Security
Network access & data egress
Every host SysClaw is permitted to reach, why it needs it, and how to check for yourself. This page is generated from the same allow-list the product enforces at runtime.
Hosts SysClaw never contacts
SysClaw does not contact any SysClaw-owned infrastructure. There is no telemetry endpoint, no analytics beacon, no crash reporting, and no licence phone-home — an activated licence is validated locally and the application continues to work with no outbound connection to us at all. Your tenant data is collected to your machine and stays there.
How the allow-list is enforced
The list below is not documentation written after the fact — it is a configuration file the product reads on startup, and it is enforced in two places:
- At startup. Every host named by a loaded API definition is resolved against the allow-list. In production an unregistered host stops the application from starting rather than being quietly permitted.
- At call time. Every outbound request — and every redirect hop — is checked against the fully resolved URL, deny by default. A refused call is written to a local outbound audit log, so denials are evidence rather than silence.
Adding a host is therefore a single, reviewable change to one file — not a code change that could widen the product's reach unnoticed.
External destinations
Allow these hosts outbound on 443 for the capabilities you intend to use.
| Host | Need | Why |
|---|---|---|
| graph.microsoft.com | Required | Microsoft Graph API — primary data source for SysClaw |
| manage.office.com | Required | Office 365 Management Activity API — audit log ingestion |
| manage-gcc.office.com | Gov cloud | Office 365 Management Activity API — GCC government cloud audit log ingestion |
| manage.office365.us | Gov cloud | Office 365 Management Activity API — GCC High (DoD) government cloud audit log ingestion |
| manage.protection.apps.mil | Gov cloud | Office 365 Management Activity API — DoD IL5 government cloud audit log ingestion |
| outlook.office365.com | Required | Exchange Online admin API — mailbox and audit data |
| api.fabric.microsoft.com | Optional | Microsoft Fabric API — analytics and Power BI |
| api.notion.com | Optional | Notion API — connector for Notion workspace data ingestion |
| cloudflare-dns.com | Optional | Cloudflare DNS — DNS resolution for outbound calls |
| check.torproject.org | Optional | Tor Project exit-node bulk list — alerting reputation feed |
| download.maxmind.com | Optional | MaxMind GeoLite2 download endpoint — GeoIP database auto-update flow |
| mm-prod-geoip-databases.a2649acb697e2c09b632799562c076f2.r2.cloudflarestorage.com | Optional | MaxMind Cloudflare R2 CDN — redirect target for GeoLite2 database downloads (presigned URLs since Jan 2024) |
| download.db-ip.com | Optional | DB-IP Lite download endpoint — default GeoIP database auto-update flow (free CC-BY mmdb, no credentials) |
| ip-api.com | Optional | ip-api.com — GeoIP lookup tool for IP geolocation (free tier, no key required) |
| haveibeenpwned.com | Optional | Have I Been Pwned API — breach exposure lookup for tenant users |
| pwpush.com | Optional | PasswordPusher cloud — expiring secure links for credential handoff |
Loopback only
These never leave the machine SysClaw runs on.
localhost:8443
PowerShell Gateway — local connector for Teams/SPO/Purview cmdlets
Verify it yourself
Do not take our word for it — this is a claim you can test in an afternoon:
-
Read the allow-list shipped inside your own install:
egress-destinations.yaml - Put SysClaw behind an inspecting proxy (Fiddler, mitmproxy, Burp) and watch every request it makes.
- Run a packet capture (Wireshark,
tcpdump) during a full collection and compare the destinations against this table. - Block everything except the required hosts and confirm the product still does what you need.
Found something on the wire that is not on this list? Tell us — that is a security bug and we will treat it as one.
Government cloud
SysClaw supports the GCC, GCC High and DoD audit endpoints alongside commercial Microsoft 365. Only the endpoint matching your tenant's cloud needs to be allowed.