Network and firewall

Every address PDF Studio connects to and why, what to allow through your firewall and proxy, and how it runs on a fully isolated network.

For network and security administrators

In short

  • Only one address is required: pdfstudio-licence.elixtechs.com over HTTPS (port 443), outbound. Versions 1.2.0 and earlier use the former address pdfstudio-licence.nmteches.com instead, which stays in service.
  • No content from your documents is ever sent over the network.
  • No telemetry. Since 1.2 the app checks once a day whether a newer version exists (sending only the version and processor type), and sends error reports only if the user agrees. IT can turn both off by policy (see Isolated networks).
  • No inbound ports are needed.

Required

HostPortWhenWhat is sent
pdfstudio-licence.elixtechs.com 443 (HTTPS) Activation, then background renewal (about every two weeks by default), and deactivation The licence key, the hashed machine ID, the computer name, and the app and Windows versions
pdfstudio-licence.nmteches.com 443 (HTTPS) The same, for versions 1.2.0 and earlier, which carry the company’s former name (NMTeches). Allow it while any PC still runs one of them. As above

The server sits behind Cloudflare, and its IP addresses can change — allow the hostname, not an IP address.

Optional

These happen only when a user chooses to install an add-on from Settings. If you block them, every core tool still works, and add-ons can be installed from files downloaded on another machine.

HostPurpose
github.com and its download serversTesseract OCR, OCR language files, and the AI assistant engine
digi.bib.uni-mannheim.deFallback source for Tesseract OCR
download.documentfoundation.org and its mirrorsLibreOffice
huggingface.co and its download serversAI packs
pdfstudio.elixtechs.comHelp menu links in the browser; since 1.2 also the daily update check, the built-in OCR download on first use, and error reports if the user agrees
pdfstudio.nmteches.comThe former name of the address above, which 1.2.x versions ask for updates and the OCR pack and send error reports to. The files themselves then come through pdfstudio.elixtechs.com.
s3.elixtechs.comSince 1.2: the files themselves when installing an update or downloading the built-in OCR (a short-lived link it is redirected to)

These sites redirect downloads to content networks whose addresses change. If your policy doesn’t allow that, download the files once and install them with the From file button.

Local connections

The app’s interface talks to its own PDF engine over 127.0.0.1 on a random port, protected by a token that changes every launch. It never leaves the PC and needs no firewall rule. If a local firewall asks about pdfsvc.exe, it does not need network access.

Proxies and TLS inspection

  • Proxy: since version 1.0.4 the licence check uses the Windows proxy settings, including PAC files and automatic detection (WPAD), just as the browser does. Allow pdfstudio-licence.elixtechs.com:443 (and pdfstudio-licence.nmteches.com:443 for 1.2.0 and earlier) through the proxy. Proxies that demand an interactive sign-in are not supported — exempt the host from authentication.
  • TLS inspection: since version 1.0.4 the app trusts the Windows certificate store, so it works behind inspection appliances whose root certificate is installed on the PCs. This does not weaken licensing: the activation record is signed and verified locally.
  • Older versions (1.0.3 and earlier): connect directly without the proxy and reject inspection certificates. Allow direct access and exclude the host from inspection, or upgrade to the latest version.
  • Redirects: the app refuses redirects from the licence server, so captive portals show up as a connection error.

To test from a PC: open https://pdfstudio-licence.elixtechs.com/health/live in a browser — it should show Healthy.

Large networks

The licence server limits requests from each public IP address. If you deploy to hundreds of PCs behind one address and they all start at once, some may show “The licence server is busy. PDF Studio will try again shortly.” — that’s expected, and the app retries by itself. If you can, roll out in batches.

Isolated networks

PDF Studio runs on networks with no internet access at all:

  1. Install the app in any format.
  2. Activate each PC with offline activation — valid for a year, renewed with a new code.
  3. For add-ons: download their files on a connected machine, move them by your approved method, and install them with From file. The built-in OCR (since 1.2) is PDF-Studio-OCR-Pack-<version>.zip on the download page.
  4. Since 1.2, turn off the update check and error reports for every user of a PC with two registry values (through Group Policy or Intune):
    HKLM\SOFTWARE\Policies\NMTeches\PDF Studio
    DisableUpdateCheck = 1 (DWORD)
    DisableErrorReports = 1 (DWORD)

Planning a large rollout on an isolated network? Talk to us and we’ll agree how to issue activation codes in bulk.

Didn’t find what you need?

Check the FAQ, or write to us and we will reply within one working day.

Contact support FAQ