Quick summary
Conformiq is a browser-based application. There is nothing to install, no agent, and no inbound connection to your network. All traffic is outbound HTTPS initiated by the user's browser.
Allow outbound HTTPS (TCP 443) to the domains listed below, and allow WebSocket connections (WSS) to the application backend. No inbound rules, VPN, or firewall exceptions are required.
Required domains
Application
| Domain | Purpose | Protocol |
|---|---|---|
| conformiq.co.uk | Web application and static assets | HTTPS |
| *.conformiq.co.uk | Subdomains used by the application | HTTPS |
Application backend
Conformiq's database, authentication, file storage and server functions are hosted on Supabase infrastructure.
| Domain | Purpose | Protocol |
|---|---|---|
| heyowywktpzpeyhvehbz.supabase.co | Authentication, database queries, certificate and document storage, server functions | HTTPS + WSS |
This is the critical one. If this domain is blocked, users cannot sign in and the application will not function at all. WebSocket connections to this host must also be permitted for live updates.
Some filtering products categorise supabase.co generically as a cloud or developer platform. If your policy blocks that category, this domain will need an explicit allow rule.
Payments
Card details are entered directly into Stripe-hosted fields and are never handled by Conformiq's servers. Conformiq is not in scope for cardholder data.
| Domain | Purpose |
|---|---|
| js.stripe.com | Stripe payment library |
| api.stripe.com | Payment API |
| checkout.stripe.com | Hosted checkout |
| hooks.stripe.com | 3-D Secure authentication |
| m.stripe.com, m.stripe.network | Fraud prevention |
| q.stripe.com | Stripe telemetry |
Required only for account setup, subscription management and billing. Day-to-day use of the application does not depend on these.
Mapping
Used to pin and display equipment locations on site.
| Domain | Purpose |
|---|---|
| maps.googleapis.com | Maps API and map tiles |
| maps.gstatic.com | Map assets and imagery |
| fonts.googleapis.com, fonts.gstatic.com | Map typography and web fonts |
If these are blocked, the application still works — location maps will not render.
Protocol requirements
- TCP 443 (HTTPS) outbound to all domains listed above
- WebSocket (WSS) to
heyowywktpzpeyhvehbz.supabase.cofor live data updates - TLS 1.2 or higher
- No inbound connections required
- No static IP allowlisting required or supported — these are cloud services with rotating IP ranges, so allow rules must be domain-based
Browser requirements
Conformiq runs in any current browser: Chrome, Edge, Safari or Firefox, desktop and mobile.
The application is a Progressive Web App and can be installed to a device home screen. It caches data locally so site staff can view equipment records and certificates without a signal. This uses standard browser storage — no device management changes are needed.
Known issues on filtered networks
Symptom: "Failed to fetch" on sign-in
Users cannot log in. The browser console shows a CORS error, and the network tab shows a failed preflight (OPTIONS request) with ERR_INVALID_REDIRECT.
Cause: a DNS or web filtering appliance is intercepting requests to the backend domain and returning a redirect. Browsers do not follow redirects on CORS preflight requests, so the request fails before it reaches our servers.
Fix: add heyowywktpzpeyhvehbz.supabase.co to your allow list. The filtering product must pass these requests through without redirection or interception.
To confirm this is the cause: ask the user to try the application on a mobile connection. If it works there but not on the corporate network, the block is at the network layer.
Symptom: maps do not load, everything else works
maps.googleapis.com or maps.gstatic.com is blocked. Not critical — the rest of the application is unaffected.
Symptom: cannot complete signup or payment
Stripe domains are blocked. Users can sign in but cannot start or manage a subscription.
TLS inspection
If your network performs TLS interception, ensure the domains above are handled correctly. Certificate pinning is not used, but inspection appliances that modify CORS headers or issue redirects on preflight requests will break the application.
Account verification, password resets and expiry notifications are sent from notify.conformiq.co.uk (for example reminders@notify.conformiq.co.uk), with replies going to hello@conformiq.co.uk. Please ensure this sender is not filtered as spam, as new users cannot activate their account without receiving the verification email.
Security and data
- All traffic is encrypted in transit using TLS
- All application data is hosted within the EU/UK on cloud infrastructure operated by Supabase (AWS). Specific region details are available on request for procurement and due diligence purposes.
- Authentication is email and password with session tokens; no credentials are stored in the browser in plain text
- Uploaded certificates and documents are stored in access-controlled cloud storage, restricted per organisation
- Card data is handled entirely by Stripe and never reaches Conformiq's systems
Support
If Conformiq is unreachable on your network after applying the rules above, contact hello@conformiq.co.uk. Where possible, please include:
- A HAR file from the browser's network tab during a failed sign-in
- The name of the filtering or proxy product in use
- Any block page or category reported by that product
We can usually identify the cause from the HAR file alone.