Allowlist Aurothic Suites on your network
For firewall, proxy, and MDM admins · Last updated: Oct 1, 2026
Summary
The Aurothic Suites iPhone app talks only to getvexa.co and our Supabase project host, plus Apple’s App Store for purchases. Everything is HTTPS on port 443/TCP. AI answers are generated by our servers, so devices never connect to the AI provider.
Domains
| Domain (FQDN) | Port | Purpose | Who connects |
|---|---|---|---|
| getvexa.co | 443/TCP (HTTPS) | Aurothic Suites app API (chat, voice, Aurothic Port Harbor™ in Aurothic Suites) and website | Devices |
| upzzylkxhmaopkmrrfuk.supabase.co | 443/TCP (HTTPS) | Sign-in, account data, and file storage for Aurothic Suites (our project host) | Devices |
| *.supabase.co | 443/TCP (HTTPS) | Same service; use this if your firewall needs a wildcard for the project host above | Devices |
| *.itunes.apple.com (includes buy.itunes.apple.com), itunes.apple.com | 443/TCP (HTTPS) | App Store and StoreKit purchases and subscriptions | Devices |
| *.apps.apple.com, *.mzstatic.com | 443/TCP (HTTPS) | App Store content (install and update Aurothic Suites, product info) | Devices |
| idmsa.apple.com, gsa.apple.com, account.apple.com, appleid.cdn-apple.com | 443/TCP (HTTPS) | Apple Account sign-in used when buying or restoring a subscription | Devices |
| generativelanguage.googleapis.com | 443/TCP (HTTPS) | AI answers (Google Gemini API). Called only by our servers, never by the phone | Not needed on your network |
generativelanguage.googleapis.com is listed for transparency only: it’s server-side. You don’t need to allow it for phones or laptops.
Apple hosts above come from Apple’s documentation. For Apple push notifications (*.push.apple.com), device management, iOS updates, and certificate validation, follow Apple’s Use Apple products on enterprise networks.
Allow by domain, not IP
getvexa.co and the Supabase host run on shared cloud networks (Vercel and Supabase). Their IP addresses are shared with other services and change without notice, so allow by domain/FQDN rather than IP address.
TLS inspection
HTTPS interception (SSL/TLS inspection) can break Aurothic Suites sign-in, chat, file uploads, and App Store purchases. Exclude the domains above from TLS inspection. Apple services refuse intercepted connections.
Copy-ready FQDN list
getvexa.co upzzylkxhmaopkmrrfuk.supabase.co *.supabase.co itunes.apple.com *.itunes.apple.com *.apps.apple.com *.mzstatic.com idmsa.apple.com gsa.apple.com account.apple.com appleid.cdn-apple.com
Example: generic firewall FQDN object
# Adapt names and syntax to your firewall. Outbound only, HTTPS.
object fqdn VEXA-API getvexa.co
object fqdn VEXA-DATA upzzylkxhmaopkmrrfuk.supabase.co
object fqdn VEXA-DATA-WILD *.supabase.co
object fqdn APPLE-STORE-1 *.itunes.apple.com
object fqdn APPLE-STORE-2 itunes.apple.com
object fqdn APPLE-STORE-3 *.apps.apple.com
object fqdn APPLE-STORE-4 *.mzstatic.com
object fqdn APPLE-ACCOUNT-1 idmsa.apple.com
object fqdn APPLE-ACCOUNT-2 gsa.apple.com
object fqdn APPLE-ACCOUNT-3 account.apple.com
object fqdn APPLE-ACCOUNT-4 appleid.cdn-apple.com
object-group VEXA-ALLOW { VEXA-API VEXA-DATA VEXA-DATA-WILD APPLE-STORE-1 APPLE-STORE-2 APPLE-STORE-3 APPLE-STORE-4 APPLE-ACCOUNT-1 APPLE-ACCOUNT-2 APPLE-ACCOUNT-3 APPLE-ACCOUNT-4 }
rule allow src INSIDE dst VEXA-ALLOW service tcp/443 no-tls-inspection