Depending on your company's security policy (firewall and proxy), you may need to configure allowlist settings for communication to use Dive. If Dive does not work properly, please review the requirements below and submit a request to your IT department.
Communication requirements
● Direction: Communication is outbound only, from devices inside your company to external servers. No inbound ports need to be opened, and we never connect from our side to your network.
● Encryption: Communication is encrypted with TLS.
● Protocol: Normal use requires only TCP (HTTP/HTTPS). UDP is used in addition to TCP only when you use the remote support (video call) feature.
Domains that need to be allowed
The domains marked "Required" below are connections needed to use Dive. Others are needed only if you use the related feature. If you do not use a feature, you do not need to set up allowlist settings for it.
Required
| Domain | Reason |
|---|---|
| *.divedx.com | Dive's app itself, video and image delivery, the Help Center, and notifications are served from several subdomains of divedx.com. We recommend registering the wildcard. |
| *.googleapis.com | Media data (videos and images), the database, and account authentication use Google's Firebase APIs. |
| *.asia-southeast1.firebasedatabase.app | Real-time database sync uses Google's Firebase. The connection automatically switches to a different host within the same domain, so this must be registered as a wildcard. |
| apis.google.com interactive-supporter-210107.firebaseapp.com |
On smartphones and tablets (iOS and Android, both in the browser and the Dive app) and on Safari on Mac, the login system (Google's Firebase) connects at startup. If these are blocked, startup and login may take longer. |
● If you cannot register *.divedx.com as a wildcard, please register the following domains individually instead. Dive may add subdomains as features are added, and more are expected in the future. (In October 2026, dav.divedx.com was added as a connection for "Edit on desktop".) If you register domains individually, you will need to submit a new request each time a subdomain is added. Until then, the related features, the Help Center, and notifications may not open. Please register *.divedx.com whenever possible.
- app.divedx.com (main app)
- cdn.divedx.com (video and image delivery)
- help.divedx.com (Help Center and maintenance notices. This is the destination of the "Help Center" and "Notifications" buttons at the top of the app.)
● If you cannot register *.googleapis.com as a wildcard, please register the following domains individually instead.
- firestore.googleapis.com (database)
- www.googleapis.com (account authentication)
- identitytoolkit.googleapis.com (login and account management)
- securetoken.googleapis.com (keeping login sessions active)
- storage.googleapis.com (uploading files such as videos and images)
● cdn.divedx.com is the connection used to deliver videos and images. It has been used by all teams since September 29, 2026. If you have registered *.divedx.com, no separate setting is needed. If you have registered individual domains, please add cdn.divedx.com. In environments that cannot connect to it, videos and images will not be displayed.
Required depending on the features you use
| Feature you use | Domain | Reason |
|---|---|---|
| When using SSO (SAML / Microsoft Entra ID) | interactive-supporter-210107.firebaseapp.com | Used to pass the single sign-on authentication screen. Because it is included in "Required," no separate setting is needed. |
| When using Microsoft 365 (SharePoint / OneDrive) integration | graph.microsoft.com | Used by the Microsoft Graph API to list files, import them ("Taken in"), and write them back. |
| When using "Edit on desktop" (Word, Excel, and PowerPoint on Windows) | dav.divedx.com | Office apps on Windows connect directly to open and save documents saved to Dive. If you have registered *.divedx.com, no separate setting is needed. |
| When using Google Drive integration | accounts.google.com apis.google.com docs.google.com www.googleapis.com docs.googleapis.com sheets.googleapis.com slides.googleapis.com |
Used by the Google Drive, Google Docs, Sheets, and Slides APIs to connect your Google account, show the file picker, import files ("Taken in"), and add links to Steps. If you have registered *.googleapis.com, the four googleapis.com domains (www, docs, sheets, and slides) do not need separate settings. apis.google.com is included in "Required." |
| When using Alignment AR SOPs | arcore.googleapis.com visualpositioning.googleapis.com |
Uses Google's alignment technology APIs. |
| api.immersal.com | When you use Spatial recognition (Immersal), the Dive app on field devices uses this domain to get maps and perform alignment. | |
| When using Remote support (video calls) | *.agora.io *.edge.agora.io *.sd-rtn.com *.edge.sd-rtn.com *.ap.sd-rtn.com *.statscollector.sd-rtn.com *.webrtc-cloud-proxy.sd-rtn.com *.rtnsvc.com *.edge.rtnsvc.com *.rtesvc.com *.edge.rtesvc.com |
Agora is used as the WebRTC service. For the required ports, see "Ports required for remote support" below. |
| *.mapbox.com | The Mapbox service is used to show support requests on a map. If it is blocked, the supporter cannot see where a request was made. |
● The identity provider domain for your company (for example, login.microsoftonline.com or *.okta.com) used for SSO or Microsoft 365 integration, and your SharePoint domains (yourcompany.sharepoint.com and yourcompany-my.sharepoint.com), are usually already allowed in environments that already use those services. In most cases no additional setup is needed, but if you cannot connect, please check these as well.
● If you have registered *.googleapis.com as described above, arcore.googleapis.com / visualpositioning.googleapis.com for Alignment AR SOPs do not need separate settings.
● Note: Google Fonts (fonts.googleapis.com / fonts.gstatic.com) is used to display fonts on screen. If it is blocked, Dive will still work normally, but the fonts shown will change.
Receiving email
Emails from Dive are sent from the address below. If you restrict incoming email, please allow email from this address.
- no-reply@episotech.com
Ports required for remote support
Required only if you use remote support (video calls). Voice and video primarily use UDP.
● Supporter side (web browser on a PC)
The allowed targets published by the provider are as follows.
TCP: 80, 443, 3433, 3478, 4700-5000, 5668, 5669, 6080, 6443, 8667, 9667, 30011-30013
UDP: 3478, 4700-5000
● Field side (Dive app on smartphones and smart glasses)
The app connects to the same relay network as the supporter side (the same domain group listed in the table above), so please submit the same allow settings as above first.
However, for the SDK built into the app, the provider does not publish an allowlist method, and for environments with strict traffic restrictions, it recommends the dedicated proxy method described below. For this reason, in environments with strict filtering, connection may not work with only the allow settings above.
● About IP address restrictions: Relay node IP addresses are not fixed, so the provider recommends allowing by domain and port rather than restricting by IP address.
If UDP cannot be allowed
For environments with strict traffic restrictions, the provider offers a proxy method that limits communication to TCP/TLS 443 only and passes it through an IP address allowlist. However, this method is not enabled in the current Dive app. In environments where UDP is blocked entirely, individual verification, including whether this method can be applied, is required.
Other items to check
If remote support does not connect, the following may be the cause.
● All outbound UDP traffic is blocked
● All traffic is forced through a proxy
● The domains above are subject to TLS inspection (SSL decryption)
Updated October 19, 2026: apis.google.com and interactive-supporter-210107.firebaseapp.com were added to "Required," since the login system connects to them at startup on smartphones, tablets, and Mac Safari.
Updated October 19, 2026: Clarified that videos and images will not be displayed in environments that cannot connect to cdn.divedx.com. Removed firebasestorage.googleapis.com from the list of domains to register individually (videos and images are delivered from cdn.divedx.com).
Updated October 15, 2026: Added dav.divedx.com as a connection for using "Edit on desktop." Added a note to the explanation for individual registration that more subdomains are expected to be added.
Updated September 24, 2026: Reorganized the page to recommend registering *.divedx.com. Added help.divedx.com to the list for individual registration. Added the email sender address.
Updated September 22, 2026: Added cdn.divedx.com as the destination for video and image delivery.
Updated August 31, 2026: Added Microsoft 365 (SharePoint / OneDrive) integration, the SSO identity provider, Spatial recognition (Immersal), and Google Fonts. The table was also split into "Required" and "By feature," and reorganized to recommend registering *.googleapis.com.
Updated July 31, 2026: Updated the domains and ports for remote support (video calls) to the latest official information from the provider. Added Cloud Run, SSO, and map entries.
Updated April 25, 2026: Added firestore.googleapis.com.