Domains and IP addresses

If your network restricts outbound traffic, or your firewall inspects who is calling your systems, this page covers what to allow.

Domains you call

Allow outbound HTTPS to these hosts.

All four are HTTPS only, on port 443. Plain HTTP is refused rather than redirected, so that a request carrying an API key is never transmitted unencrypted, not even once before a redirect.

Allowlist by hostname, not by IP

We do not publish a list of inbound IP addresses for the API, and we recommend against pinning to any address you observe.

The API is served from cloud infrastructure behind a CDN. Addresses change without notice as capacity moves, and an integration pinned to one will break at a time nobody predicted, with a failure that looks like an outage on our side. Allowlist api.askylabs.com by name.

If your security policy genuinely requires IP-level egress control, the usual answer is to route your own outbound traffic through a proxy or NAT gateway you control, and allowlist the hostname there. Contact us if that does not work for your environment.

Traffic from Asky to you

Two kinds of Asky traffic may reach your systems.

AskyBot crawls websites monitored on the platform. It identifies itself with a user agent, honors robots.txt, and crawls from cloud infrastructure without a fixed IP range, so it should be allowed by user agent rather than by address. See the AskyBot page for the exact string and per-provider instructions.

Publishing connections reach your CMS when you publish content from Asky to Webflow, WordPress, or Sanity. These use the credentials you connected and appear as normal API traffic to that platform.

The REST API never calls you. It is read-only and request-response only, with no webhooks or callbacks in v1.

TLS

TLS 1.2 or higher, with modern cipher suites. Certificates are issued by a public CA and rotate automatically, so do not pin a certificate or a public key: pinning breaks silently at renewal.

Where your data is hosted

Asky runs in the European Union. The application and API run in Stockholm, Sweden, and the primary database is hosted in Stockholm on Supabase.

For a current list of sub-processors and their locations, including the providers behind AI-engine monitoring, contact us or see your data processing agreement. If you have a data residency requirement, tell us before you build, because it is easier to confirm up front than to discover in a security review.