Skip to main content
This is the page to hand your IT team. It lists every outbound host the OpenWhispr desktop app contacts, why, and whether it’s optional. All connections are client-initiated over TLS on port 443. A few components — the CLI bridge, an auth bridge, an OAuth callback catcher, and local model servers when you use them — listen on 127.0.0.1 for the app’s own pieces to talk to each other. One exception: the bundled Parakeet speech server can’t bind loopback-only, so on Windows it listens on all interfaces until the installer’s firewall rule closes it off — see antivirus and firewall prompts.

​
Required by default

Contacted by every install using OpenWhispr Cloud, which is the default after onboarding.

​
Streaming transcription

Streaming sessions are routed through one of three providers. Allowlist all three unless a specific provider is pinned in your configuration.

​
Local model downloads

Contacted only when someone opts into a local model — Whisper, Parakeet, or a local reasoning model. Not needed for cloud-only installs.

​
Google and Microsoft Calendar (optional)

Only if a user connects Google or Microsoft Calendar in settings. Apple Calendar reads Calendar.app locally and needs no calendar-provider network allowlist.

​
Company SSO and SCIM (optional)

Required only for centrally managed Enterprise workspaces. Business and Pro workspaces keep their ordinary sign-in flow. The SCIM connector is an inbound HTTPS integration from your identity provider to OpenWhispr. It does not require an inbound firewall rule on employee devices. See SCIM provisioning.

​
Managed enterprise AI (optional)

Allow only the provider selected by your workspace administrator. Replace <region> and the Azure wildcard with the region and resource you actually use. AWS and Microsoft also retrieve OpenWhispr’s OIDC discovery document and public signing keys from api.openwhispr.com. That is cloud-to-cloud traffic, not a connection from the employee device.

​
URL audio import (optional)

Only when a user pastes a URL into the Upload view. Downloads are HTTPS-only, and hosts resolving to private or internal addresses are rejected.

​
Bring-your-own-key providers (optional)

Required only where a user has configured their own API key. Skip any provider not in use.
Tinfoil assigns an enclave host dynamically at runtime, so allowlist *.tinfoil.sh rather than pinning individual hosts. atc.tinfoil.sh serves the attestation bundle, which is verified locally.

​
Notes for network administrators

  • Proxies are honoured. The app uses Electron’s network stack, which follows system proxy settings — macOS System Settings, Windows Internet Options and WPAD, GNOME proxy — and PAC scripts on all platforms.
  • IP pinning is not supported. These hosts resolve to provider-managed addresses that change without notice. Allowlist by hostname.
  • TLS interception needs its root trusted by the OS. Otherwise connections fail with certificate errors.
  • Minimal Linux containers without a system CA bundle — Alpine, distroless — need NODE_EXTRA_CA_CERTS set to your CA bundle path.

​
What the failures look like

​
Testing the path

Run these from a machine on the same network as the user. Any HTTP response — including 401 — confirms the network path works.