Network requirements
Everything below is what a browser needs to reach for the platform to work. If you manage a firewall, forward proxy or secure web gateway, this is the complete list — nothing else is required.
If you only do one thing: allow the hosts marked Required, and allow outbound UDP 3478 for real-time audio.
Application
The product itself. Blocking these makes the platform unreachable.
| Host | Ports | Protocols | Purpose |
|---|---|---|---|
zursum.comRequired | 443 | HTTPS | Web application |
www.zursum.comRequired | 443 | HTTPS | Web application (canonical host) |
empatia.aiOptional | 443 | HTTPS | Alternate brand domain |
www.empatia.aiOptional | 443 | HTTPS | Alternate brand domain |
Real-time voice
Practice conversations run over WebRTC. This is the section most often missed: media needs UDP, not just HTTPS.
| Host | Ports | Protocols | Purpose |
|---|---|---|---|
*.retellai.comRequired | 443 | HTTPS, WSS | Voice session signalling and transcription |
*.livekit.cloudRequired | 443 | HTTPS, WSS | WebRTC media server |
*.livekit.cloudRequired | 3478 | UDP | STUN/TURN — carries the actual audio. Without outbound UDP the call connects but stays silent. |
*.livekit.cloudOptional | 443 | TCP | TURN over TLS — fallback when UDP is blocked. Degraded quality but functional. |
Payments
Only required for self-service checkout. Not needed for enterprise contracts billed by invoice.
| Host | Ports | Protocols | Purpose |
|---|---|---|---|
js.stripe.comOptional | 443 | HTTPS | Payment form |
api.stripe.comOptional | 443 | HTTPS | Payment processing |
checkout.stripe.comOptional | 443 | HTTPS | Hosted checkout |
Error monitoring
Crash reporting. Blocking these degrades our ability to support you, but the product still works.
| Host | Ports | Protocols | Purpose |
|---|---|---|---|
*.sentry.ioOptional | 443 | HTTPS | Error reporting |
va.vercel-scripts.comOptional | 443 | HTTPS | Anonymous usage analytics |
Certificate validation
Needed by TLS-inspection appliances to build and revalidate our certificate chain. Blocking these is a common cause of false 'connection is not private' warnings.
| Host | Ports | Protocols | Purpose |
|---|---|---|---|
*.lencr.orgRequired | 80, 443 | HTTPS, TCP | Let's Encrypt intermediate certificate (AIA) and revocation list (CRL) distribution |
Sender domain for invitations and notifications. Allowlist it in your secure email gateway so onboarding invites are not quarantined.
| Host | Ports | Protocols | Purpose |
|---|---|---|---|
emails.zursum.comRequired | — | — | Envelope sender for all transactional email (SPF/DKIM/DMARC aligned) |
Certificate trust anchors
Our certificates are issued by Let's Encrypt. If your gateway performs TLS inspection with its own trust store, it must trust these roots. A stale trust store is the most common cause of a false "your connection is not private" warning on our domains.
ISRG Root X1Let's Encrypt (ISRG)RSA root, trusted by every major OS since 2021.
ISRG Root X2Let's Encrypt (ISRG)ECDSA root.
ISRG Root YRLet's Encrypt (ISRG)RSA root issued in 2025. Cross-signed by ISRG Root X1, so an up-to-date store is not strictly required — but older inspection appliances may need it imported explicitly.
ISRG Root YELet's Encrypt (ISRG)ECDSA counterpart of Root YR, also cross-signed by ISRG Root X1.
If you inspect TLS traffic
We use HSTS, so a certificate error cannot be clicked through by the user. Rather than exempting us from inspection, we recommend updating the appliance trust store — but if you prefer a bypass, add our domains to the TLS inspection exclusion list.
Verify it works
Run the connectivity check from inside your network. It produces a report you can paste into a ticket, with the exact hosts that failed.
Run the connectivity checkQuestions? Write to security@zursum.com