Overview
On your internal network, one wired connection lets staff use Matrix from their computers. If you enable an outside service, the agent can read from it or, where needed, send to it. Each request carries what the agent sends, such as search terms. Most teams never enable outside access.
Deployment modes
| Mode | Network connection |
|---|---|
| Fully isolated | None. Approved staff use the system directly. |
| On your internal network | One wired connection. Staff reach Matrix in a browser. Matrix can call internal systems through its API if you allow it. |
| Separate systems per team | One wired connection per system, each on its own segment. |
| Approved outside services | Agents reach only the outside services your IT team approves. Each request carries what the agent sends, such as search terms. |
Physical connection
| Item | Requirement |
|---|---|
| Connection type | Wired Ethernet |
| Configuration | Connection requirements agreed with your IT team before signing |
| Wireless | None. Wi-Fi and Bluetooth are disabled at the factory. |
Addressing
- Assign one static IP address on your internal network.
- Optionally create an internal DNS name, for example
matrix.yourcompany.internal.
Ports
Inbound, from your users' computers to Matrix:
| Service | Purpose |
|---|---|
| Web access | Matrix Workspace and admin console |
| Internal API | Only if enabled |
Outbound, only if your IT team approves outside services:
| Service | Purpose |
|---|---|
| Approved outside service | An agent reads from, or where needed sends to, one service |
Matrix accepts no requests from outside your company network.
Connection requirements, permitted services and integration scope are supplied with your agreement, so your IT team can prepare the firewall rules before installation.
No internet connection is required. Matrix connects to an outside service only if your IT team approves it, and only to that service.
If you enable connections to internal systems (for example a document store or an ERP), list each destination and port in your firewall rules. Matrix connects only to the internal destinations you allow.
Recommended firewall rules
- Place Matrix on its own network segment or VLAN.
- Allow inbound traffic to Matrix only for the services above, only from the user networks that need it.
- Deny all outbound traffic from Matrix to the internet, except to the outside services you approve. To inspect what each approved request carries, route it through your own proxy.
- If internal connections are enabled, allow only the specific destinations and ports required.
- Log all traffic to and from the Matrix segment.
How to confirm the external network boundary
- Apply the rules above, with logging on the deny rule.
- Test representative tasks against the network acceptance plan agreed with your team.
- Review traffic beyond your company network separately from permitted internal traffic: expect no connection in the standard setup, and only connections to the services you approved if you enabled any.
- Report unexpected external attempts for investigation. Blocking traffic is not evidence that every component has been independently assessed.
Identity
MFA protects sign-in. Directory integration and its access requirements are confirmed for your environment during scoping.