Network requirements

Quick summary

Construkta is a browser-based application. There is nothing to install, no agent, and no inbound connection to your network. All traffic is outbound HTTPS initiated by the user's browser.

Allow outbound HTTPS (TCP 443) to the domains listed below, and allow WebSocket connections (WSS) to the application backend. No inbound rules, VPN, or firewall exceptions are required.

Required domains

Application

Application backend

Construkta's database, authentication, file storage and server functions are hosted on Supabase infrastructure.

The application domain and the backend domain are separate. Allowing construkta.co.uk does not allow the backend. The browser calls the Supabase host below directly on every page, and that is the host that filtering products (Cisco Umbrella in particular) have blocked on customer networks. It must be allowed explicitly, in its own right.

This is the critical one. If this domain is blocked, users cannot sign in and the application will not function at all. WebSocket connections to this host must also be permitted for live updates.

Some filtering products categorise supabase.co generically as a cloud or developer platform. Cisco Umbrella DNS filtering has blocked this host on a customer network, which stops sign-in completely while the application domain itself resolves normally. If your policy blocks that category, this domain needs an explicit allow rule — allowing the application domain alone will not fix it.

Payments

Card details are entered directly into Stripe-hosted fields and are never handled by Construkta's servers. Construkta is not in scope for cardholder data.

Required only for account setup, subscription management and billing. Day-to-day use of the application does not depend on these.

Mapping

Used to pin and display equipment locations on site.

If these are blocked, the application still works — location maps will not render.

Not required from the browser

Construkta's server-side functions call ai.gateway.lovable.dev (photo and certificate reading) and connector-gateway.lovable.dev (payments) from our servers, not from the user's browser. These do not need to be allowed on your network.

Protocol requirements

• TCP 443 (HTTPS) outbound to all domains listed above
• WebSocket (WSS) to heyowywktpzpeyhvehbz.supabase.co for live data updates
• TLS 1.2 or higher
• No inbound connections required
• No static IP allowlisting required or supported — these are cloud services with rotating IP ranges, so allow rules must be domain-based

Browser requirements

Construkta runs in any current browser: Chrome, Edge, Safari or Firefox, desktop and mobile.

The application is a Progressive Web App and can be installed to a device home screen. It caches data locally so site staff can view equipment records and certificates without a signal. This uses standard browser storage — no device management changes are needed.

Known issues on filtered networks

Symptom: "Failed to fetch" on sign-in

Users cannot log in. The browser console shows a CORS error, and the network tab shows a failed preflight (OPTIONS request) with ERR_INVALID_REDIRECT.

Cause: a DNS or web filtering appliance is intercepting requests to the backend domain and returning a redirect. Browsers do not follow redirects on CORS preflight requests, so the request fails before it reaches our servers.

Fix: add heyowywktpzpeyhvehbz.supabase.co to your allow list. The filtering product must pass these requests through without redirection or interception.

To confirm this is the cause: ask the user to try the application on a mobile connection. If it works there but not on the corporate network, the block is at the network layer.

Symptom: maps do not load, everything else works

maps.googleapis.com or maps.gstatic.com is blocked. Not critical — the rest of the application is unaffected.

Symptom: cannot complete signup or payment

Stripe domains are blocked. Users can sign in but cannot start or manage a subscription.

TLS inspection

If your network performs TLS interception, ensure the domains above are handled correctly. Certificate pinning is not used, but inspection appliances that modify CORS headers or issue redirects on preflight requests will break the application.

Email

Account verification, password resets, invites and expiry notifications are sent with a visible From address of info@construkta.co.uk (display name Construkta), signed by the delegated sending subdomain notify.construkta.co.uk. Replies go to the same monitored mailbox, info@construkta.co.uk. Please ensure this sender is not filtered as spam, as new users cannot activate their account without receiving the verification email.

SPF, DKIM and DMARC alignment

• Mailbox mail from info@construkta.co.uk is sent and signed by Google Workspace as construkta.co.uk.
• Application mail is signed by Lovable Emails as notify.construkta.co.uk with a visible From at the apex.
• Both pass DMARC under relaxed alignment. The apex DMARC record must keep adkim=r and aspf=r.
• Warning: tightening either to strict (adkim=s or aspf=s) breaks all application mail, including account verification and password resets.

Security and data

• All traffic is encrypted in transit using TLS
• All application data is hosted in the eu-west-2 (London) region on cloud infrastructure operated by Supabase (AWS)
• Authentication is email and password with session tokens; no credentials are stored in the browser in plain text
• Uploaded certificates and documents are stored in access-controlled cloud storage, restricted per organisation
• Card data is handled entirely by Stripe and never reaches Construkta's systems

Support

If Construkta is unreachable on your network after applying the rules above, contact info@construkta.co.uk. Where possible, please include:

• A HAR file from the browser's network tab during a failed sign-in
• The name of the filtering or proxy product in use
• Any block page or category reported by that product

We can usually identify the cause from the HAR file alone.