Network and Firewall Requirements

Document ID: M17-CERT-001-D8

Audience: Company administrator and IT liaison

Last updated: 2026-10-16

Applies to: Jakten Platform 2.0

1. Summary

Daily work in every Jakten module does not require internet after successful activation, except for licensing validation, updates, support actions that explicitly contact Jakten services, and the optional AI features listed in section 2.1. Those AI features contact licensing.jakten.net while they run. With AI off, no module needs internet for daily work.

2. jakten.net endpoints (activation)

Allow outbound HTTPS (TCP 443) from the machine that performs activation:

During initial commercial rollout, staging hostnames may appear in email links until production promotion is complete.

2.1 Jakten AI features

Jakten's AI features are optional. They run only after a company administrator has turned on Jakten AI for the company. These are the features that contact the internet while they run:

Everything else in each module works offline, including counting an estimate, opening a kept answer, the crosswalk, the unit aliases, the inbox of Quote's risks in Risk, and accepting any suggestion already made.

The machine that runs the feature sends each AI request to licensing.jakten.net over HTTPS (TCP 443). In an office deployment that is the Platform Server; in a single-user deployment it is the workstation. Workstations in an office never contact it for AI.

• No new host or port. It is the same hostname activation already uses. No other outbound host is added, and Jakten forwards the requests to its AI provider itself.
• Uploads. Quote AI requests can carry bid documents up to 32 MB each, and Assurance AI requests the pages of a basis document (from a file of up to 20 MB), so a proxy or inspection device must allow uploads of up to 32 MB to licensing.jakten.net. Risk AI requests carry only text, and Ask Jakten requests only the question and Jakten's own documentation.
• When unreachable. The feature shows that AI is offline and every non-AI feature keeps working.

What these requests contain, and how the provider handles them, is described in the *Jakten AI Data Processing Terms* (https://jakten.net/legal/ai_data_processing/v1.2), which a company administrator accepts before AI can be turned on.

3. Office deployment — LAN connectivity

Workstations must reach the Platform Server on your office network.

3.0 The server's HTTPS certificate

Platform Server encrypts all workstation traffic with HTTPS. The first time it starts it creates its own certificate in a tls folder beside its database (by default C:\ProgramData\Jakten\PlatformServer\data\tls) and writes that certificate's fingerprint to platform-server-certificate-fingerprint.txt in the same folder. The health-check utility prints the same fingerprint.

When a workstation connects for the first time, Jakten shows the fingerprint the server presented. Compare it with the one on the server and confirm only if they match. From then on that workstation accepts only that certificate. If someone on the network presents a different one, Jakten refuses to connect.

The certificate is valid for ten years and is kept across restarts and upgrades. If it is ever replaced, each workstation shows that the certificate changed and asks for the new one to be confirmed.

Your own certificate (optional). To use a certificate from your organization, set tlsMode to provided and tlsCertPath and tlsKeyPath to the PEM certificate and private key in the Platform Server configuration. Workstations confirm that certificate the same way unless it chains to a public certificate authority; a certificate from your own internal authority is confirmed like the generated one. Renewing it means confirming it again on each workstation.

Upgrading an existing office server. A server upgraded to this release switches to HTTPS on the same port. Upgrade Jakten Platform on the workstations too; each one then shows that the server now uses HTTPS and asks you to reconnect with https:// and confirm the certificate in Settings → Connection Settings.

Reverse proxy (optional). If your IT team terminates HTTPS at a proxy in front of Platform Server, set tlsMode to off, set trustedProxies to the proxy's address, and make sure the proxy sends X-Forwarded-For. Do not put a plain port forward (such as netsh interface portproxy) in front of Platform Server: every connection would appear to come from the server itself.

3.1 Windows Firewall (server)

Allow inbound TCP on the Platform Server port from office LAN subnets and from VPN interfaces if remote workers connect securely.

3.2 Remote access (VPN)

If users connect from outside the office, use VPN or a secure private network. Do not expose Platform Server directly to the public internet without IT security review.

4. Ports reference

5. Proxy considerations

If outbound HTTPS uses a corporate proxy, ensure the activating machine can reach licensing.jakten.net. If Jakten AI is turned on, the machine that runs the modules (the Platform Server in an office deployment) must reach it too, with uploads of up to 32 MB allowed.

6. Verification checklist

Related documentation