Allowlisting Staffbase App / Intranet

Domain names that can be allowed for Staffbase app functionality

Many domains will be migrated beginning on May 1st for the US American Hosting Infrastructure and on June 7th for the German Hosting Infrastructure.
If your organization currently individually allows the domains below, we would recommend allowing both domains listed on each point to ensure the accessibility of all features.


If your organization uses restrictive firewall or proxy server settings, allowlisting certain domain names can be necessary to ensure your Staffbase web application works as expected.

Staffbase strongly discourages the practice of whitelisting or allowlisting as it can affect the overall performance of your application. We currently do not support the use of allowlisting. The information available here can be used when necessary and when being aware of the limitations that come with it.
The URLs listed here can change without prior notification. Review this page periodically to ensure the URLs listed here match those allowed in your system.

Domain Names to Allow

Allow these domain names for basic app functionality:

  • Web application URL, for example, myapp.staffbase.com or your custom domain
  • Service URLs (Learn more about how to determine the hosting infrastructure in the Support Portal article):
    • For applications hosted on the US American hosting infrastructure: us1.staffbasestatic.com and backend.staffbase.com
    • For applications hosted on the German hosting infrastructure: de1.staffbasestatic.com and de.staffbase.com
  • Media URL: *.eyo.net

Additional Domains in case of Partial Accessibility Issues:

  • If your system can allow wildcard domains, allow: *.staffbase.com
  • If your system requires allowing each URL separately, allow the following based on your hosting infrastructure (Learn more about how to determine the hosting infrastructure in the Support Portal article):
    • US American Hosting Infrastructure
      • pluginabsence-service-main-us1.staffbase.com
        (Will soon move to: pluginabsence-service-us1.staffbase.com)
      • pluginabsence-main-us1.staffbase.com
        (Will soon move to: pluginabsence-us1.staffbase.com)
      • plugincalendar-main-us1.staffbase.com
        (Will soon move to: plugincalendar-us1.staffbase.com)
      • pluginquizcalendar-main-us1.staffbase.com
        (Will soon move to: pluginquizcalendar-us1.staffbase.com)
      • plugineventregistration-main-de1.staffbase.com
        (Will soon move to: plugineventregistration-us1.staffbase.com 🆕  added on May 19 2022)
      • pluginfacebook-main-us1.staffbase.com
        (Will soon move to: pluginfacebook-us1.staffbase.com)
      • pluginfiori-main-us1.staffbase.com
        (Will soon move to: pluginfiori-us1.staffbase.com)
      • pluginforms-main-us1.staffbase.com
        (Will soon move to: pluginforms-us1.staffbase.com)
      • pluginintegrated-content-main-us1.staffbase.com
        (Will soon move to: pluginintegrated-content-us1.staffbase.com)
      • pluginmaps-main-us1.staffbase.com
        (Will soon move to: pluginmaps-us1.staffbase.com)
      • pluginmealplan-main-us1.staffbase.com
        (Will soon move to: pluginmealplan-us1.staffbase.com)
      • pluginms365-main-us1.staffbase.com
        (Will soon move to: pluginms365-us1.staffbase.com)
      • pluginnetigate-main-us1.staffbase.com
        (Will soon move to: pluginnetigate-us1.staffbase.com)
      • de-plugin-saml.staffbase.com
        (Will soon move to: pluginsaml-us1.staffbase.com)
      • pluginshifts-main-us1.staffbase.com
        (Will soon move to: pluginshifts-us1.staffbase.com)
      • pluginsurveys-main-us1.staffbase.com
        (Will soon move to: pluginsurveys-us1.staffbase.com)
      • pluginsurveymonkey-main-us1.staffbase.com
        (Will soon move to: pluginsurveymonkey-us1.staffbase.com)
      • lambda-secure-media.staffbase.com
      • wittywidgetwizard-main-us1.staffbase.com
        (Will soon move to: wittywidgetwizard-us1.staffbase.com)
    • German Hosting Infrastructure
      • pluginabsence-service-main-de1.staffbase.com
        (Will soon move to: pluginabsence-service-de1.staffbase.com)
      • pluginabsence-main-de1.staffbase.com
        (Will soon move to: pluginabsence-de1.staffbase.com)
      • plugincalendar-main-de1.staffbase.com
        (Will soon move to: plugincalendar-de1.staffbase.com)
      • pluginquizcalendar-main-de1.staffbase.com
        (Will soon move to: pluginquizcalendar-de1.staffbase.com)
      • plugineventregistration-main-de1.staffbase.com
        (Will soon move to: plugineventregistration-de1.staffbase.com)
      • pluginfacebook-main-de1.staffbase.com
        (Will soon move to: pluginfacebook-de1.staffbase.com)
      • pluginfiori-main-de1.staffbase.com
        (Will soon move to: pluginfiori-de1.staffbase.com)
      • pluginforms-main-de1.staffbase.com
        (Will soon move to: pluginforms-de1.staffbase.com)
      • pluginintegrated-content-main-de1.staffbase.com
        (Will soon move to: pluginintegrated-content-de1.staffbase.com)
      • pluginmaps-main-de1.staffbase.com
        (Will soon move to: pluginmaps-de1.staffbase.com)
      • pluginmealplan-main-de1.staffbase.com
        (Will soon move to: pluginmealplan-de1.staffbase.com)
      • pluginms365-main-de1.staffbase.com
        (Will soon move to: pluginms365-de1.staffbase.com)
      • pluginnetigate-main-de1.staffbase.com
        (Will soon move to: pluginnetigate-de1.staffbase.com)
      • de-plugin-saml.staffbase.com
        (Will soon move to: pluginsaml-de1.staffbase.com)
      • pluginshifts-main-de1.staffbase.com
        (Will soon move to: pluginshifts-de1.staffbase.com)
      • pluginsurveys-main-de1.staffbase.com
        (Will soon move to: pluginsurveys-de1.staffbase.com)
      • pluginsurveymonkey-main-de1.staffbase.com
        (Will soon move to: pluginsurveymonkey-de1.staffbase.com)
      • lambda-secure-media.eyo.net
      • wittywidgetwizard-main-de1.staffbase.com
        (Will soon move to: wittywidgetwizard-de1.staffbase.com)
    • Integration Widgets
      • m365-widgets.staffbase.com (Microsoft 365 Widgets)
      • google-drive-widget.staffbase.com (Google Drive Widget)
      • workday-widgets.staffbase.com (Workday Widgets)
    • Additional URLs
      • asset-in.video-cdn.net
      • asset-out-cdn.video-cdn.net
      • videocdnvod1-vh.akamaihd.net
      • videocdnvod2-vh.akamaihd.net
      • c.video-cdn.net
      • d.video-cdn.net
      • e.video-cdn.net
    • Custom Integrations
      • If your application makes use of third party plugins or integrations, be sure to also include those in your list of allowed URLs

Mail Notifications

For platforms on the German hosting infrastructure, to allow for email notifications, allowlist the domain name and IP address dedicated to the Staffbase service provided by Mailjet for our mail provider:

Domain: mailjet.com
Mailserver: @bnc3.mailjet.com
Mailserver: @a297928.bnc3.mailjet.com 🆕  added on May 20 2022
Mailserver: @a1869926.bnc3.mailjet.com 🆕  added on May 20 2022
IP: 87.253.236.169

Learn more about Staffbase Email domain names and IP ranges here.

IP Address Ranges

Some firewalls and servers may allow based on IP addresses and not Domain names. Our system runs on cloud service providers and uses dynamic IPs to provide the app. This means that these IPs will change randomly and we do not get a running list of these addresses. Additionally, our web deployments rely upon CDNs that can use their own IP ranges. Our hosting providers also contribute additional IPs. Additional information on the CDNs as well as our hosting providers is available on our Security Page.

With our constant implementation of container architecture, there will be even more decoupled services in the future, resulting in more IP addresses and thus rendering the effort of maintaining such a list impracticable. To allow all the IPs that would be included in these ranges would mean needing to allow tens of thousands of CDIRs and even then it would be difficult to guarantee that those ranges would stay constant.