> ## Documentation Index
> Fetch the complete documentation index at: https://platform.atlan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network requirements

> The hosts the Atlan desktop app needs to reach, with the purpose of each, for firewall allowlisting.

If your organization restricts outbound traffic, allow the hosts below. All
traffic is HTTPS on port 443.

| Host                                | Operated by | Purpose                                                    | Required     |
| ----------------------------------- | ----------- | ---------------------------------------------------------- | ------------ |
| `controlplane.atlan.engineering`    | Atlan       | Sign-in, control-plane API, update feed                    | Yes          |
| `agentgateway.atlan.engineering`    | Atlan       | Registry, skills, and Brain                                | Yes          |
| `releases.atlan.com`                | Atlan       | Update payload downloads, installers, and the release page | Updates only |
| `k.atlan.dev`                       | Atlan       | Update manifest fallback                                   | Updates only |
| `*.ingest.sentry.io`                | Sentry      | Crash and error reporting                                  | No           |
| `cdn.segment.com`, `api.segment.io` | Segment     | Product analytics                                          | No           |

<Note>
  The two third-party hosts are being moved behind an Atlan-operated proxy, so
  a future release will drop them from this list. Blocking them today costs
  you nothing operationally - see below.
</Note>

## The minimum set

The first two hosts are the floor: without them, sign-in and sync do not
work. The remaining hosts degrade a feature rather than break the app:

* Blocking `k.atlan.dev` leaves updates dependent on the control-plane feed
  alone.
* Blocking `releases.atlan.com` stops updates entirely: the update *check*
  succeeds, but the download it points at lives on this host.
* Blocking the Sentry and Segment hosts disables crash and usage reporting.
  The app is unaffected; Atlan support just sees less when you report a
  problem. No customer data flows to either: crash reports are scrubbed
  before send, and analytics carry product usage, not your content.

Blocking telemetry is a legitimate choice - make it deliberately rather than
by accident.

## First-run install traffic

On first launch the app downloads its background sync runtime from the
gateway origin (`agentgateway.atlan.engineering`), over TLS with an integrity
check. Plan for one \~50 MB download per device on first run, and budget
bandwidth accordingly for large fleets.

## Proxies

The app uses the system network stack, so standard HTTPS proxies configured
at the OS level apply. These hosts are stable root URLs and are not expected
to change; if they ever do, the change lands in these docs and in release
notes first.