Clicks through every screen in order at machine speed, then opens the hidden decoy menu.
Naïve crawlerLocked within seconds
QALA: cloud app streaming with AI clone detection
Your app runs in our cloud. Users get the pixels, never the code, and an AI engine catches agents trying to copy it.
See the live demo
The problem
AI made copying an app cheap.
Ship a desktop app and you ship its binary. Open-source models now turn binaries back into working code, and AI agents can explore an app screen by screen to rebuild it.
- LLMs decompile binaries
- Agents can drive any desktop UI
- Obfuscation only buys time
- Every install ships the code
64.9%
of decompiled functions re-execute correctly after an open-source LLM rebuilds them.
LLM4Decompile-9B-v2 benchmark, 2024
850+
companies already pay one vendor, Guardsquare, to obfuscate their code.
0 of 8
app-streaming platforms in our analysis offer AI-clone detection.
Apache Guacamole
WebRTC
OpenID Connect
SAML 2.0
RDP · VNC
SOC 2 · roadmap
The platform
Two layers. One platform.
Streaming means the binary never reaches a device. Detection catches anyone trying to copy the app through its screens instead. No SDK, no code changes.
Open the live demoCloud streaming
Your Windows or Linux app runs on QALA hosts and reaches users as an encrypted stream in any modern browser. They get pixels; the binary stays on our servers.
Try the streaming previewFolder & feature permissions
Choose exactly which folders, screens and features each role can reach. Users sign in through your own SSO, with OpenID Connect or SAML.
AI Detection Engine
A transparent model scores seven behavioural signals live (speed, rhythm, coverage, forward sweeps, pointer movement, backtracking and dwell) and responds in steps: monitor, re-authenticate, lock. v2 adds a logistic-regression model trained on labelled sessions.
Watch it score youHoneypot screens
QALA's client draws decoy menu items that only something enumerating the interface can reach. Touch one and the session locks. Your app's code is never modified.
Trigger one in the attack labWatermark & audit
A faint visible session ID and per-session audit records trace leaked screenshots and recordings back to an account.
How it works
From upload to protected in four steps
01.
Upload your app, unchanged
Push your existing Windows or Linux app once. No rewrite, no SDK, no code changes.
02.
Pick what each role sees
Choose the folders, screens and features each role can reach, then connect your SSO.
03.
Share one link
Users open the app in any browser, on any device. Nothing to install, patch or leak.
04.
Protect every session
Detection, honeypots, watermarking and audit run automatically from the first click.
For end users
Nothing to install. Nothing to leak.
No costly hardware
Heavy CAD and GPU apps run on a basic laptop.
Anywhere, anytime
Office, home or the road: open a link.
Any device, any OS
Windows, macOS, Linux, ChromeOS and tablets.
Zero installs
Nothing to download, configure or patch.
Always current
Update once and everyone gets it instantly.
Measured, not promised
We don't just promise detection. We measure it.
We ran 100 simulated sessions for each kind of attacker through the detector that powers the live demo, and compared it with a plain rate-limit rule. v1 uses calibrated weights. v2 adds a logistic-regression model trained on 10,612 labelled session prefixes, with seed 777 held out from training. Open the demo to rerun it.
Rerun the benchmarkDetection rate by attacker
Share of sessions pushed to step-up or lock (risk ≥ 70). Seed 777, 100 sessions each.
QALA v1QALA v2 (trained)Rate-limit rule
1%Real users flagged · v1
1%Real users flagged · v2
18%Real users flagged · rate limit
Across 30 random seeds: human-mimic agents caught 63% (v1), 69% (v2) and 40% (rate limit). Low-and-slow agents caught 4%, 29% and 0%. Real users flagged 2.4%, 3.5% and 17%. 16 automated tests reproduce these numbers.
What it catches, and what it misses
Caught · 100%
Caught · 100%
Caught · 67% · v2 73%
v1 misses 97% · v2 catches 38%
Agentsobserved
Adds random pauses to look human, but still sweeps forward through every screen.
Jittered botRhythm and coverage give it away
Moves the pointer, varies its rhythm and revisits screens the way a person would.
Human-mimic agentA rate limit catches 43%
Paces itself over long sessions and backtracks like a person. This is our hard case, and we say so.
Low-and-slow agentTrained v2 helps; pilots will confirm
The business
The numbers behind QALA
Plan figures from our project brief. Every pilot replaces them with real data.
See pricingMarket
QALA sits where virtual desktops meet in-app protection: delivery infrastructure that also protects the app.
$11BSpend we compete for, 2025
120Customers · 3-year target
Unit economics
Pro costs $18 per concurrent user a month. Hosting runs about $6 on Linux and web apps; Windows licences pass through at cost.
$18Pro · per user / month
~67%Pro gross margin
Customer case
An ISV with $5M in revenue and 500 concurrent users pays $108k a year on Pro. Here is the cloning loss it must prevent to break even.
2.2%Of revenue to break even
0.4%With support savings
Pricing
Priced per concurrent user.
That's how software vendors already sell, so QALA drops straight into their price lists. Every plan includes hosting.
Book a pilotStarter
$8/user/mo
- Up to 50 users
- Browser streaming
- Folder permissions & SSO
- Standard watermark
Pro Core plan
$18/user/mo
- Everything in Starter
- AI Detection Engine
- Feature-level permissions
- 90-day audit · 99.9% SLA
Enterprise
$28+/user/mo
- Everything in Pro
- On-prem or Baku data centre
- GPU apps
- Unlimited audit · SOC 2
Windows apps
Microsoft licences are passed through at cost and quoted per deployment. Linux and internal web apps run at list price.
No hidden licence riskRoadmap
From prototype to scale
Prototype
Detector v1 + trained v2 · streaming previewStatus: live demoOct 2026MVP
Upload · permissions · streaming · SSOGate: 3 pilotsQ1 2027Anti-clone v1
Watermark · agent detection · auditGate: 10 payingQ2 2027Enterprise
On-prem · Baku DC · GPU · SOC 2Gate: 1st enterpriseQ3–Q4 2027Scale
AWS & Azure MarketplaceGate: 120 customers2028
Get started
Stream it. Don't ship it.
We're onboarding three pilot ISVs, each with a free clone-risk assessment of their app.
Open the live demoPilot access:
hello@coretetym.co