Licensed to be used in conjunction with basebox, only.
// installation
Network connectivity
Applies to
Product: Cloud · Audience: IT / network · Administrator · Security reviewer
How users reach basebox Cloud, how the Cloud reaches your systems (connectors, mail, directory) and which IP/egress aspects to consider. The decisive difference from a server in your own network: connections to your systems come from the Noris data center – i.e. from outside into your network.
Users → basebox Cloud
- HTTPS (443) to
https://<your-organisation>.basebox.ai, from anywhere with an internet connection. - Sign-in via your organisation's Keycloak realm; with SSO, redirection to your identity provider.
- API clients use
https://aims.basebox.aiwith API key andX-Realm(your organisation's subdomain). - Users never talk directly to inference, service models or connectors – only to the platform.
If you want to restrict access to your company network, that happens on your side (proxy, zero-trust gateway, allowlist at the perimeter). Restricting the Cloud to specific source IPs of your organisation is something to request from basebox.
basebox Cloud → your systems
These paths only arise if you set up the respective integration:
| Integration | Direction | Port | What you have to allow |
|---|---|---|---|
| Connectors (wiki, tickets, IMAP, business systems) | Cloud → your system | system-specific, mostly 443; IMAP 993 | Inbound rule for the Cloud's egress addresses to the target system |
| SMTP | Cloud → your mail server | 587 / 465 | Inbound rule; alternatively an internet-facing relay |
| LDAP / Active Directory | Cloud → your directory | 389 / 636 | Inbound rule – in practice usually undesirable; prefer OIDC |
| OIDC provider | Cloud → provider; browser → provider | 443 | Nothing, if the provider is publicly reachable |
| Web search | Cloud → search provider | 443 | Nothing on your side; basebox restricts the connector to the provider hosts |
Egress addresses. For firewall approvals you need the fixed addresses the Cloud speaks from outbound. basebox provides them for your environment.
Principle: allow exactly one path per integration – from the Cloud's egress addresses to the target system on the required port. In the Cloud, the connector itself reaches only its declared target system anyway (egress allowlist at the MCP gateway).
Private connectivity
For organisations that do not allow any exposure from the internet into their network, private connections are an option – for example a site-to-site VPN between the Noris data center and your network. Whether and in what form that is possible for your environment is clarified with basebox.
If private connectivity is not possible and no inbound paths may be opened, these paths remain in the Cloud:
- Identity via OIDC instead of LDAP – needs no path into your directory.
- Mail via an internet-facing relay of your organisation.
- Connectors only to systems reachable from the internet (e.g. SaaS ticket systems, hosted MCP servers such as YouTrack).
- For purely internal business systems, basebox Server in your own network is the appropriate path.
What the Cloud sends outwards
In normal operation, chats and documents do not leave your environment; the language model runs on the same server (Infrastructure). Deliberate exceptions:
- Web search – the search query goes to the configured provider, without user identity and user IP; off by default, consent before the first search.
- Connectors – requests to your own systems with the respective person's credentials.
- Mail – invitations and notifications to your mail server.
In full: Data flows · External services.
Checklist for your network team
- Outbound 443 from user devices to
<org>.basebox.aiallowed (and to the OIDC provider, if SSO) - Cloud egress addresses received from basebox
- One inbound rule per connector: Cloud egress → target system → port
- SMTP path or relay decided
- Identity model decided (OIDC recommended; LDAP only with private connectivity)
- TLS certificates of your target systems from a public CA – or private CA agreed with basebox
- Private connectivity clarified, if required
Next step: Enterprise integration (Cloud)