IT and network requirements
Everything your IT team needs in order to let Planther work on a managed or filtered network. This page is written to be sent on as-is.
The short version
- Allow the domains below over HTTPS on port 443. Planther uses no other ports.
- Do not buffer streamed responses, or Planther's answers will look frozen. See streamed responses.
- Let verification emails through, and be careful with automatic link scanning. See email.
- There is nothing to install and no inbound firewall rule to add.
Domains to allow
The full list, ready to paste into a filter or proxy configuration. Each one is explained underneath.
planther.co.uk
europe-west2-chatppc-planning.cloudfunctions.net
identitytoolkit.googleapis.com
securetoken.googleapis.com
firestore.googleapis.com
firebasestorage.googleapis.com
storage.googleapis.com
chatppc-planning.firebaseapp.com
maps.googleapis.com
maps.gstatic.com
mqyjfdusykkmbmouosyr.supabase.co
document-writer-agent-833426465129.europe-west2.run.app
eu.i.posthog.com
mcp.planther.co.ukRequired
Planther will not work at all if any of these is blocked.
| Domain | What it is for |
|---|---|
planther.co.uk | The Planther app itself. |
europe-west2-chatppc-planning.cloudfunctions.net | Planther's backend. Chat, site reports, searches and everything else the app asks for. |
identitytoolkit.googleapis.com | Signing in and creating accounts. |
securetoken.googleapis.com | Keeping people signed in. Blocked, users are logged out roughly every hour. |
firestore.googleapis.com | Chats, projects and documents. |
firebasestorage.googleapis.com | Uploading files to a project. |
storage.googleapis.com | Downloading files and exported documents. |
chatppc-planning.firebaseapp.com | The link inside verification and password reset emails. Needed to activate a new account. |
Required for specific features
The app still loads, but the feature named beside each one will not work.
| Domain | What it is for |
|---|---|
maps.googleapis.com | Maps, on the map view and inside site reports. |
maps.gstatic.com | Map images and icons. |
mqyjfdusykkmbmouosyr.supabase.co | Authority and boundary lookups used by the map search. |
document-writer-agent-833426465129.europe-west2.run.app | The document writer. |
Optional
Blocking these is fine. Nothing a planner uses day to day depends on them.
| Domain | What it is for |
|---|---|
eu.i.posthog.com | Anonymous usage statistics. Safe to block - Planther works normally without it, and fails quietly. |
mcp.planther.co.uk | Only needed if your staff connect Planther to an outside AI assistant such as Claude or ChatGPT. |
Streamed responses
Planther writes its answers out as they are produced, using server-sent events (text/event-stream). Two common settings interfere with that.
Response buffering
If a proxy or web filter buffers the response, the user sees nothing at all for up to a minute and then the whole answer lands at once. It reads as a broken app rather than a slow one. Please exclude text/event-stream responses from the domains above from any buffering or content-inspection rewrite.
Idle connection timeouts
A single request can legitimately be quiet for a while when Planther is researching before it answers. Planther sends a keepalive every 15 seconds to hold the connection open, so any idle timeout of 60 seconds or more is fine.
Planther sends account emails from noreply@planther.co.uk. SPF, DKIM and DMARC are all configured, so normal filtering should accept them.
One thing to check: automatic link scanning
Every new user has to click a verification link before they can sign in. That link points at chatppc-planning.firebaseapp.com rather than planther.co.uk. It is a Google Firebase address and it is genuine.
The link can only be used once. If your mail security opens or "detonates" links before the recipient does, it can use the link up, and the user is then told it is invalid or expired. If you see that, either exclude that domain from link rewriting and scanning, or ask the user to request a fresh link. We can also verify an account by hand if you get stuck.
What Planther does not need
Nothing to install
Planther runs entirely in the browser. No software, no browser extension, no plug-in, and no admin rights on the machine.
No inbound rules
Planther never connects to your network. Every connection is outbound from the browser, over HTTPS on port 443.
No WebSockets
Planther uses ordinary HTTPS requests only, so proxies that block WebSockets are not a problem.
No bot-detection challenge
Planther deliberately does not use reCAPTCHA or a similar attestation check. We removed ours because it blocked real users on managed and filtered networks.
Browsers
Current versions of Chrome, Edge, Firefox and Safari. JavaScript must be enabled, and the browser needs to keep cookies and local storage for planther.co.uk in order to keep someone signed in.
Opening a file attached to a project opens it in a new tab. If pop-ups are blocked by policy, please allow them for planther.co.uk.
Where data is handled
The Planther application, its database and its file storage all run in Google Cloud's London region (europe-west2).
Some of the providers we rely on operate outside the UK, most notably the AI models that power Planther's features. Our privacy policy sets out who those providers are and the safeguards used for international transfers.
Checking it worked
Once the domains are allowed, ask someone to run through these four things. Between them they cover every requirement on this page.
- Sign in.
- Send a chat message and watch the answer appear a few words at a time. If it sits still and then arrives all at once, responses are being buffered.
- Open the Map page and confirm the map draws.
- Open a file attached to a project, which should open in a new tab.
Something still blocked?
Tell us what you are seeing and we will work it out with you. We would rather hear about it than have someone quietly unable to use Planther.
Contact us