OPSQAIOQOPSQAI
Blog
27 May 2026Security4 min read

Data stays on your server. Really.

A concrete walkthrough of every network call an OPSQAI installation makes — and doesn't make — so IT teams can approve the firewall rules in one meeting.

By OPSQAI Security

"Self-hosted" is a word people use loosely. This post is the specific version: what an OPSQAI installation talks to over the network, and what it does not.

Inbound

  • Port 443 from the customer's LAN, terminated by Caddy. This is the only inbound port required.

Outbound — required

  • mc.opsqai.de — licence heartbeat and signed update manifest checks. Payload: licence ID, build version, timestamp. No customer content. No end-user identifiers.
  • The AI endpoint chosen by the customer — OpenAI, Azure OpenAI, OpenRouter, or none at all if the customer picks Ollama. This traffic is between the customer's server and the customer's own AI account; OPSQAI does not proxy it.

Outbound — never

  • No analytics beacons. No product telemetry. No error-reporting SaaS.
  • No document, chunk, embedding, question, or answer is ever transmitted to OPSQAI or to opsqai.de. If the customer picks Ollama, no document ever leaves the server at all.

The Doctor tool in the first-run wizard prints exactly this list, so a security review can be closed with a screenshot instead of a questionnaire.

Keep reading