IT & Network Setup Guide

For school & district IT administrators · SoftwareConvene LLC (Indiana, USA)

This page gives your IT team everything needed to allow, vet, and support SoftwareConvene on your network — the exact domains to whitelist, the ports and protocols used, our SSL and security posture, and our privacy stance. Everything here is designed to be copy-paste ready for a firewall or web-filter allow-list.

What SoftwareConvene is

SoftwareConvene builds web tools for schools: ClassConvene (assessments and classroom tools for educators), TeamConvene (management for coaches and clubs), and FundCatalyst (team finances). It runs entirely in the browser — there is no desktop agent, browser extension, or software to install on student or staff devices.

The platform is served from three domains behind Cloudflare, each with a valid, publicly-trusted TLS certificate:

• softwareconvene.org — front door / sign-in
• classconvene.org — educator home (and *.classconvene.org for public science-fair pages)
• teamconvene.org — coach / club home

Required domains — whitelist these REQUIRED

These are the only domains the app needs to sign in and run its core features. Every piece of application JavaScript is hosted on our own domains (we self-host all libraries — no public CDN dependency), so this list is short and stable.

Copy-paste allow-list (one host per line; includes wildcards for filters that support them):

softwareconvene.org
*.softwareconvene.org
classconvene.org
*.classconvene.org
teamconvene.org
*.teamconvene.org
xolmvxvqfjxrdaewuawu.supabase.co

Optional / feature-specific domains OPTIONAL

These are only contacted when a specific optional feature is used. Blocking them will not affect sign-in or core classroom use — the relevant feature simply won't be available.

js.stripe.com
api.stripe.com
checkout.stripe.com
m.stripe.network
www.zeffy.com
api.zeffy.com
www.desmos.com
api.weather.gov
waterservices.usgs.gov
api.inaturalist.org
mesonet.agron.iastate.edu
server.arcgisonline.com
*.tile.openstreetmap.org
*.basemaps.cartocdn.com
api.nps.gov

What we do not load

For filters that flag pages by the trackers they call: SoftwareConvene loads none of the following, on any page:

• No Google Analytics, Google Tag Manager, or DoubleClick.
• No Meta/Facebook Pixel, TikTok pixel, Snap, or any social-media tracking tag.
• No session-replay or heat-mapping (Hotjar, FullStory, Clarity, etc.).
• No advertising networks or ad exchanges.
• No third-party font, script, or CDN dependency — all libraries are self-hosted on our domains.

Ports & protocols

• 443 / TCP (HTTPS) — all application, API, and Supabase traffic.
• 443 / TCP (WSS) — Supabase realtime uses a secure WebSocket over the same port and host.
• No other inbound or outbound ports are required on client devices. No UDP, no non-standard ports.

SSL / TLS inspection

All endpoints present valid, publicly-trusted certificates and negotiate TLS 1.2 or 1.3 with modern cipher suites, so SSL-inspection (MITM) proxies can decrypt and re-sign our traffic normally. We do not use certificate pinning in the browser, so a properly-configured inspection appliance will not break the app.

We send Strict-Transport-Security (HSTS), so once a device has loaded the site it will refuse plain-HTTP downgrades — ensure your inspection proxy serves the re-signed content over HTTPS (it will, by default).

Security posture

• Encryption everywhere. Data is encrypted in transit (HTTPS/TLS), including app-to-database, and at rest.
• Security headers. We set Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, and a restrictive Permissions-Policy (camera and geolocation off; microphone same-origin only).
• Per-account authorization on every record and file, plus database Row-Level Security as a second layer.
• Private file storage. Uploaded documents are never publicly listed or served by guessable link — only through an authorized, permission-checked request.
• Session & abuse protection. Rate limiting and session protections defend accounts.

Privacy & compliance

SoftwareConvene is built to align with FERPA, COPPA, and applicable state student-privacy laws:

• Schools control student data; we process it only as a service provider, on the school's behalf.
• Data minimization by design: roster tools support pseudonyms / class identifiers instead of full real names, and each feature collects only what it needs.
• We never sell data, never show ads, and never use school or student content to train AI models.
• Sub-processors are limited to Google Cloud (hosting), Supabase (database/auth), Cloudflare (network), and — for optional AI features — Anthropic and Google Vertex AI under no-training commercial terms. Stripe handles payments when applicable.

Full details: Privacy Policy · Terms of Service.

Email from SoftwareConvene

We send a small amount of transactional email — beta-access invitations, data-privacy-agreement signing links, password resets, and event notifications. All of it is authenticated (SPF, DKIM, and DMARC all pass) and sent through a reputable provider. If any of it is landing in quarantine or spam for your staff, allowing the values below in your mail gateway (Microsoft 365 / Exchange Online, Google Workspace, Proofpoint, Mimecast, or Barracuda) will fix it.

Sending identity

A note for link-rewriting / sandboxing gateways

If your gateway rewrites or detonates links (Proofpoint URL Defense, Barracuda Link Protection, Microsoft Safe Links, Mimecast URL Protect), note that every link in our mail resolves to the same domains you're already allowing for the app itself — softwareconvene.org, classconvene.org, and teamconvene.org. Allowing those domains in your web filter (see Required domains) also lets these links pass inspection cleanly.

Unsubscribing

Bulk messages carry a one-click List-Unsubscribe header (RFC 8058). Transactional messages that a user specifically requested — a password reset, a document they asked us to send — are always delivered and are not part of any list.

Content category

SoftwareConvene should be categorized as Education / Educational Institutions in web-filter category databases (GoGuardian, Lightspeed, Securly, Zscaler, Cisco Umbrella, etc.). If our domains are miscategorized in your filter, please contact us and we will submit a re-categorization request to the relevant vendor.

Contact for vetting

District technology teams are welcome to request a data-privacy agreement (DPA), a security questionnaire, or a walkthrough. Email [email protected] and we'll respond promptly.