Network and security
What reaches your eode install, what it calls out to, and what stays in your account.
What stays in your account
Your models, data, results, conversations and uploaded files are in your database and file storage. Your secrets are in your Secrets Manager. River Logic has no access to your account, and the install sends nothing back to us: feedback filing, support handoff and usage telemetry are switched off in a self-hosted install.
Inbound
| Hostname | Port | Who calls it |
|---|---|---|
APP_HOST | 443 | Your users' browsers |
MCP_HOST | 443 | Your MCP clients |
Both are served by one load balancer that the stack creates. The optimization engines are never reachable from outside the cluster.
Outbound
| Endpoint | Needed for |
|---|---|
api.anthropic.com | Every conversation with RIA, with your own key |
api.workos.com and your sign-in domain (from the eode portal) | Sign-in. Your users' browsers reach the sign-in domain too |
River Logic's image registry (Amazon ECR in us-east-1) | Pulling eode's images, at install and upgrade |
fonts.googleapis.com, fonts.gstatic.com | Your users' browsers, for the web app's typeface |
| AWS APIs in your region (STS, Secrets Manager, ECR, EKS) | The cluster, its secrets and images |
Let's Encrypt (acme-v02.api.letsencrypt.org) | Only with automatic certificates |
| Your OpenTelemetry collector | Only if you set TelemetryEndpoint |
| A data source a user connects | Only when a user adds a data connection |
There is no offline mode: eode needs your LLM provider and the sign-in service.
Inside the cluster
- Network policies allow only the web app and the MCP endpoint to reach the engines, and keep the engines off the internet.
- Each pod reads only the secrets it needs, through its own AWS role.
- A user's data connections can't reach the internal ranges in DataConnectionDenyCidrs.
The full lists, the network policies and the ranges are in Reference: Network.