Depending on your internal Security policies (firewall or proxy), you may need to configure communication permissions to use Dive. If the app is not working properly, please refer to the requirements below and submit an Application to your IT department.
Communication Prerequisites
● Communication direction: Only outbound traffic from internal devices to external services is required. Inbound port opening is not needed, and Episotech Ltd. will not connect to your network.
● Encryption: All communication is encrypted with TLS.
● Protocol: Normal operation uses TCP (HTTP/HTTPS) only. UDP is used in addition to TCP only when using the Remote support (video call) feature.
Domains Requiring Allowlist Permission
Among the domains listed below, "Required" domains are necessary for using Dive. The others are only required if you use the corresponding feature. If you do not use a feature, you do not need to configure permission for its domains.
Required
| Domain | Reason |
|---|---|
| app.divedx.com | Main server |
| *.googleapis.com | We use Google's Firebase API for Media data (videos and images), databases, and account authentication |
| *.asia-southeast1.firebasedatabase.app | We use Google's Firebase for real-time database synchronization. Because the connection automatically switches to a different host within the same domain, you need to register with a wildcard |
● If you cannot register *.googleapis.com with a wildcard, register the following domains individually instead:
- firebasestorage.googleapis.com (storing and playing video and image files)
- firestore.googleapis.com (database)
- www.googleapis.com (account authentication)
- identitytoolkit.googleapis.com (Log in and account management)
- securetoken.googleapis.com (maintaining log-in status)
Required Depending on Your Features
| Feature You Use | Domain | Reason |
|---|---|---|
| When using SSO (SAML / Microsoft Entra ID) | interactive-supporter-210107.firebaseapp.com | Used for passing authentication screens for single sign-on |
| When using Microsoft 365 (SharePoint / OneDrive) Integration | graph.microsoft.com | We use Microsoft Graph API for listing, importing, and writing back files |
| When using Alignment AR SOP | arcore.googleapis.com visualpositioning.googleapis.com |
We use Google's alignment technology API |
| api.immersal.com | When using Spatial recognition (Immersal), the Dive app on the field device uses it to retrieve maps and perform Alignment | |
| When using Remote support (video call) | *.agora.io *.edge.agora.io *.sd-rtn.com *.edge.sd-rtn.com *.ap.sd-rtn.com *.statscollector.sd-rtn.com *.webrtc-cloud-proxy.sd-rtn.com *.rtnsvc.com *.edge.rtnsvc.com *.rtesvc.com *.edge.rtesvc.com |
We use Agora as our WebRTC service. For required ports, see "Ports Required for Remote support" below. |
| *.mapbox.com | We use Mapbox service for displaying the map for Support Request. If it is blocked, the support side cannot confirm the location of the request |
● The domains of your ID provider (login.microsoftonline.com, *.okta.com, etc.) and SharePoint domains (xx.sharepoint.com, xx-my.sharepoint.com) that you use with SSO or Microsoft 365 Integration are normally already permitted in environments where you are already using those services. In most cases, no additional configuration is required, but if you cannot connect, please verify these as well.
● If you have registered *.googleapis.com above, individual configuration is not necessary for arcore.googleapis.com and visualpositioning.googleapis.com used for Alignment AR SOP.
● Note: We use Google Fonts (fonts.googleapis.com / fonts.gstatic.com) for displaying fonts on the screen. If they are blocked, the operation of Dive will not be affected, but the displayed font will change.
Ports Required for Remote support
Ports are only required if you use Remote support (video call). Audio and video primarily use UDP.
● Support side (PC Web browser)
The following ports are permitted according to the provider's public information:
TCP: 80, 443, 3433, 3478, 4700-5000, 5668, 5669, 6080, 6443, 8667, 9667, 30011-30013
UDP: 3478, 4700-5000
● Field side (Smartphone or smart glasses Dive app)
The app also connects to the same relay network (same domain group in the table above), so please first submit an Application with the same permission settings as above.
However, the provider does not publish an allowlist method for the SDK embedded in the app and recommends a dedicated proxy method for environments with strict communication restrictions. Therefore, in environments with strict filtering, connection may not be possible with only the above permissions.
● About IP address restrictions: Since relay node IP addresses are not fixed, the provider recommends permission via domain and port rather than by IP address restriction.
When UDP Cannot Be Permitted
The provider offers a proxy method for environments with strict communication restrictions that fixes communication to TCP/TLS 443 only and allows it through an IP address allowlist. However, since the current Dive app does not enable this method, individual verification is required in environments where UDP is completely blocked, including applicability.
Additional Items to Confirm
If Remote support does not connect, it may be due to one of the following:
● Outbound UDP communication is completely prohibited
● All communication is forced through a proxy
● The domains above are included in the Target for TLS Inspection (SSL decryption)
Updated 2026/08/31: Added items for Microsoft 365 (SharePoint / OneDrive) Integration, SSO ID provider, Spatial recognition (Immersal), and Google Fonts. The table was also split into "Required" and "By Feature" and reorganized to recommend registration with *.googleapis.com
Updated 2026/07/31: Updated Remote support (video call) domains and ports to the latest official provider information. Added items for Cloud Run, SSO, and map
Updated 2026/04/25: Added firestore.googleapis.com