8Levers · pre-workshop assessment

Information for IT and security teams

A colleague has been invited to a short, browser-based conversation with an AI interviewer ahead of an 8Levers workshop, or to answer the same questions in writing. This page lists exactly what the browser needs to reach, so the session can be allowed through a corporate network.

What it is

One web page, opened from a personal link. About ten minutes.
The conversation runs in the browser over WebRTC, the same technology as Teams, Meet or Zoom in a browser tab. Nothing is downloaded and nothing is installed.
Camera and microphone are used only during the conversation, only after the browser's own permission prompt. Video is not recorded. A written transcript is kept and used only to prepare the workshop.
A written alternative is offered on the same page. It needs only HTTPS to our own service, with no camera, microphone or WebRTC, and is a complete substitute if video cannot be allowed.
The page asks for a name and work email so the facilitators know whose answers are whose. It never asks for a password, and it collects no other personal data.

1. Our own hosts

HTTPS, port 443.

Host	Purpose
`interview.octovectis.com`	The assessment page, its scripts and fonts, served by 8Levers. Everything the page itself needs is on this one host.
`api-production-6041.up.railway.app`	8Levers' own service: session set-up, the written form, and connection diagnostics.

Allowing only these two hosts is enough for the written version to work end to end.

2. The AI interviewer

HTTPS, port 443. Required for the video conversation.

Host	Purpose
`tavusapi.com` `.tavus.io` `.tavusapi.com`	Tavus, which provides the AI interviewer: conversation set-up, the interviewer's video, and the on-screen summary cards.

3. The video call itself

The call is carried by Daily. The list below is taken from Daily's networking guide, which is the authority and stays current. If you allow by IP address rather than by name, Daily publishes the ranges at ip-info.daily.co/ips/ip-info.json.

Web requests, port 443

Host	Purpose
`.daily.co` `.dailywebrtc.com` `*.dailywebrtc.net`	General Daily functionality.
`.wss.daily.co` `-wss.daily.co` (and the same on `dailywebrtc.com` / `.net`)	Call signalling, over WebSocket. WebSocket upgrades to these hosts must be permitted.
`b.daily.co`, `c.daily.co` (and the same on `dailywebrtc.com` / `.net`)	Daily's CDN resources.
`gs.daily.co` (and the same on `dailywebrtc.com` / `.net`)	Dispatch server.
`prod-ks.pluot.blue`	ICE negotiation.

dailywebrtc.com and .net are Daily's fallback domains, mirroring the same servers. They are separate registrable domains, so a wildcard on daily.co does not cover them; each host needs its two twins allowed alongside it.

Media (audio and video)

Host	Ports
`stun.cloudflare.com` `*.stun.twilio.com` (at minimum `global.stun.twilio.com`)	STUN. UDP 3478 and UDP 53.
`turn.cloudflare.com` `*.turn.twilio.com`	TURN. UDP and TCP 3478, UDP 53, TCP 80, TCP 5349, and TCP/TLS 443.
`.wss.daily.co`, `-wss.daily.co` (and the `dailywebrtc` twins)	Direct media to the servers. TCP 443, TCP 40000–49999, UDP 23000–26999, UDP 40000–49999.

Where UDP is closed, as it usually is on a corporate network, TURN over TCP/TLS 443 is the only path media can take. If the TURN hosts are not reachable, the participant appears to join the call and then sees and hears nothing.

Please exempt this traffic from TLS inspection.

WebRTC media is encrypted end to end between the two endpoints. A proxy that decrypts and re-encrypts the STUN, TURN, ICE or media traffic breaks the key exchange, and the symptom is a call that connects but carries no audio or video. Daily's guidance is explicit: exclude STUN, TURN and ICE traffic from inspection. Signalling over WebSocket to the wss hosts should also be allowed to upgrade.

Optional, and safe to block

Host	Purpose
`*.ingest.sentry.io`	The call library's own error reporting, back to its vendor. It carries no conversation content. Blocking it has no effect on the session; we list it only so it is not a surprise in your logs.

Browser requirements

A current Chrome, Edge, Safari or Firefox. On a phone, the built-in browser rather than an in-app browser inside a mail or chat app.
Camera and microphone permission for interview.octovectis.com for the video version. Managed-browser policies that restrict capture, such as Chrome's VideoCaptureAllowedUrls and AudioCaptureAllowedUrls, should include that origin. Otherwise the written version can be used instead.
Site data (localStorage) for interview.octovectis.com, used to save a draft of written answers on the device. The page still works without it; drafts are simply not kept.

If the link itself is blocked

Mail security tools sometimes rewrite or hold links to sites they have not yet categorised. The link is safe to release: the page offers no downloads, no executables and no credential prompts.
The participant can also open the link on a personal device, or on a phone away from the corporate Wi-Fi.
If only the video call is blocked, the written version on the same page is a complete alternative and needs nothing from section 2 or 3.

Questions

Reply to the invitation email, or write to hello@8levers.com. We are happy to talk directly to your security team.

8Levers · www.8levers.com · This page: interview.octovectis.com/it.html