For IT Administrators

Everything you need to allow Sortstash through a corporate firewall or proxy. Sortstash is a desktop file-organization app for macOS and Windows. It makes a small number of outbound HTTPS requests and nothing else.

Domains to allow

Required for every installation:

  • api.sortstash.com — license activation and validation, plus update checks and downloads

Only needed if the user connects the OneDrive integration:

  • login.microsoftonline.com — Microsoft sign-in
  • graph.microsoft.com — Microsoft Graph file operations

Only needed if the user connects the Dropbox integration:

  • www.dropbox.com — Dropbox sign-in
  • api.dropboxapi.com — Dropbox API
  • content.dropboxapi.com — Dropbox file transfers

Ports

Outbound traffic is port 443 (HTTPS) only. Sortstash makes no plain HTTP requests and uses no other outbound ports.

One local exception: while a user signs in to OneDrive or Dropbox, the app briefly listens on 127.0.0.1:8400 to receive the OAuth callback from the browser. This is loopback only — it never leaves the machine and needs no firewall rule — but endpoint-protection software that blocks local listeners will prevent cloud sign-in from completing.

TLS inspection

Sortstash does no certificate pinning. It validates TLS using the operating system trust store, so a corporate TLS-inspection proxy with its root certificate installed on the machine will work without any additional configuration in the app.

What leaves the machine

None of your company's data reaches Sortstash's servers. No file contents, file names, paths, or folder structure are ever transmitted to us. All organizing happens locally on the user's machine, and the app sends no usage telemetry.

When a cloud integration is connected, the app talks directly to Microsoft or Dropbox from the user's machine. That traffic never passes through Sortstash. The OAuth tokens are held in the operating system's credential store (macOS Keychain, Windows Credential Manager) and are never sent to us.

For completeness, here is everything our servers do store — all of it licensing data, none of it derived from your files:

  • The license key, plus the name and email address given at purchase (purchases are handled by Paddle, our merchant of record — card details go to them, never to us)
  • For each activated device: a salted SHA-256 hash of the machine ID, the device's hostname so users can identify their own devices, the operating system, and the app version. The hash cannot be reversed to recover the machine ID, but it is linked to the license record, and therefore to the purchase email — that association is what enforces the per-license device limit.
  • For trials: only the device hash and the trial dates. A trial is not associated with any name or email address unless and until it converts to a purchase.

Sortstash requires no user account, and the app works fully offline apart from periodic license validation and update checks.

Blocked at work? Send this to your IT team

Copy the message below and email it to whoever manages your network. 

Subject: Request to allow Sortstash through the firewall

Hi,

I use Sortstash (a desktop file-organization app) and it is being blocked on our network. Allowing it should be quick - here is everything it connects to:

Domains
- api.sortstash.com (required - license checks and updates)
- login.microsoftonline.com and graph.microsoft.com (only if OneDrive is used)
- www.dropbox.com, api.dropboxapi.com, content.dropboxapi.com (only if Dropbox is used)

Ports
- Outbound: 443 (HTTPS) only. No other ports, no plain HTTP.
- During OneDrive/Dropbox sign-in the app listens on 127.0.0.1:8400 for the
  OAuth callback. Loopback only, so no firewall rule is needed, but local
  listeners must not be blocked by endpoint protection.

TLS inspection
- The app does no certificate pinning. It uses the OS trust store, so our
  inspection proxy will work without extra configuration.

Data handling
- No company data reaches Sortstash's servers: no file contents, file names,
  paths, or folder structure, and no usage telemetry. Organizing happens
  locally on the machine.
- If OneDrive or Dropbox is connected, the app talks directly to that
  provider; the traffic does not pass through Sortstash, and the OAuth tokens
  stay in the OS credential store.
- Their servers hold licensing data only: the license key, the purchase name
  and email, and a salted hash of the machine ID plus hostname, OS and app
  version for each activated device.

Full details are here: https://sortstash.com/support/it

Thanks!

Questions we haven't covered? Email support@sortstash.com.