Testing inside your network

A staging site, an intranet or an internal tool that is not on the internet can still be recorded and run, through a connector: a small program you run on a machine inside your network. It drives the Chrome or Edge already on that machine, and BitAssure tells it what to do.

How it stays safe

• It only ever calls out. The connector connects to BitAssure over ordinary HTTPS, through your proxy if you have one. Nothing listens on your side, so there is no firewall change and no inbound port.
• Your allow-list decides where it may go. allowed.hosts lists the addresses it may open, such as *.yourbank.internal or 10.0.4.0/24. It is checked on your machine before anything is opened, so nobody at BitAssure can widen it.
• Its credential opens one door. The connector's key fetches its own runs and reports their results. It cannot read anything else in your account.
• Nothing is downloaded. It uses the browser already installed and never fetches one.

What does leave your network: the results, screenshots and video of the runs you set up, sent to BitAssure for your reports.

What your network needs to allow

Outbound HTTPS on port 443 only, through your proxy if you have one:

• api.bitassure.app, which the connector talks to while it runs
• auth.bitassure.app and bitassure.app, for the people using BitAssure in a browser
• github.com and objects.githubusercontent.com, to download the connector

If a web filter shows a certificate error on any of these, it is usually the filter's own block page; ask your IT team to allow the addresses above.

If your network inspects HTTPS, its own certificate authority signs every connection. The connector trusts what the machine trusts (the Windows certificate store, or the system bundle on Linux), so this usually just works. If it still says BitAssure's certificate was not trusted, save your network's authority as a .pem file next to the connector and name it in connector.properties as ca.file=bank-ca.pem.

Setting one up

1. Go to Settings → Connectors and press Add connector. Name it after where it runs, such as "Office network".
2. Download the package for the machine. Windows and Linux packages include their own Java, so nothing else needs installing. They come from github.com/BitAssure/connector, which most company networks already allow, and each release lists every file's SHA-256 in SHA256SUMS. If GitHub is blocked, the page offers the same files from api.bitassure.app.
3. Follow the steps on the page for your machine. Each one is a command to paste:
   • Windows server: run it as a scheduled task under the SYSTEM account, which the connector sets up for you
   • Linux server: run it as a systemd service
   • Your own computer: run it in a terminal while you test
4. Register it with the one-time code the page shows. The code works once and expires after a day. The connector swaps it for its own key, kept in a file only its user can read.
5. Put the addresses it may open in allowed.hosts. Left empty, it may open any address, and it says so loudly when it starts.

The page shows whether the connector is connected.

Pointing a platform at it

On a website platform, set Reached through to the connector. From then on, recordings and runs of that platform happen through it. Other platforms carry on running on BitAssure's own machines.

What happens when it is off

A run waiting for a connector that is not running, or that stops answering mid-run, ends as an error after a short time, naming the connector, and its credits come back. Nothing waits silently.

Limits

• Websites only for now. Phones and APIs cannot be reached through a connector yet.
• Runs through a connector still count towards your account's runs at once.
• The packages are unpack-and-run. A signed Windows installer and Linux .deb and .rpm packages are not available yet.