Trust & firewall

Trust & Firewall Configuration

Find the domains and protocols your IT team needs to allow Encelade through a firewall or proxy.

Domains to allowlist

The table below is derived from this repository's codepaths. Standard transport is HTTPS on port 443; Supabase Realtime adds WSS on 443.

This baseline covers fixed Encelade codepaths. User-supplied embeds, custom media URLs, and external integrations may add additional vendor domains beyond this list.

Domain	Purpose	Protocol	Port
`www.encelade.ai`	Primary Encelade site, authenticated routes, API traffic, MCP endpoints, and the Sentry tunnel at /api/monitoring.	HTTPS / SSE	443
`mpecifbzzyybcerfeghr.supabase.co`	Supabase Auth, sessions, MFA, collaboration, and realtime updates.	HTTPS / WSS	443
`*.blob.vercel-storage.com`	Public delivery for uploaded media, custom fonts, and blob-backed export snapshot handoff.	HTTPS	443
`docs.google.com`	Optional direct CSV download for public Google Sheets used as chart data sources.	HTTPS	443
`prysm-export-worker.fly.dev`	Async PDF and PPTX export worker used when external export processing is enabled.	HTTPS	443
`fonts.googleapis.com`	Optional Google Font stylesheet loading from the editor font picker.	HTTPS	443
`fonts.gstatic.com`	Optional Google Font file delivery.	HTTPS	443
`basemaps.cartocdn.com`	Map basemap styles and tiles for map and globe layers.	HTTPS	443
`nominatim.openstreetmap.org`	City lookup in the dotted globe editor.	HTTPS	443
`cdn.amplitude.com`	Amplitude browser SDK download when product analytics is enabled.	HTTPS	443
`*.amplitude.com`	Amplitude event ingestion and session replay endpoints when product analytics is enabled.	HTTPS	443

IP ranges

Encelade runs on Vercel, Supabase, and Fly.io. Those platforms use dynamic IP ranges, so outbound allowlisting should be done by domain rather than by source IP. If your environment requires static IP ranges or a custom network review, contact security@encelade.ai.

Protocols

HTTPS: standard web traffic for the Encelade UI, REST APIs, asset delivery, export initiation, and optional analytics/font/map requests.
WSS: Supabase Realtime uses secure WebSockets for collaboration presence, patch sync, generation updates, and survey response events.
SSE / Streamable HTTP: the MCP endpoint at /api/mcp supports streaming responses for AI clients, including the legacy /api/mcp/sse transport.

Hosting & subprocessors

Supabase: Database, authentication, and realtime collaboration — United States.
Vercel: Application hosting, delivery, and file storage — United States.
Fly.io: PDF and PPTX export rendering and page thumbnails — United States.
Upstash: Rate limiting, caching, and background job queues (Redis and QStash) — United States.
Stripe: Payment processing — United States.
Anthropic: AI text generation and analysis of uploaded files (API only) — United States.
OpenAI: AI text and image generation (API only) — United States.
Google: AI text and image generation via Gemini (API only), and usage analytics via Google Analytics — United States.
Black Forest Labs: AI image generation via FLUX (API only) — EU and United States.
fal.ai: AI image background removal and video generation (API only) — United States.
Tripo: AI 3D model generation (API only) — United States.
Amplitude: Product analytics and session replay — United States.
Microsoft: Session recording and heatmaps via Clarity — United States.
Sentry: Error monitoring — United States.
Resend: Transactional email delivery — United States.

Data handling

Encelade stores account information (email, profile, workspace membership), the presentation content you create or import, uploaded media and fonts, generation prompts and the model outputs they produce, and standard product telemetry. Tenant data is isolated at the database level via row-level security and tenant-scoped foreign keys.

All traffic is encrypted in transit over HTTPS or WSS as described above. Data at rest is encrypted by the underlying managed services (Supabase Postgres for relational data, Vercel Blob for file storage, Upstash for cache and rate limits). The full list of providers that process customer data is published in Hosting & subprocessors above. For the full data-processing policy, see /legal/privacy.

GDPR posture

For customer-uploaded content, Encelade acts as a processor on behalf of the customer; for account-level data tied to the Encelade account itself, Encelade acts as a controller. A Data Processing Addendum is available at /legal/dpa.

Data subject requests — access, correction, export, or erasure — can be sent to security@encelade.ai. EU data residency requirements can be discussed with the same address; where each provider processes data is listed under Hosting & subprocessors.

Data retention

Active account data is retained for the life of the account. When you delete a project or an account, the underlying records are removed immediately via cascading database deletion — there is no soft-delete window, no "trash" tier, and no separate purge job. Once deleted, content is no longer reachable through the product or its APIs.

Operational backups follow our infrastructure providers' standard retention windows (Supabase point-in-time recovery and Vercel platform backups). We are formalizing a single retention schedule with the exact windows for each data category and will publish it on this page. For specific retention questions, email security@encelade.ai.

Email template for IT

This template includes the current domain list and a direct link back to this page.

Subject: Firewall allowlist request for Encelade

Hello IT/Security team,

I'm evaluating Encelade for work and need network allowlisting so I can access the product, collaboration features, exports, and optional MCP connectivity.

Please allow outbound access to: www.encelade.ai (HTTPS / SSE, port 443); mpecifbzzyybcerfeghr.supabase.co (HTTPS / WSS, port 443); *.blob.vercel-storage.com (HTTPS, port 443); docs.google.com (HTTPS, port 443); prysm-export-worker.fly.dev (HTTPS, port 443); fonts.googleapis.com (HTTPS, port 443); fonts.gstatic.com (HTTPS, port 443); basemaps.cartocdn.com (HTTPS, port 443); nominatim.openstreetmap.org (HTTPS, port 443); cdn.amplitude.com (HTTPS, port 443); *.amplitude.com (HTTPS, port 443).

Reference: https://www.encelade.ai/trust

Thank you,
[Your name]

Contact

For allowlist questions or enterprise security reviews, email security@encelade.ai. We can discuss SSO, DPAs, data residency requirements, and the current status of our security program, including SOC 2, with enterprise customers.

For broader legal and security policy information, see /legal/security.