Network and allowlists

Where Pulse works on one network but not another, or stops working once a corporate VPN, proxy, firewall or web filtering product is enabled, traffic is probably being blocked on the network side. This article brings together what a user can narrow down themselves, and the list of destinations to share with an IT department. It is the general network article that the other troubleshooting articles refer to.

#Running the app's network diagnostics

The Pulse app has a feature that checks in one go whether it can reach the destinations it needs.

1. 1

   Open the diagnostics screen

   Open Settings > Troubleshooting in the app.

2. 2

   Run the check

   Choose Run check under “Network connectivity”.

3. 3

   Read the result

   Where a problem is found, it says which features are affected.

4. 4

   Follow the remedy shown

   Choose whether you manage the machine and network yourself or your company's IT department does, and steps for that situation are shown.

5. 5

   Share the report

   Copy report copies the full diagnostic result to share with your IT department or with support. On a company-managed machine or network, Copy request for IT gives you a request you can send as it stands.

Where several features are failing at once, check Pulse's service status page before changing any network settings. If it is an incident on the service side, no work is needed internally.

#Symptoms that point to the network

Blocking and filtering show up in forms like these.

• Sign-in does not complete, stalls partway, or does not return to the app after authentication
• Transcription does not start, disconnects partway, or keeps reconnecting
• Notes or share links never finish loading
• An AI summary or a chat response stops partway and does not continue
• An uploaded file never finishes sending
• Downloading an update or an installer fails
• It does not work on the office Wi-Fi or VPN, but does work over mobile tethering
• Certificate errors, or a message such as “cannot establish a secure connection”
• An unexpected sign-in screen, warning page or captive portal appears

It can also simply hang with no symptom at all. Where a filtering product blocks the connection and returns a warning page or sign-in page in place of the real response, the app sees “a response, but not the right one”, and the screen stays stuck loading.

#Narrowing it down yourself

1. 1

   Run the diagnostics

   Run the app's network diagnostics and follow the remedy shown.

2. 2

   Try a different network

   Try mobile tethering or your home network. If it works there, the cause is most likely the corporate network, the VPN, a proxy or a filtering product.

3. 3

   Try with the VPN or proxy off

   Where your internal rules allow it, turn the VPN or proxy off temporarily and try again. Where they do not, do not force it — share the results from the other network with your IT department instead.

4. 4

   Check the settings on your machine

   Use “Checking the proxy settings and certificates on your machine” below to establish which proxy is in use and whether an inspection certificate is present.

5. 5

   Share it with your IT department

   Where the symptom only occurs on the company-managed network, share the copied diagnostic report, or the template request below, with your IT department.

#Checking the proxy settings and certificates on your machine

Which proxy is in use, and whether an inspection certificate authority certificate is installed, can be seen from your operating system's settings. Including what you find in the request shortens the exchange with your IT department.

#Behaviour with an always-on VPN

In configurations that route all traffic through a VPN, the long-lived WebSocket connection used for transcription can be cut by an idle timeout or a session re-authentication. Where the start of a meeting is transcribed but it stops after a few or a dozen minutes, suspect this. Where it disconnects after roughly the same elapsed time every occasion, a timeout setting is very likely involved. Ask your IT department to compare the elapsed time until disconnection against the VPN logs for that moment.

#Proxies and SSL inspection

Where a corporate proxy decrypts and inspects traffic and re-encrypts it with the organisation's own certificate authority certificate (SSL inspection), connections can fail for the following reasons.

• The inspection certificate authority certificate has not been distributed to that machine
• The certificate has been distributed, but is not in the certificate store the app uses
• The inspection appliance does not let the WebSocket upgrade request through
• The inspection appliance receives the whole response before forwarding it (buffering), so progressively delivered responses never arrive

What it comes down to is two things: whether the machine trusts the substituted certificate, and whether the inspection appliance can relay the traffic with its shape intact. The practice of substituting certificates is not itself a problem where those two things hold.

#Where file uploads stall

Corporate proxies and web filtering products often have a limit on the size that can be sent in a single request. Where small files go through but anything over a few MB fails, suspect that limit. For the file limits themselves, see File size limits.

#Blocking by security products used in Japan

Endpoint protection and data-loss prevention products distributed internally sometimes restrict traffic on a per-application basis. Where correcting the firewall and proxy settings does not help, check the blocking logs of the product on the machine. Some products return no error to the app when they block: the connection simply times out. For narrowing down cases where access to audio devices themselves is restricted, see Transcription is not working.

#A template request for your IT department

This is a template for an internal request. Every Pulse request is gathered here in one place. Keep only the items you need, from network allowances, operating system permissions and calendar integration approval.

Subject: Settings needed to use our meeting-notes app (Pulse)

Hello,
This is [team / name].
Pulse, which we use to record meetings, is not working correctly
on our internal environment. Please could you consider the settings below.

■ What is happening
- Symptom: [e.g. transcription does not start / stops N minutes after starting /
        calendar events do not appear / no summary is generated]
- On the corporate network: reproducible
- On mobile tethering: not reproducible
- Machine: [asset number / OS and version]
- App network diagnostics: see attached

■ What we would like allowed on the firewall and proxy
- HTTPS (TCP 443) to the destinations listed below
- Secure WebSocket (wss, TCP 443) to the same destinations
  * The WebSocket upgrade and long-lived connections must be preserved
- For the streaming hosts, response buffering and content inspection
  disabled
- Where SSL inspection is in use:
  - Confirmation that the inspection CA certificate is on this machine
  - The streaming hosts above excluded from inspection
- Where DNS filtering is in use: the CNAME targets allowed as well
- Where file attachments are used: confirmation of the request size limit

■ Operating system permissions (where audio is not captured)
[On macOS]
- System Settings > Privacy & Security > Microphone: allow Pulse
- System Settings > Privacy & Security >
  Screen & System Audio Recording: allow Pulse
[On Windows]
- Settings > Privacy & security > Microphone:
  enable “Microphone access”
- Same screen: enable “Let desktop apps access your microphone”

■ What we would like allowed in the endpoint protection product
- In application control, allow traffic from the Pulse executable
- In audio device access control, add Pulse to the allowed list
- Confirmation of whether the traffic appears in the blocking logs

■ Calendar integration approval (where events do not appear)
[On Microsoft 365]
- Approve the Pulse application in the Microsoft admin centre
- Permission required: reading calendar events
[On Google Workspace]
- Allow Pulse under Admin console > Security > Access and data control
  > API controls > Manage third-party app access

■ Notes
- This app does not add a recording participant to the meeting tool; it captures
  the audio playing on the machine and the microphone audio on the machine itself.
- The only calendar information the app reads is the events visible to my account.
- The list of destinations is published on Pulse's network requirements page.
- Audio captured will be handled in accordance with [internal request number /
  policy name].

Thank you for your help.

#For network administrators: destinations to allow

This section is for whoever configures firewalls, proxies, SSL inspection and web filtering products (including SASE products).

Pulse communicates over HTTPS and secure WebSocket. Let the following domains through without rewriting responses or redirecting them.

For the ordinary HTTPS domains, TLS/SSL inspection can be left enabled provided managed machines trust the inspection certificate authority and the proxy relays requests and responses without altering them.

Hosts that deliver progressively (streaming) have to return the response body in parts, in order. For those hosts, disable response buffering and content scanning. Where your product cannot inspect without buffering, exclude them from TLS inspection.

Transcription requires outbound secure WebSocket on TCP 443. Allow the WebSocket upgrade and long-lived connections. Pulse may connect directly or go through the operating system's proxy settings.

#The app itself

#App downloads and automatic updates

The delivery CDN host name is a fixed host name issued by the CDN provider. Rather than allowing it with a wildcard, register the value given on the network requirements page exactly as it stands.

#Transcription

Where your security product supports wildcards, allowing the processor's whole domain with a wildcard prevents endpoints added later from being missed. Where it does not, register the host names individually.

#Sign-in, single sign-on (SSO) and calendar integration

Where you sign in with a Google or Microsoft account and connect a calendar, traffic is also needed to the sign-in and API domains Google and Microsoft publish in their own documentation. Refer to their published information for what to allow.

#Notifications

Allow both HTTPS and secure WebSocket for real-time notifications.

#Documentation and status page

#Sending diagnostic logs

#DNS CNAME targets (for SASE and DNS filtering)

Products that judge traffic by inspecting DNS responses need the CNAME resolution targets allowed as well.

#Five settings that usually do the trick in filtered environments

1. Allow secure WebSocket traffic on TCP 443 to the transcription hosts.
2. Disable response buffering for the hosts that deliver progressively.
3. Check that your security product is not substituting a warning page or sign-in screen for the response.
4. Check that name resolution succeeds on the DNS resolver you manage.
5. Check that managed machines trust the certificate authority used for TLS inspection. Where they cannot be made to, exclude the domains concerned from inspection.

#About disclosing destinations

The lists in this article are for configuring a corporate network. What information Pulse sends from a user's machine to parties other than UNCHAIN, Inc. is published separately under the Telecommunications Business Act.

Meeting audio, transcribed text and the body of notes Pulse generates are not among the information transmitted externally for analytics or fault detection. These are handled only to the extent needed to provide the Pulse service.

#If none of this resolves it

Where reviewing the network settings does not help, contact tharada@the-unchain.com with the app's diagnostic report attached. The following helps us investigate faster.

• The results of trying both on the corporate network and on another network (tethering, for example)
• Your network environment (whether a VPN is in use and its product name, whether a proxy is in use, whether SSL inspection is in use, and the type of filtering product)
• Which diagnostic items failed, and which features are affected
• Where blocking is suspected, the proxy or endpoint protection logs for the time concerned
• Your operating system and version, and the Pulse app version

On a network managed by an IT department, getting in touch with someone from that team involved reduces the back-and-forth of checking and correcting settings.

#Related articles