← Portal
💻

RM Workspace

Remote Worker · Tailscale access

Available computers tailnet · tail51536c.ts.net

Connect over Tailscale, then use Screen Sharing. Checking who is connected… “Connected” means someone has a Jump Desktop or Screen Sharing session open in that account right now.

Connect from anywhere

🔒
Install Tailscale & sign in

Tailscale puts your device on the private company network (an encrypted mesh). Once connected, the office computers above appear — screen-share into the one you need. Sign in with your Crawford & Co account.

Get Tailscale →

Getting started

1
Install Tailscale

It's linked above. Install it on your laptop and sign in with your CC account (SSO).

2
Wait for approval

First time only — an admin approves your device before it can join the network. You'll be notified when you're in.

3
Pick a computer

Open the list at the top of this page and find your account. A green outline means someone is already using it; yellow means it's free. Click Screen Share on a yellow one.

4
Work on that screen

All client work happens on the office machine — never save client files to your own laptop. Sign out of the machine when you finish.

⚠ Every shift
  • Make sure Tailscale is connected (the icon is green) before you try to reach a computer.
  • Keep all client work inside the screen-share — don't copy files, screenshots or client data onto your own device.
  • Only connect to the machine you've been assigned. If it's offline or you can't reach it, contact IT before starting.

Your tools

🏠
IOE Measure Costing
Price the measures on a retrofit job — the costing tool the Improvement Option Evaluation needs. Reads the Elmhurst RdSAP worksheet and prices each measure against real output. Opens in the portal, so use it inside the screen-share like everything else client-related.
Open Measure Costing →

Secure setup guide · IT / admin

🔒 The principle — sensitive files stay on the UK machine

Remote workers do not get client files on their own devices. They use Tailscale to screen-share into a UK office computer and see only its screen — the files, email and client systems live on that machine and never travel to the worker's laptop. Tailscale builds a private, end-to-end encrypted link (WireGuard) directly between the two devices; nothing is exposed to the public internet. So an overseas worker can work on sensitive data without ever holding it.

1Set up the office machinesOffice
  • Install Tailscale on each UK machine that holds client data and sign in with the shared manager.ccltd@ admin account.
  • Enable Screen Sharing (macOS: System Settings → General → Sharing) or Remote Desktop (Windows).
  • Set it to never sleep when the display is off, and in the Tailscale admin console disable key expiry for these machines so they stay reachable.
  • Tag them tag:office so ACLs can target them as a group.
2Onboard the remote worker's deviceAdmin console
  • Worker installs Tailscale and signs in with their CC account (SSO) — this ties the device to a named person.
  • Turn on device approval so no device joins the tailnet until an admin approves it.
  • Tag the worker's device tag:remote and keep key expiry ON (forces periodic re-auth).
3Least-privilege access with ACLsTailscale ACL
  • Remote workers should reach only the office access machine, and only on the screen-share port — not each other, not everything.
"acls": [
  {
    "action": "accept",
    "src":    ["tag:remote"],
    "dst":    ["tag:office:5900", "tag:office:3389"]
  }
]
// 5900 = macOS Screen Sharing · 3389 = Windows RDP
// no other rule for tag:remote = everything else is denied
4Keep the data on the machineSession
  • Screen-share is pixels only — nothing transfers by default. In the Screen Sharing / RDP settings, turn off clipboard sharing, file transfer and drive redirect for zero copy-out.
  • Disable Taildrop (Tailscale file-send) for tag:remote so files can't be pushed between devices.
  • Client files therefore never leave the UK office machine.
5Identity, audit & offboardOngoing
  • Enforce MFA at the identity provider (the SSO that signs people into Tailscale).
  • Turn on audit logging (and Tailscale SSH session recording if you use tailscale ssh) so every connection is traceable.
  • Off-boarding = remove the person's device in the Tailscale admin console → access is cut instantly; then disable their CC account.
  • Optional — UK exit node: if a worker must also browse client web systems as UK, route their traffic through a UK machine set as an exit node.

Hard controls checklist

✓
Device approval onno device joins unapproved
✓
ACLs least-privilegetag:remote → office only
✓
Screen-share onlyports 5900 / 3389
✓
Clipboard / file xfer offzero copy-out
✓
Taildrop off for remoteno file send
✓
SSO + MFAnamed, verified sign-in
✓
Key expiry on (users)periodic re-auth
✓
Audit logging onevery connection traced

Remote team

0 online
0 total
WorkerRegionAccessStatus

Sample roster — wire to live Tailscale device presence once each worker's device is enrolled.