothing of ours is in the path, so there is nothing for us to carry and nothing for us to keep.
- 02One hop through TURNstrict networks
Some networks will not open a path between two machines at all. A TURN server forwards the packets and reads none of them, and you can point Clu at one you run yourself instead of ours.
- 03Our relaystart, and fallback
Every session opens here while a direct path is negotiated behind the working terminal, and stays here if one never comes up. We forward bytes we hold no key for.
The route can change in the middle of a session. The key does not. The same AES-256-GCM stream under the same session key travels all three, so moving between them changes the road and never the lock, and you keep typing through it.
Sealed against reading and tampering
The same AEAD cipher that secures TLS 1.3 and is cleared to protect classified data. A 256-bit key puts brute force beyond reach, and GCM’s authentication tag means any tampered packet is rejected outright, never decrypted.
A fresh key for every session
Your devices derive a shared secret across the open internet without ever sending it, using the same elliptic-curve exchange Signal and TLS 1.3 rely on. A fresh ephemeral key each session gives forward secrecy: a leaked key can’t unlock past or future traffic.
We hold no key to your data
Encryption and decryption happen only on your own hardware. The relay forwards ciphertext it holds no key for, so neither a breach of our infrastructure nor a subpoena can turn your data into plaintext.
Claim your machines.
Sign up
30-day free trial
No credit card required to start.
Install
curl -fsSL cluterm.com/install | sh
One binary, zero dependencies.
Pair
echo A7X92M | cluterm pair
Key generated locally, on-device.
Connect
open dashboard → pick device
You’re in. From anywhere.
Watch the four steps play out first simulated, about 45 seconds, no account
Five dollars.
Five dollars a month, flat, for the encrypted fabric that connects your machines. Your Claude, Codex, or API usage stays billed by your provider, never marked up by us.
Start free trialTeams & organizations
SSO, audit logs, centralized billing, and dedicated support for many devices at once, priced to your team.
Common questions.
How is this different from SSH, Tailscale, or Gitpod? +
What can I actually do with Clu? +
Is my data secure? +
What about latency? +
How many machines can I add? +
What devices are supported? +
Your machines.
Everywhere you are.
Install the agent, pair your device, connect in under a minute.