Every connection
Each connection an install makes, which way it goes, what crosses it and when, and the connections it never makes.
Updated 2026-10-18
Every connection an install makes is listed here, and nothing else crosses the edge of your tenant. The network rules in your subscription allow these destinations and refuse the rest, so the list is enforced by your own network, not only by the code.
Connections it makes
| Connection | Direction | What crosses it | When |
|---|---|---|---|
| Your team | Inbound HTTPS, behind your Entra sign-in | The work itself | While in use |
| Encompass | Outbound, with your API key and service user | The loan file and documents in; the income, the structure, the result PDF and the officer’s tasks back | Each loan |
| Arive | Outbound, with your keys | The loan file and documents in; the result back into the loan | Each loan |
| DU and LP | Outbound, through your Encompass or your lender’s portal, with your credentials | The loan as submitted, and its findings | Each AUS run |
| Lender portals | Outbound, with your credentials | Submission and conditions | When a loan is submitted |
| Microsoft Teams | Outbound, only if you connect it | The leadership view, with a reference to each result | When you use it |
| Microsoft Entra ID | Outbound | Microsoft’s public signing keys, to check each sign-in | When the install starts, and when Microsoft changes its keys |
| Proxara’s release registry | Outbound, pull only | Signed releases of the application, the model and the rules. Nothing is sent back. | Rules hourly; updates when you choose |
| Virus signatures | Outbound, from ClamAV’s mirror | Signature updates for the file scanner | When the install starts, then daily |
Connections it never makes
| Connection | What crosses it |
|---|---|
| Telemetry to Proxara | Nothing. No analytics, crash reports or usage counts. |
| A heartbeat | Nothing, unless your IT switches one on. It then carries versions and health, never borrower data. |
| Support access | None, standing or temporary. A diagnostics bundle reaches Proxara only if your IT sends it. |
| An outside model service | None. The model runs on your GPU and has no route out. |
| Anyone not listed above | Nothing. The network refuses it. |
How your team can check
- Before it runs: the install is declared as code. Ask for the Bicep templates and read every resource and network rule before anything is created.
- After it runs: the network rules, the log of every outbound call and the role assignments are all in your subscription. Confirm that no identity outside your tenant holds a role.
- Over time: the outbound log stays in your tenant, so your own monitoring sees any call the list doesn’t explain.