Documentation › For IT: allowing DeltaSys

For IT: allowing DeltaSys

DeltaSys runs in the browser from one domain over HTTPS. If a web gateway or firewall (McAfee / Skyhigh Web Gateway, Zscaler, Palo Alto, Fortinet, Forcepoint, Cisco and others) blocks it, these are the addresses, ports and protocols to allow. Nothing is installed on the computer.

What to allow

Address	What it is	Needed for
`deltasys.app`	The site, the apps (`/planner/`, `/estimator/`, `/time/`) and their API (`/api/`)	Everything
`pay.deltasys.app`	Payment pages, hosted by Stripe under our name	Subscribing and updating a card (workspace owners)
`.stripe.com`, `.stripe.network`	Scripts and frames the Stripe payment pages load	Payment pages only
`login.microsoftonline.com`, `login.live.com`	Microsoft sign-in	Only when signing in with Microsoft
`fonts.googleapis.com`, `fonts.gstatic.com`	Typefaces of the public site	Appearance only; the site works without them

The apps themselves load nothing from other domains: their code, styles and fonts are served from deltasys.app. Project data goes only to deltasys.app/api/, and only for a signed-in workspace.

Protocols and ports

HTTPS on port 443 only, TLS 1.2 or 1.3. Plain HTTP and www.deltasys.app redirect to https://deltasys.app.
.app domains are HTTPS-only in every browser (the HSTS preload list), and the site sends Strict-Transport-Security as well.
No WebSockets, no non-standard ports, no browser extensions, plug-ins or desktop software.
Downloads are only the files a person asks for (exports such as XER, Project XML, CSV and reports), made in the browser. Uploads are only the files a person opens (XER, XML, JSON and spreadsheets).
If the gateway inspects TLS, nothing in DeltaSys pins certificates, so inspection does not break it.

Category and reputation

DeltaSys is business software for project controls (scheduling, earned value, estimating and risk). The categories that fit are Business and Software / Hardware (or Internet Services). The domain was registered in October 2026, so a gateway that blocks newly registered or uncategorized domains may stop it until its category is set: allow deltasys.app by name, or ask your gateway's vendor to review it.

A security contact is published at /.well-known/security.txt. How data is stored and protected is in Security and privacy.

Checking the connection

Open https://deltasys.app/api/health from the computer behind the gateway. It answers with a short line that includes "ok":true.
Open https://deltasys.app/planner/?demo=1. The demo workspace loads in the browser with no account.
If the first works and the second does not, the gateway is blocking scripts or JSON from deltasys.app: allow the whole domain rather than single pages.

Contact

For a security review, a questionnaire or a private deployment inside your own network, contact us.