Network and firewall requirements
In Cloud mode the daemon reaches a small, fixed set of vendor-owned outbound destinations; in Private mode it makes no analysis calls. This is the complete list.
Egress allowlist
| Domain | Purpose | Mode |
|---|---|---|
update.poisonzero.com | Control plane and backend API: enrollment, sign-in and token refresh, policy retrieval, evaluation, audit reporting, and the license check-in | Cloud + Private |
cdn.poisonzero.com | Auth-gated, SHA-256-pinned download of the inference engine and detection model | Enterprise on-device only |
4df093c3e409bb815ddaa9bc13b5abc9.eu.r2.cloudflarestorage.com | Where those engine and model downloads actually land: cdn.poisonzero.com authenticates the request, then redirects to this storage host with a short-lived signed link. Allowlisting it grants no standing access - without a valid, unexpired signature the host returns nothing. | Enterprise on-device only |
poisonzero.com and dl.poison0.com | Installer, daemon binaries and updates: poisonzero.com serves the version file and the SHA256SUMS trust anchors and redirects the binary downloads themselves to dl.poison0.com | Install + updates |
console.poisonzero.com, or <slug>.poison0.com for an isolated Enterprise instance | Per-tenant console, opened in the admin browser, never by the daemon | Admin browser only |
All connections are outbound HTTPS on TCP 443; the daemon opens no inbound listener, so no firewall ingress rule is needed.
Private mode makes no analysis calls: memory content never leaves the machine. The only recurring outbound is a periodic license check-in, carrying credentials and version only, never content.
Read next
The on-device engine that keeps content local runs in a kernel-enforced sandbox; the whole protection is fail-closed.