Skip to main content
With the SaaS deployment, Kvelden operates the servers, TLS, mail, and infrastructure. Your network configuration is therefore almost entirely outbound — your users reach Enclave over HTTPS. A few optional integrations (bring-your-own-key, SSO, webhooks) add connectivity between your systems and Kvelden’s platform.
How to read the Direction column.
  • Outbound — a connection your users or systems initiate to Kvelden. Open it from your network toward Kvelden.
  • Inbound (to your systems) — a connection Kvelden’s platform initiates to something you host (your KMS, your webhook receiver). Allow it from Kvelden’s published egress addresses.

​
Baseline — all you need for standard use

File content is presigned and browser-direct. When you bring your own object storage, uploads and downloads go straight from the user’s browser to your storage endpoint — so that host (and its port, 443 or a custom one) must be reachable outbound from your users, not only from Kvelden. With Kvelden-managed storage, no extra egress is needed beyond *.kvelden.com.
No inbound ports need to be opened on your network for standard SaaS use — all user traffic is outbound 443. If your organisation filters egress by domain, allow *.kvelden.com (and your storage endpoint if you bring your own).

​
Optional integrations

​
Bring-your-own-key (BYOK / HYOK)

If you keep the master key in your own KMS/HSM, Kvelden’s platform reaches it to wrap and unwrap data-encryption keys. Allow the relevant connection from Kvelden’s published egress addresses to your key service.
For a self-hosted HSM/KMIP endpoint, expose it to Kvelden over a private interconnect (VPN or cloud private link) rather than the public internet where possible. Kvelden provides the source egress ranges to allowlist. Contact your account team to arrange private connectivity.

​
Single sign-on (SSO)

SAML and OIDC sign-in is browser-mediated — your users are redirected to your identity provider over 443 and back. For OIDC, Kvelden additionally fetches token and JWKS metadata server-to-IdP.

​
Webhooks

Kvelden delivers events to receivers you configure — allow inbound HTTPS to your endpoint from Kvelden’s egress addresses.

​
Comparison with the appliance

If you also run the on-premise appliance, its port requirements are broader (it makes its own outbound calls to KMS, storage, mail, DNS, and NTP, and a cluster adds inter-node ports). See Appliance — Network Ports & Firewall.

​
Next steps

SaaS Deployment

What Kvelden manages and what you control.

Storage

Kvelden-managed or bring-your-own object storage.

Key Management

BYOK/HYOK — the 443 / 5696 connectivity above.

Set up SSO

Connect your identity provider.