Skip to main content
If your organization restricts outbound traffic, allow the hosts below. All traffic is HTTPS on port 443.
The two third-party hosts are being moved behind an Atlan-operated proxy, so a future release will drop them from this list. Blocking them today costs you nothing operationally - see below.

Minimum set

The first four hosts are the floor: without them, sign-in, setup, and sync do not work. Blocking app.atlan.com also stops updates entirely: every update download is served from this host. Blocking aireg.sh stops first-run setup at Couldn’t set up the background service. The remaining hosts degrade a feature rather than break the app:
  • Blocking releases.atlan.com leaves updates dependent on the app.atlan.com feed alone.
  • Blocking the Sentry and Segment hosts disables crash and usage reporting. The app is unaffected; Atlan support just sees less when you report a problem. No customer data flows to either: crash reports are scrubbed before send, and analytics carry product usage, not your content.
Blocking telemetry is a legitimate choice - make it deliberately rather than by accident.

First-run install traffic

On first launch, the app downloads its background service from aireg.sh, over TLS with a signature check. Plan for one download of tens of megabytes per device on first run, and budget bandwidth accordingly for large fleets. A slow link does not fail the download: it resumes where it stopped, and gives up only when no data arrives for 45 seconds.

Proxies

The app uses the proxy settings and the trusted certificates of the operating system, so standard HTTPS proxies configured at the OS level apply. These hosts are stable root URLs and are not expected to change; if they ever do, the change lands in these docs and in release notes first. If your proxy inspects TLS traffic (Zscaler, for example), it re-signs each connection with its own root certificate. Do one of the following, or update checks, sign-in, and first-run setup fail with a TLS or certificate error:
  • Exempt the hosts above from TLS inspection.
  • Deploy the proxy’s root certificate to the operating system’s trust store: the System keychain on macOS, or Trusted Root Certification Authorities on Windows. Atlan 0.9.67 and later trust that store for every connection; earlier versions do not trust it for sign-in or the background service download.