Networks and proxies

For IT and locked-down networks: every host OptiFlume and your sign-in use, how it works behind proxies and HTTPS inspection, and what still works offline. Your prompts and code are never sent.

Hosts OptiFlume contacts

Host	What for	When
`optiflume.ai`	Sign-in, and the plan check that fetches your signed license	At sign-in, then about twice a day
`optiflume.ai`	Update check (a signed release notice)	When Cursor or VS Code starts, when a Claude Code or Codex session starts, and every few hours
`optiflume.ai`	Model prices (Cursor's published prices, signed)	Once a day
`optiflume.ai`	Compatibility list (signed), so automatic switching can pause on a Cursor version the same day	Once a day
`optiflume.ai`	Daily usage rollup, counts only (if usage reporting is on)	At most every six hours
`get.optiflume.ai`	The Terminal installer, update packages, and the local models	At install, on update, and once for the models
`huggingface.co`	Fallback source for the local models if get.optiflume.ai is unreachable	Only if needed, once
`cursor.com`	Cursor's public pricing page, for a model the price list does not have yet	At most once a day, only when needed

All requests use HTTPS on port 443. Nothing about your prompts, code, file names or repositories is sent to any of them. Exactly what each request carries is in What is stored where.

In your browser: sign-in and payment

Signing in and paying happen in your web browser, not in OptiFlume. Depending on how you sign in and whether you subscribe, the browser visits:

Host	What for
`accounts.google.com`	Sign in with Google
`github.com`	Sign in with GitHub
`appleid.apple.com`	Sign in with Apple
`optiflume.ai`	Sign in with an email link (Gmail or any inbox): the email comes from OptiFlume, and the link opens optiflume.ai
`checkout.stripe.com`	Subscribing to Pro (Stripe Checkout, with Link)
`billing.stripe.com`	Managing your subscription, invoices and card
`link.com`	Managing your subscription with Link, which processes OptiFlume payments

Allow-listing for IT

If your network only allows approved hosts, ask IT to allow:

optiflume.ai
get.optiflume.ai
huggingface.co        # optional: fallback for the one-time model download
cursor.com            # optional: Cursor is usually allowed already

# in the browser, for the sign-in methods you use and for paying:
accounts.google.com
github.com
appleid.apple.com
checkout.stripe.com
billing.stripe.com
link.com

Optional: when you install OptiFlume or an update, macOS itself may contact Apple’s notarization service to confirm the package is signed and notarized by its developer. That check is made by macOS, not by OptiFlume, and most networks already allow it.

Proxies

OptiFlume follows the proxy configured in macOS (System Settings → Network → your connection → Details → Proxies) and the standard HTTPS_PROXY environment variable. There is nothing to set in OptiFlume itself. In a terminal, including claude and codex, OptiFlume uses that terminal’s environment; in VS Code and Cursor, it uses the editor’s.

HTTPS inspection

OptiFlume trusts the certificates in your macOS Keychain, so networks where IT installs its own root certificate to inspect HTTPS work without extra steps. If a connection still can’t be verified, OptiFlume says “the secure connection could not be verified (a company network or security software may be inspecting HTTPS)”. Ask IT to make sure the inspection certificate is trusted in the macOS Keychain.

Downloads are checked independently of the connection: update packages and the license, release, price and compatibility documents are signed by OptiFlume and verified on your Mac before they are used.

Offline and restricted networks

Routing, the Guardian, the session watchdog and optiflume analytics work with no network at all.
A Pro or trial license lets a Mac work offline for about 30 days, plus a 14-day grace period, before it needs to check in.
If the update check is blocked, OptiFlume keeps working on the installed version. You can turn the check off with "update_check": false.
If usage reporting is blocked, nothing breaks; turn it off with optiflume telemetry off to stop the attempts.
If prices or the compatibility list can’t be fetched, OptiFlume uses the last copy it has.

Diagnose a connection problem

optiflume refresh   # tries the plan check and prints the error, if any
optiflume update --check
optiflume doctor

Still stuck? Send the output of optiflume doctor --bundle to support@optiflume.ai.