Skip to main content

Fully Managed Guacamole
as a Service

Deploy Guacamole as a fully managed service starting at €9/mo. Get automated backups, SSL, updates, support and monitoring included.

Apache Guacamole is an open-source clientless remote desktop gateway maintained by the Apache Software Foundation. It translates RDP, VNC, SSH, and telnet into HTML5 in your browser — combining the convenience of TeamViewer or AnyDesk with the session recording and architectural control of a self-hosted jump host.

Free 7-day trial  99.9% Uptime SLA  No credit card  Cancel anytime

Free 7-day trial  99.9% Uptime SLA
No credit card  Cancel anytime

Guacamole

Guacamole

STARTING AT

€9/month
Automated Backups
Monitoring
Automated Updates
Auto SSL

USAGE

Unlimited
Human Support
Custom Domains
Terminal Access
File Manager Access
Deploy in your region 21 locations worldwide
GermanyFinlandNetherlandsUKSwedenUnited StatesCanadaSingaporeJapanAustraliaBrazilSouth Africa+9 more →
Guacamole Preview Image

ABOUT THE SOFTWARE

What is Guacamole

Apache Guacamole is a clientless HTML5 remote desktop gateway. It runs in a browser tab and translates four protocols — RDP, VNC, SSH, and Kubernetes — into a session your user runs without installing anything client-side.

The project was created in 2010 by Michael Jumper, donated to the Apache Software Foundation by Glyptodon LLC in 2016, and graduated to a top-level Apache project on November 14, 2017. Sixteen committers and ten PMC members maintain it under the Apache License 2.0.

Architecturally, Guacamole is three things. guacd, a C daemon that speaks RDP, VNC, SSH, telnet, and Kubernetes. A Java web application that runs in Tomcat and renders the protocol streams as HTML5 canvas. And a JDBC database — MySQL, PostgreSQL, or SQL Server — that stores users, connections, and permissions. Notable downstream commercial distributions include Glyptodon Enterprise, Keeper Connection Manager, and Kasm Workspaces; AWS Marketplace ships a Guacamole bastion-host CloudFormation template used in production by customer-service desks.

FEATURES

What Guacamole does

Guacamole speaks five protocols, renders them as HTML5 in any modern browser, and gates them behind centralized authentication, session recording, and per-connection permissions. One URL replaces a sprawl of native clients and VPN credentials.

HTML5 browser rendering

Sessions stream as canvas in any Chromium, Firefox, or Safari browser. No client install, no agent, no plugin. Works on Chromebooks, iPads, and locked-down corporate laptops.

Centralized authentication

Built-in JDBC users plus stackable extensions for LDAP, SAML, Active Directory, OpenID Connect, header-based SSO, and CAS. Mix and match per deployment.

Session recording and playback

Every connection optionally records to disk. Play back in-browser since Guacamole 1.5.0. Convert to MP4 with the guacenc CLI for long-term archive.

Clipboard and file transfer

Bidirectional clipboard between browser and remote desktop. SFTP-backed file transfer for SSH connections. Drive redirection for RDP. Bulk connection import added in 1.6.0.

RDP, VNC, SSH, telnet, Kubernetes

Five protocols in one gateway. Connect to a Windows desktop, a macOS VNC server, a Linux SSH host, and a Kubernetes exec session from the same browser tab.

TOTP and Duo multi-factor

TOTP via guacamole-auth-totp. Duo via guacamole-auth-duo with Universal Prompt v4 since 1.6.0. Both as drop-in extensions with bypass-host lists for service accounts.

Connection groups and sharing

Organize hundreds of connections into nested groups with RBAC permissions. Share live sessions read-only or read-write with another authenticated user via signed tokens.

Brute-force protection

The guacamole-auth-ban extension introduced in 1.6.0 blocks IPs after configurable failed attempts. Tracks up to roughly 10 million IPs in memory. On by default on DANIAN.

WHAT'S ALWAYS INCLUDED

Every app. Fully managed.
Nothing extra to pay for.

Every app you deploy includes the full managed service — security, backups, updates, and support from day one.

Automatic updates and patches

Apps run the latest stable version. Security patches applied silently, with rollback if needed.

Daily off-site backups

Multiple daily backups in redundant off-site locations. One-click restore if anything goes wrong.

24/7 uptime monitoring

Continuous monitoring with instant alerting. We respond before you notice.

SSL, firewall, DDoS protection

Auto-renewing SSL, hardened firewall rules, DDoS mitigation on every deployment.

Performance and scaling

We monitor resource usage continuously. When your app needs more headroom, we flag it and upgrade with your explicit approval.

Dedicated engineering support

Real engineers on chat. DNS, SMTP & migration help. All included in €9.

WHY MANAGED

Why teams pick managed Guacamole

Two events in 2024 reshaped the remote-access category. On June 26, TeamViewer disclosed an APT29 intrusion into its corporate environment. Through 2024 and 2025, customers reported renewal hikes of 30 to 100% as legacy plans were retired. The browser-based, single-purpose gateway is the architectural answer — and Guacamole is the open-source default.

Running Guacamole yourself is more work than the install guide suggests. The guacd daemon, the Tomcat container, and the JDBC database each have their own version compatibility windows, log rotations, and tuning knobs. The auth extensions — TOTP, Duo, SAML, LDAP, JDBC — ship as separate JARs you install into GUACAMOLE_HOME/extensions and restart Tomcat after every upgrade. Database schema migrations between minor versions occasionally need manual SQL.

The 1.5.5 to 1.6.0 upgrade in 2025 is a good example. CVE-2024-35164, a terminal-emulator arbitrary code execution in guacd, was disclosed on July 1, 2025. The fix shipped only in 1.6.0. Anyone still on 1.5.5 on the day of disclosure — which on the day of disclosure was every self-hosted install — was exposed until they completed the upgrade. We pushed 1.6.0 to every DANIAN-managed Guacamole instance within the disclosure window.

REVIEWS

Hear from customers ​like you​​​​​​​

Successful businesses and professionals around the world rely on DANIAN every day

USE CASES

Three teams who run Guacamole on DANIAN

These are representative team types we set up most often. Each starts with the same flat €9 plan.

40-CLIENT MCP IN MUNICH

Replacing TeamViewer Corporate after the APT29 breach

Region: Germany. Per-client connection groups, isolated by RBAC. SAML SSO to the MSP's Microsoft Entra ID. Duo Universal Prompt enforced. Recordings rotated to object storage after 30 days for billable-hours reconciliation. Replaces per-endpoint TeamViewer agent install on every client machine.

8-SRE FINTECH IN LONDON

Killing per-engineer SSH key sprawl across 200 servers

Region: UK. SSH connections grouped by environment — prod, staging, dev. Duo Universal Prompt enforced. Recordings retained 90 days. Break-glass access via signed JSON tokens. No engineer holds a personal SSH key on a production host anymore.

THREE-PERSON GAME STUDIO IN BARCELONA

Browser RDP to a Windows-only build machine

Region: Spain. Three RDP connections to a production-class Windows VM with GPU passthrough. TOTP enforced. Clipboard sync on. RDP drive redirection for asset transfer. Session timeout extended to 8 hours for long Unreal Engine compiles. Devs work on MacBooks, target Windows-only AAA tooling.

COMPARISON

Four ways to run Guacamole

Four real paths: proprietary remote-desktop SaaS, self-hosted on a VPS, self-hosted on a home server, or fully managed. The cost gap widens with team size — and only one path keeps the session recording, protocol breadth, and architectural control Guacamole was built for.

 PATH1 USER5 USERS 10 USERSYOUR TIME / MONTH WHAT YOU GIVE UP
TeamViewer
(proprietary SaaS)
~€50/mo (Business)~€91/mo (Premium, 15-user minimum)~€91/mo (Premium, 15-user minimum)0 hrs
Proprietary protocol. Forced tier upgrade at 2+ users. Documented renewal hikes. No on-disk session recording on Business.
Self-host
on a $24/month production-class VPS
~$44/mo infrastructure~$44/mo infrastructure~$44/mo infrastructure5–10 hrs initial, then 1–2 hrs/moYou install and patch guacd, Tomcat, MySQL, and every extension. You own the CVE response window. Recording rotation is on you.
Self-host on a home server
(Synology DS923+ or HP ProLiant ML30)
€210–667/mo all-in€210–667/mo all-in€210–667/mo all-in2–4 hrs/moHardware €650–1,500. Business internet €40–80/mo. Electricity €17–32/mo. Off-site backup €10–20/mo. Your home power outage is a production incident.
DANIAN Managed Guacamole€9/mo€9/mo€9/mo0 hrsYou give up self-hosting. We pin the FreeRDP build, push CVEs, and back up nightly.

TeamViewer Business supports one named user. A 5- or 10-person team is forced onto Premium and its 15-user minimum — the difference between the columns is the forced-tier mechanic, not the seat count.

BY INDUSTRY

Guacamole for specific industries

Remote access is regulated differently in each industry. Guacamole's session recording, protocol translation, and clientless architecture line up with four sets of demands more cleanly than a generic SaaS does.

Privileged-access controls sit under Cyber Essentials Plus secure-configuration requirements and CIS Controls v8 — specifically Control 6: Access Control Management. Each MSP technician's session into a client network needs to be authenticated, authorized, and reviewable.

DANIAN provisions one tenant per MSP organization. Per-client connection groups are isolated by RBAC. SAML SSO connects to the MSP's identity provider. Session recording runs on every connection. Duo Universal Prompt is enforced. Per-client TOTP devices are supported via the bypass-host pattern.

The workflow: engineer signs in via SSO and Duo, selects the client connection group, opens an RDP session into the client's domain controller in the browser. The session is recorded, attached to the PSA ticket, and time-stamped against billable hours.

Quantifiable: forty SMB clients with roughly three jump targets each — about 120 endpoints — on a single €9 Guacamole instance, versus a per-endpoint agent install on every client machine.
Technical safeguards for electronic protected health information sit under 45 CFR §164.312 — specifically unique user identification (a)(2)(i) and audit controls (b). The European equivalent runs through the Network and Information Security Directive 2 and the European Health Data Space Regulation.

DANIAN turns session recording on by default, encrypts recordings at rest, and configures retention to multi-year for regulated review. SAML SSO connects to the hospital identity provider. No clinician-side install — the clinician needs a browser and a TOTP device.

The workflow: an on-call cardiologist signs in from a home browser, RDPs into the EMR workstation inside the hospital VLAN, the session is recorded, the recording is tagged with the clinician's NPI and archived to cold storage.

Quantifiable: hundreds of clinicians serviced without a per-clinician VPN agent or virtual-desktop client footprint — replaced by one HTML5 entry point and one consolidated session record per access event.
Industrial remote access sits under IEC 62443-3-3 system requirements — specifically SR 1.13 (access via untrusted networks) and SR 2.8 (auditable events). NIST SP 800-82 Rev. 3 gives equivalent guidance for industrial control systems.

DANIAN puts Guacamole in a corporate DMZ as the sole bridge into the OT VLAN. Per-connection source-IP allowlists. Short-lived JSON token-based connections for vendor engineers.

The workflow: a Rockwell or Siemens vendor engineer needs PLC firmware updated. IT issues a 24-hour token-based connection to a single engineering workstation. The vendor RDPs in via browser. The session video is retained as management-of-change evidence.

Quantifiable: replaces a sprawl of vendor-bespoke remote-support tools — TeamViewer, AnyDesk, OEM-custom — with one logged choke point and a single record per vendor-access event.
Research and student data sit under NIST SP 800-171 Rev. 3 for controlled unclassified information in US research grants, and the Family Educational Rights and Privacy Act for student records. European institutions follow national research-data-protection regimes.

DANIAN uses Guacamole 1.6.0 bulk connection import to provision one RDP per lab seat at semester start and removes them at semester end. SAML SSO connects to the institution's Shibboleth identity provider. Case-insensitive usernames — configurable since 1.6.0 — match eduPersonPrincipalName.

The workflow: an undergraduate on a personal Chromebook signs in to the lab portal, gets matched to a Windows lab VM by group, RDPs into AutoCAD or MATLAB in the browser. The session is logged for license-compliance review.

Quantifiable: an 800-student computer-science department shares roughly 60 specialty Windows lab VMs without buying CAD or numerical-computing licenses for every Chromebook, iPad, and Mac in the cohort.

FAQ

Frequently asked questions

Everything teams ask before signing up — answered straight, without sales speak.

Three groups: technical setup, migration, and how DANIAN works as a service.

01

Technical and configuration

The browser Clipboard API only permits setting clipboard data during an active event. The Guacamole web UI exposes a clipboard text area in the on-screen menu — open the menu with Ctrl+Alt+Shift, paste into the text area, and the session receives it. For large transfers, RDP drive redirection or SFTP for SSH is the alternative.
Two common causes. First, Network Level Authentication on the server side — the user must be in the Remote Desktop Users group, or NLA disabled. Second, a FreeRDP version mismatch — the 1.5.x guacd was built against FreeRDP 2.x and some Windows builds need a rebuilt guacd. We pin guacd against a known-good FreeRDP across the fleet to avoid the failure mode.
Yes, via the guacamole-auth-ldap extension. When both LDAP and the JDBC database are configured, LDAP authenticates and JDBC stores connection permissions — the user must exist in both for full functionality. We handle the dual-source setup at provision time so engineers do not hit the documented sync gap.
The guacamole-auth-sso extension covers SAML, OpenID Connect, CAS, and header-based SSO. Since Guacamole 1.4.0, saml-strict is enabled by default, so the saml-idp-metadata-url parameter is preferred over inline XML. Common failure mode: a missing X-Forwarded-Proto header on the reverse proxy causes redirect loops — we set the headers correctly at the edge.
CVE-2024-35164 — a terminal-emulator arbitrary code execution in guacd — was disclosed on July 1, 2025, and fixed only in 1.6.0. Self-hosters need to upgrade the guacamole-server package, accept the database schema migration, and verify FreeRDP linkage. We pushed 1.6.0 to every DANIAN-managed instance within the disclosure window.
Apache JIRA ticket GUACAMOLE-2092, filed June 30, 2025. The guacd process needs a writable home directory or FreeRDP refuses to initialize. The fix on Debian: mkdir -p /var/lib/guacd then chown guacd:guacd /var/lib/guacd. We baked this into our default Docker volume layout so fresh instances and upgrades work the same way.

02

Migration and onboarding

We can activate your app on your own custom domain/subdomain. Examples: mydomain.com, anyword.mydomain.com.
Or, on our randomized free subdomain. Example: 963.apps.danian.cloud
If you wish to use a custom domain/subdomain, select that option when ordering your app (or notify us later). We will send you the required DNS records and if needed, our tech team will modify them for you.
21 datacenter locations across six continents. You choose the region at provisioning. Application data sits in the region you choose; pick whichever is closest to your users or matches your data-residency preference.
Yes. Request a region migration from the dashboard and we run the move in the background. The system emails you when the migration completes; total transfer time depends on data volume but typical instances finish in a few hours. There is no extra charge for a region change.
Yes. Full data export is available at any time, in a portable format you can bring to any infrastructure.

03

Billing, support, and platform

€9 covers everything we do for that app: hardware in the region you choose, daily off-site backups with one-click restore, automatic security patches and version upgrades, 24/7 monitoring, SSL and firewall, and engineering support on Email/LiveChat. There are no setup fees or hidden line items. For more info see our Pricing page.
If you decide to continue, we charge €9/app/month from day 8. If you don't, the trial ends and you can export your data. No card is required for the trial, and we never auto-charge you without explicit consent.
No. The €9/month is flat regardless of how many users log into your app. Add 5 users or 50; the price doesn't change.
24/7 Live chat and email support, both staffed by engineers who run the systems. We handle DNS configuration, SMTP setup, app integrations, performance tuning, troubleshooting, and migration help. Response time is typically under an hour. There is no tier system — every customer gets the same support.
Yes. Cancel from the dashboard. We don't charge a cancellation fee, we don't lock data, and we will export your data to you on request before deletion. data to you on request before deletion.
Every customer instance is backed up daily to a separate region from the primary. We test restores. You can request a restore at any backup point within the retention window — usually 7 days for daily backups.
Your application data sits in the region you choose at provisioning — 21 datacenter locations across six continents. Account-level data (billing, account email, support ticket history) is processed centrally. Application data region is picked by you, per app.
99.9% uptime SLA on every app, every tenant. Service credits are documented at danian.co/service-level-agreement. The status page is located at status.danian.co.
When your tenant approaches the resource ceiling — the base tier holds 1 vCPU/RAM, 30 GB storage — we notify you. Resource upgrades happen with your explicit consent; we will not upgrade your tenant or charge you without it.
We wait. We don't suspend the app or delete your data on the first failed charge. We email you, you fix the card on file, and we continue.
Invoices can be downloaded from the billing dashboard in PDF the day each charge succeeds. EU VAT is added where applicable and the VAT-reverse-charge regime applies for VAT-registered businesses with a valid number.
150+ open-source apps across automation, team chat, file sync, analytics, AI, password management, email marketing, dev tools, project management, smart home, CMS, and federated social. See the full catalog →
Yes. Every instance comes with a web-based terminal and a file manager in your DANIAN management dashboard. Useful for managing your data and customizations.
Resources scale with your usage. If your app needs more vCPU, RAM, or storage, we add it — and we ask first before any change to your plan. €9 is the floor; resource-heavy workloads may price higher, but you'll always know in advance.
Yes. We have both a Partner program and an Affiliate program available. Anybody can sign up.
No contract. No minimum commitment. Cancel anytime from the dashboard with one click. The 7-day free trial requires no credit card. After the trial converts to paid, you can still cancel at any month without notice or penalty.

DEPLOY IN YOUR REGION

21 datacenter locations on six continents

Pick the region closest to your users.

United States, Germany, Finland, Singapore, Australia, Brazil, Canada, Netherlands, UK, Spain, Italy, France, Sweden, Malaysia, India, Japan, Mexico, Poland, South Korea, Chile, South Africa and more coming soon

Global Reach Map

Try managed Guacamole for 7 days

No card. Cancel from the dashboard.