> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Ports & Firewall

> What to open on your network to use Kvelden-hosted Enclave — outbound HTTPS for users, plus the connectivity needed for BYOK/HYOK, SSO, and webhooks.

With the SaaS deployment, Kvelden operates the servers, TLS, mail, and infrastructure. Your network configuration is therefore almost entirely **outbound** — your users reach Enclave over HTTPS. A few optional integrations (bring-your-own-key, SSO, webhooks) add connectivity between **your** systems and Kvelden's platform.

<Info>
  **How to read the Direction column.**

  * **Outbound** — a connection your users or systems initiate *to* Kvelden. Open it from your network toward Kvelden.
  * **Inbound (to your systems)** — a connection Kvelden's platform initiates *to* something you host (your KMS, your webhook receiver). Allow it from Kvelden's published egress addresses.
</Info>

## Baseline — all you need for standard use

| Port  | Protocol | Direction | Source → Destination                         | Purpose                                                      | Required       |
| ----- | -------- | --------- | -------------------------------------------- | ------------------------------------------------------------ | -------------- |
| `443` | TCP      | Outbound  | Users' browsers → Enclave (`*.kvelden.com`)  | The Enclave web app and API                                  | **Yes**        |
| `443` | TCP      | Outbound  | Users' browsers → your S3-compatible storage | Presigned, browser-direct file upload/download (BYO storage) | If BYO storage |

<Note>
  **File content is presigned and browser-direct.** When you bring your own object
  storage, uploads and downloads go straight from the **user's browser** to your
  storage endpoint — so that host (and its port, `443` or a custom one) must be
  reachable outbound from your users, not only from Kvelden. With Kvelden-managed
  storage, no extra egress is needed beyond `*.kvelden.com`.
</Note>

<Note>
  No **inbound** ports need to be opened on your network for standard SaaS use — all
  user traffic is outbound `443`. If your organisation filters egress by domain,
  allow `*.kvelden.com` (and your storage endpoint if you bring your own).
</Note>

## Optional integrations

### Bring-your-own-key (BYOK / HYOK)

If you keep the master key in your own KMS/HSM, Kvelden's platform reaches it to wrap and unwrap data-encryption keys. Allow the relevant connection **from Kvelden's published egress addresses** to your key service.

| Port   | Protocol | Direction                 | Destination                                                      | Purpose                  |
| ------ | -------- | ------------------------- | ---------------------------------------------------------------- | ------------------------ |
| `443`  | TCP      | Inbound (to your systems) | Your cloud KMS (e.g. AWS KMS) via IAM role / cross-account trust | Envelope key wrapping    |
| `5696` | TCP      | Inbound (to your systems) | Your Thales CipherTrust Manager (KMIP)                           | KMIP key wrapping (HYOK) |

<Note>
  For a self-hosted HSM/KMIP endpoint, expose it to Kvelden over a private
  interconnect (VPN or cloud private link) rather than the public internet where
  possible. Kvelden provides the source egress ranges to allowlist. Contact your
  account team to arrange private connectivity.
</Note>

### Single sign-on (SSO)

SAML and OIDC sign-in is browser-mediated — your users are redirected to your identity provider over `443` and back. For OIDC, Kvelden additionally fetches token and JWKS metadata server-to-IdP.

| Port  | Protocol | Direction                 | Endpoint                        | Purpose                                              |
| ----- | -------- | ------------------------- | ------------------------------- | ---------------------------------------------------- |
| `443` | TCP      | Outbound                  | Users' browsers → your IdP      | SAML/OIDC redirect and assertion                     |
| `443` | TCP      | Inbound (to your systems) | Your IdP's token/JWKS endpoints | OIDC token exchange and key discovery (from Kvelden) |

### Webhooks

Kvelden delivers events to receivers you configure — allow inbound HTTPS to your endpoint from Kvelden's egress addresses.

| Port              | Protocol | Direction                 | Destination           | Purpose                                  |
| ----------------- | -------- | ------------------------- | --------------------- | ---------------------------------------- |
| `443` (or custom) | TCP      | Inbound (to your systems) | Your webhook receiver | Event delivery from the Enclave platform |

## Comparison with the appliance

If you also run the on-premise appliance, its port requirements are broader (it makes its own outbound calls to KMS, storage, mail, DNS, and NTP, and a cluster adds inter-node ports). See [Appliance — Network Ports & Firewall](/enclave/appliance/ports).

## Next steps

<CardGroup cols={2}>
  <Card title="SaaS Deployment" icon="cloud" href="/enclave/saas/overview">
    What Kvelden manages and what you control.
  </Card>

  <Card title="Storage" icon="database" href="/enclave/saas/storage">
    Kvelden-managed or bring-your-own object storage.
  </Card>

  <Card title="Key Management" icon="key" href="/enclave/platform/key-management">
    BYOK/HYOK — the `443` / `5696` connectivity above.
  </Card>

  <Card title="Set up SSO" icon="user-lock" href="/enclave/organization/authentication">
    Connect your identity provider.
  </Card>
</CardGroup>