> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reclaimtime.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Domains and URLs to allow-list

> The hosts the ReclaimTime client and dashboard contact, what each one is for, and how to get the full list for your organisation.

Everything ReclaimTime does is an outbound HTTPS connection on port 443. There are no inbound connections, no fixed source addresses to reserve, and no non-standard ports.

## Desktop client

| Host                    | Purpose                                                                      | If blocked                                                                                                          |
| ----------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| `cloud.reclaimtime.com` | Backend: sign-in, organisation settings, the corporate list, activity upload | Falls back to a second backend host. If both are blocked, the client never signs in and no data is recorded at all. |
| `reclaimtime.com`       | Reads the current version number for the machine's update channel            | The client stays on its installed version indefinitely, with no visible error                                       |

The client also needs three further hosts: the fallback for the backend, licence validation on sign-in, and the host the installers are downloaded from. We send the full list, with the purpose of each and what breaks if it is blocked, by email. Ask at [support@reclaimtime.com](mailto:support@reclaimtime.com) and we will reply with the exact hosts for your organisation.

<Warning>**Ask for the full list before you roll out.** Allow-listing only the two hosts above is not enough. Without the other three, sign-in or updates fail in a way that looks like an outage rather than a policy.</Warning>

<Warning>**If your organisation has a dedicated backend, its hosts are different again.** Larger customers are given their own backend hostname and its own fallback, and their own update channel. Do not assume the general hosts apply to you.</Warning>

<Info>Clients before 8.0 connected to what is now the fallback host directly, with no fallback of their own. If you have a mixed fleet mid-rollout, both backend hosts are in use at once, which is another reason to allow the pair.</Info>

## Dashboard

| Host                                  | Purpose                                                |
| ------------------------------------- | ------------------------------------------------------ |
| Your organisation's dashboard address | The web application supervisors and administrators use |
| `docs.reclaimtime.com`                | This documentation site                                |

The dashboard is reached from a browser only. It does not need anything installed and does not open connections back to the client.

## Version files

If your policy allow-lists paths rather than hosts, these are the version files the client reads. The installer download paths come with the host list.

| URL                                                            | What it serves                        |
| -------------------------------------------------------------- | ------------------------------------- |
| `https://reclaimtime.com/download/win/CurrentVersion.txt`      | Current version, general channel      |
| `https://reclaimtime.com/download/win/fast/CurrentVersion.txt` | Current version, early access channel |

Organisations on a dedicated channel have their own equivalents. Ask us for yours.

Installers are code signed as **FocusMe (Reclaim Time Ltd)** and timestamped, so check the signature rather than the host a file came from. See [Code signing and tamper resistance](/it/code-signing).

## Endpoint protection

Two behaviours regularly trip up endpoint protection and are worth exempting rather than investigating each time:

* The client restarts itself if it is closed or ended. That is intentional. It is what stops tracking being ended by closing a window.
* Updates download an executable and run it silently. This is the normal update path, not an unexpected download.

We send the process names to exempt along with the host list.

## Quick test from a machine

If a client is not reporting and you want to know whether the network is the reason, these should succeed from the machine itself:

```powershell theme={null}
Invoke-WebRequest https://reclaimtime.com/download/win/CurrentVersion.txt
Test-NetConnection cloud.reclaimtime.com -Port 443
```

Run the same `Test-NetConnection` against each host on the list we send you, substituting your own backend pair if you have a dedicated one. If the first command returns a version number and the rest connect, the network is not the problem, and the answer is on [First login and SSO](/first-login).

***

*Checked against ReclaimTime client 8.0.0.9 and dashboard V3 on 5 September 2026.*