Back to Portfolio
DevOps & Infrastructure
● Live in productionThinClient OS + Fleet Manager
Locked-down Debian RDP appliance with a cloud fleet manager
Visit Live SiteZero-desktop hardened OS
Reproducible BIOS+UEFI ISO
Self-healing auto-reconnect
Fleet manager + device agent
Overview
A production-grade Linux appliance that boots straight into a full-screen Windows RDP session — no desktop, no shell, no login prompt — backed by a self-healing watchdog and an infinite reconnect loop. It ships as a reproducible BIOS+UEFI ISO and pairs with a Next.js cloud manager to provision, monitor and remotely control the device fleet.
Managing desktops shouldn’t cost this much time and money.
Hardware you keep replacing.
Every few years the PCs slow down and get replaced, even though the actual work happens in a browser or a line-of-business app. You’re buying hardware to run an operating system, not to do the job.
You can’t see what’s happening.
A machine goes down in a branch office and you find out when someone phones. There’s no record of what happened, no way to check the network, and no way to help without travelling or talking someone through it.
Data sits on machines you don’t control.
Files saved to desktops. Local logins. USB sticks. Every endpoint is a place data can leak from, and every one needs patching, antivirus and someone to look after it.
The desktop is the problem. Move it to the cloud, lock the endpoint down to a single job, and manage the whole fleet from one place.
Why it matters
The outcomes that actually move the needle
Cut hardware spend.
Any PC from the last decade works — a 10-year-old desktop boots the same session as a new one, because the actual computing happens on AWS. Machines stop being a refresh cycle and become a screen and a keyboard.
Nothing to steal from the endpoint.
No local desktop, no local files, no local user account. If a machine is stolen, the thief gets a locked screen — the data never left AWS.
Cut your AWS bill for the hours nobody is working.
Start and stop the Windows servers on EC2 straight from the dashboard. A clinic running 12 hours a day doesn’t pay for the other 12.
See and fix problems without travelling.
Watch a live view of any screen, check the real measured connection speed, chat with the person using it, lock it, restart it, or pull a full diagnostic bundle — from your phone if necessary.
A record of what actually happened.
Optional session recording (screen, webcam and microphone in a single stream) stored in your own encrypted S3 bucket, with automatic retention so it deletes itself on schedule.
Set up in minutes, updates itself forever.
Write the ISO to a USB stick, boot, enter one enrolment key. After that, cryptographically signed updates roll out to the fleet on their own — staged, with automatic rollback on failure.
Product Demo
Watch the demo
Key Capabilities
What we designed, built and shipped
Boots into fullscreen Windows RDP — zero desktop, fully locked down
Self-healing watchdog + reconnect-forever loop
Reproducible BIOS+UEFI ISO build (cross-platform via Docker)
Cloud fleet manager: provisioning, monitoring & remote commands
Technology Stack
Every choice made for a reason — not just what's trendy
| Layer | Technology | Why |
|---|---|---|
| Device OS | Debian 13 (live-build ISO), Openbox | Stable, minimal, reproducible images |
| RDP client | FreeRDP 3 (xfreerdp3) | H.264/AVC444 acceleration, mature protocol support |
| Device agent | Python daemon, GTK3 (PyGObject) | Small footprint, no desktop environment required |
| Capture | FFmpeg with VA-API hardware encoding | GPU encode keeps old CPUs usable |
| Streaming | HLS (segmented H.264/AAC) | Plays in any browser, resumable, cache-friendly |
| Control plane | Next.js, React, TypeScript | Server components, one deployable app |
| Data | PostgreSQL via Prisma | Relational integrity for multi-tenant billing |
| Storage | AWS S3 (per tenant) | Durable, encrypted, lifecycle-managed |
| Compute | AWS EC2 | Windows workloads, started/stopped on demand |
| Delivery | Docker Compose, PWA + service worker | Reproducible deploys, installable dashboard |
| Security | AES-256-GCM, bcrypt, RSA-signed updates, TOTP, WebAuthn | Defence in depth |
Architecture
How data actually moves
The endpoint holds nothing. Every path below is a real connection the system makes today.
The endpoint holds no data. It streams a Windows session from EC2, reports to the control plane every five seconds, and pushes recordings straight into the customer's own encrypted S3 bucket. The storage bucket is never public — the dashboard proxies playback through short-lived signed URLs.
See it in action
The real dashboard
Captured from the live console. Device and customer names have been redacted for privacy.
How it works
From USB stick to managed fleet
1
Flash & boot
Write the ISO to a USB stick and boot any PC. No Windows licence, no imaging server.
2
Enrol once
Enter the customer’s enrolment key. The device registers itself, gets a unique identity, and appears in the dashboard.
3
Connect
It boots straight into the Windows session on EC2 using credentials pushed from the server. The user never sees or types them.
4
Operate
Staff work normally. You watch status, quality and activity; step in with live view, chat, lock or restart if needed.
5
Maintain
Signed updates roll out on their own, in stages. Recordings age out automatically under the retention policy you set.
Deployment
Deploy it your way
Fully managed (recommended).
We run the control plane; you run your Windows workloads on your own AWS account. Fastest to start, nothing to maintain.
Self-hosted control plane.
The dashboard ships as a Docker Compose stack with a bundled PostgreSQL. Runs on any Linux host or your own EC2 instance — useful where data residency rules require it.
Bring your own storage.
Point each customer at their own S3 bucket. Recordings never touch our infrastructure. Any S3-compatible provider works (AWS S3, MinIO, Wasabi, Backblaze B2, DigitalOcean Spaces).
Integrations
- AWS EC2 — power Windows instances on and off from the dashboard; the RDP target updates itself when the address changes
- AWS S3 — per-tenant recording and live-view storage with lifecycle retention
- Any RDP host — AWS EC2, Azure, on-premise Windows Server, or a physical PC
- Microsoft Authenticator and any RFC-6238 TOTP app
- WebAuthn / passkeys — platform biometrics on macOS, Windows, iOS and Android
- Admin API — token-authenticated REST endpoints for automation and scripted provisioning
See it running on your own hardware.
We'll walk you through a live fleet, then help you boot your first machine from a USB stick on a call. No commitment, no sales script.
Complete feature guide
Everything the platform does
ThinClient OS turns any standard PC into a secure, single-purpose workstation that boots straight into your Windows desktop — paired with a full web + mobile dashboard to run, monitor, support, and record every machine from one place. Here is everything the platform does.
On each machine
The ThinClient operating system
Installs on any standard PC and turns it into a secure, single-purpose workstation. Staff never touch the underlying system — it simply switches on and works.
Startup & session
- Boot straight to work. Powers on to a branded start-up screen, then a secure lock screen — no Windows desktop, no clutter, nothing to configure.
- Secure lock screen first. The screen password is required before anything connects, so a machine left on is never open to a passer-by.
- Automatic connection. After unlocking, the machine connects to your Windows desktop by itself — the user is working within seconds.
- Single-purpose kiosk. Locked to its job: users cannot exit to a desktop, install software, or change system settings.
- Automatic session recovery. If a session ends unexpectedly it returns to the connect screen and reconnects — never stuck on a dead screen.
Connecting to Windows
- Centrally managed connection. Windows server address, username, and password are set from the dashboard — not typed at the device.
- The password stays hidden. Delivered securely and never shown on the machine. Staff can connect but can never see, copy, or share it.
- Per-machine or account-wide. One default connection for all machines, or a specific connection per machine.
- One-time manual override. An operator can enter a different connection for a single session; it reverts on the next restart.
- Local fallback. If the dashboard is unreachable, a securely-saved local connection keeps work from being blocked.
- Video quality control. Remote display mode can be tuned centrally (automatic, high-quality, or compatibility) to keep tricky setups smooth.
Networking & internet quality
- Wired or Wi-Fi. Works over a network cable or Wi-Fi, and knows which it is using (cable, Wi-Fi, or mobile/tethered).
- Prefers the cable. Waits for the more reliable wired connection first when a cable is plugged in before offering Wi-Fi.
- Simple Wi-Fi picker. An on-screen list to choose a network and enter the password, with USB-adapter stability built in.
- Live internet speed test. Measures real download speed on a schedule and on demand from the dashboard — even during a live call.
- Live latency & packet-loss check. Continuously watches the link to your Windows server — the early warning for lag or freezes.
- On-screen quality badge. A movable, colour-coded badge (green / amber / red) floats over the session showing live speed and link quality.
On-screen controls & display
- Volume & brightness. Simple on-screen sliders for volume and (on supported screens) brightness.
- Correct local time. Clock and time zone are set for you, per machine or account-wide, so the on-screen time is always right.
- Clean, branded look. A polished start-up/branding screen and a distraction-free interface.
Security & lockdown
- Screen lock with password. Locks the session instantly when the user steps away, and is required after boot.
- Remote password updates. A new screen-lock password can be pushed from the dashboard.
- Tamper-proof. No unapproved software, no system settings, no breaking out of the workstation.
- Hardened remote access. Behind-the-scenes remote support access is locked down and safe by default.
- Dial-out only. The machine reaches out to the dashboard — nothing inbound to open, so it works behind any normal firewall.
Monitoring & recording
- Live screen & camera streaming. Stream a machine’s screen — and camera, if attached — to the dashboard in real time.
- Session recording. Record screen, camera, and microphone combined into one video saved to secure cloud storage.
- Continues across screen locks. Recording keeps going through screen locks so nothing is missed.
- Transparent recording notice. A non-blocking on-screen badge names what is being captured (or runs silently where policy allows).
- Choose what’s captured. Screen, camera, and microphone can each be turned on or off.
On-device support chat
- Always-available chat bubble. A floating chat button in the corner — visible on the desktop and over the full-screen remote session.
- Unread badge. A red badge appears when an administrator sends a new message.
- Share screenshots both ways. Send a screenshot of exactly what you see, and view screenshots the administrator sends back.
- Emoji & quick reactions. An emoji picker plus one-tap reactions, flowing in near real time.
Reliability & self-healing
- Frozen-session recovery. Detects a frozen session and restarts the connection automatically — no power-cycling, no lost server-side work.
- Smart reconnection. Ordinary network hiccups are ridden out and the session reconnects on its own.
- Freeze-proof audio pipeline. A purpose-built remote-desktop engine removes a known cause of call-related freezes.
- Stability hardening. Real-time audio priority, a memory safety cushion, a hardware watchdog, and persistent logs keep long calls stable.
Automatic over-the-air updates
- Updates arrive over the internet. New features and fixes install themselves — no IT visit, no manual work.
- Safe & verified. Every update is cryptographically signed, so only genuine updates are ever applied.
- Staged, non-disruptive rollout. Rolled out gradually; the operator is gently prompted and can defer before it applies.
- Always reports its version. So you can see exactly what each machine is running.
Setup & provisioning
- Simple enrolment. A new machine joins with a one-time code, then gets its own unique, secure identity.
- First-boot setup. Handles the initial configuration automatically.
- Install to disk. So the machine runs the operating system permanently.
Management dashboard
The web + mobile application
One place to see, control, support, and record everything — from your computer or your phone.
Access anywhere — web + mobile
- Full web application. Open the dashboard in any modern browser, on any computer — nothing to install.
- Installable mobile app (PWA). One-tap install on phone or tablet for an app-like experience — manage your fleet on the go.
- Responsive, light & dark. Looks great on desktop, tablet, and phone, with light and dark themes.
- Comfortable navigation. A collapsible side menu; account details, theme switch, and sign-out sit neatly together.
Users & access control
- Logins for your team. Give each team member their own account.
- Access levels. Full administrator, or view-only / limited access — you decide.
- Add or remove people any time. You stay in control of who can get in.
- Account settings. Each user manages their own profile and password.
Device fleet management
- All machines in one list. See every machine at a glance, in consistent order.
- Search & filter. Find machines by name and filter by status (online / offline) or group.
- Device detail pages. Everything about a single machine in one place.
- Enrolment & organise. Add machines with secure codes, then rename and organise to match your setup.
- Key rotation. Administrators can re-secure a machine’s identity if ever needed.
Live monitoring
- Online / offline at a glance. Updated live, with a “last seen” time for every machine.
- Internet quality per machine. Live speed and connection type (cable / Wi-Fi / mobile) with a clear colour signal.
- On-demand speed test. Trigger a real speed test on any machine — even mid-call — and watch the result appear.
Live view & session recording
- Watch live. View any machine’s screen — and camera — in real time, in split view or full-screen.
- Auto-stop when offline. If a machine drops off, monitoring stops cleanly and won’t silently restart.
- Recording & playback. Recorded sessions are stored securely and can be played back from the dashboard.
Activity & productivity tracking
- Working hours & connections. How long each machine was actually in use, and how many times a session was started.
- Screen locks & idle time. How often and how long the machine was locked, plus periods with no activity.
- Offline time. When the machine wasn’t reachable.
- Day-by-day, per machine. Spot patterns and see where time goes.
Remote control & actions
- Lock, restart, shut down. Lock or unlock the screen, and restart or shut down a machine remotely.
- End session & force update. Give the user a clean start, or push a machine to the latest version now.
- Speed test & diagnostics. Run a speed test or collect a full diagnostics bundle on demand.
- Offline-safe & confirmed. Actions queue for offline machines and run on reconnect; disruptive ones ask for confirmation.
Windows connection management
- Set the connection centrally. Configure server address, username, and password per machine — or one default for all.
- Password stays hidden. Stored encrypted and never displayed back — not in the dashboard, not on the device.
- Display/quality control. Tune the remote display mode per machine to keep difficult setups smooth.
Support chat from the dashboard
- Message any machine. Chat directly with the person at any machine, with per-machine conversations and full history.
- Screenshots both ways. Receive screenshots from users and send screenshots back, with emoji reactions.
- Unread badges & local time. Never miss a reply; messages show in the machine’s local time with friendly labels.
- Clear a conversation. When it’s no longer needed. Messages flow within seconds.
Secure storage & retention
- Your own secure cloud storage. Recordings and shared screenshots live in private cloud storage configured for your account.
- Recording retention. Recordings auto-delete after a period you choose (for example, 30 days).
- Chat retention. Support-chat messages and screenshots auto-delete after a period you choose, up to 7 days.
- Recording notice control. Show the on-screen recording badge, or run silently where a monitoring policy applies.
Audit log
- Every important action recorded. Who did what, and when.
- Covers key events. Locks, restarts, setting changes, and recordings.
- Reviewable any time. A clear, trustworthy trail for accountability and compliance.
Update management
- See each machine’s version. At a glance, with an “update available” indicator when a newer version is ready.
- Force-update on demand. Push a specific machine to the latest version now.
- Staged rollout control. So updates reach the fleet gradually and safely.
Diagnostics
- One-click diagnostics. Request a full bundle from any machine — system health, logs, and connection details.
- Delivered securely. Straight to your storage and downloadable from the dashboard — no site visit needed.
Licensing & billing
- Per-machine licensing. Costs scale simply with your fleet.
- Clear invoices. For the machines in use.
Security & privacy
- Hidden Windows password — delivered securely, never shown on the device.
- Everything encrypted, with recordings and screenshots in secure, private cloud storage.
- Role-based access — people see and do only what you allow.
- Full audit trail — every important action is logged.
- Transparent monitoring — a clear on-screen recording badge (unless a policy allows silent operation).
- Automatic clean-up — recordings and chats delete on the schedule you set.
- Locked-down machines — no tampering, no unapproved software.
- Signed, verified updates — only genuine updates are ever applied.
- No inbound access needed — machines dial out, so nothing is exposed on your network.
Reliability
- Self-healing — frozen sessions recover automatically, no power-cycling.
- Smart reconnection through everyday network hiccups.
- Freeze-proof audio and call-stability hardening for long, smooth sessions.
- Automatic over-the-air updates keep every machine current, effortlessly.
- Set it and forget it — once running, machines just keep working.
$45per machine / month
All-inclusive — no hidden fees
No separate charges for the dashboard, storage, updates, or support — one simple price, per machine.
Everything included
- The secure operating system on every machine
- The management application — on the web and as a mobile app
- Live view, session recording, and secure cloud storage
- Activity tracking and the audit log
- Support chat and user management
- Automatic updates and ongoing support
See how it fits your industry
Exam proctoring, BPO desktops, healthcare clinics, retail branches, and 6 more — each with the specific problem it removes and how ThinClient OS fits.
See it in action
This product is live in production — explore it for yourself.
Visit ThinClient OS + Fleet ManagerReady to Start Your Project?
Let's discuss how we can help you achieve similar results for your business
More Success Stories
Explore our other devops & infrastructure projects
Data Platform
Database Migration Platform
eSparks IT Solutions built a browser-operated data platform for planning, running, monitoring, and validating real-time migrations between heterogeneous databases. Five relational engines (SQL Server, PostgreSQL, MySQL, Oracle, Db2) migrate in either direction; MongoDB is supported as a CDC source. Its Java 21 and Spring Boot 3 control plane orchestrates jobs, while a React interface supports operation through the browser. For real-time CDC, the data plane uses Debezium, Kafka, and a JDBC sink, with PostgreSQL in the stack and deployment via Docker Compose or Kubernetes (Strimzi). The platform includes end-to-end integrity validation with drift detection, custom Java SMTs, AES-GCM secret encryption, Prometheus/Grafana, and JWT/RBAC security. SQL Server, PostgreSQL, MySQL and MongoDB migrations are live-verified end-to-end — including a production programme that moved roughly 960 million rows across 405 tables from SQL Server to PostgreSQL with zero rows missing at validation; Oracle and Db2 connectors are implemented and tested at the unit/config level, pending live verification.
Read Full Case Study
SaaS
Sparks Business — Inventory, Sales & GST Invoicing Platform
Sparks Business is a multi-tenant platform built by eSparks IT Solutions to run inventory, purchases, sales and GST invoicing from one system. It pairs a NestJS 11 API with an installable Next.js 15 PWA, backed by PostgreSQL 17 through Prisma 6 across 49 data models. Every query is scoped to its tenant through an AsyncLocalStorage-driven Prisma client extension, and an append-only audit table is enforced at the database level — even a direct update or delete against it is rejected by a trigger. GST math (CGST/SGST/IGST splitting, GSTIN validation) runs on decimal.js for exact, rounding-free results, and a real Tally XML importer lets a business bring in existing ledgers, vouchers and stock items instead of starting over. Redis and BullMQ handle background email and document generation, S3-compatible object storage holds product images, invoice PDFs and backups, and Microsoft Graph sends transactional email. Deploys are health-gated, so a broken build never reaches production.
Read Full Case Study
SaaS
Esparks Edu — School Management ERP
Esparks Edu is a SaaS school management ERP built to unify academics, finance, HR, and daily operations in one platform. eSparks IT Solutions developed it with Next.js 16, React 19, PostgreSQL, Prisma, NextAuth.js v5, Redis, and a companion React Native app. The system supports subdomain-based multi-tenancy with row-level tenant isolation, along with RBAC across 9 roles and 4 subscription tiers (Free, Starter, Professional, Enterprise) billed through Razorpay. Its scope covers admissions, attendance, fees, exams, payroll, timetable, transport, library and report cards, helping schools manage core processes in a single system. The platform spans 60 data models across 6 logical database schemas, around 27 web modules, and 21+ mobile screens, with Firebase push notifications extending the experience to parents and students.
Read Full Case Study