Allowed Networks (IP Allowlist)
Allow your company's console, or the console and the app, only from your own networks, without locking yourself out.
Allowed networks let your company use Kalima only from certain networks. Kalima compares the IP address of every request with your list. This is part of the Enterprise plan.
Open Sign-in & security, find Allowed networks and choose Open. Owners and admins change the list.
Choose where the list applies
Under The list applies to, choose one of three modes:
| Mode | What is checked |
|---|---|
| Off | No addresses are checked. You can still prepare the list and switch it on later. |
| The console only | Your company's console and administration through API keys (the admin API) are reachable only from the networks in the list. The app stays usable from anywhere. |
| Console and app | The console and every use of a company account: web app, desktop app, phone app, public API and AI apps. Signing in from other networks is not possible either. |
Add networks
203.0.113.7) or a range in CIDR notation (203.0.113.0/24, 2001:db8:1200::/48). IPv4 and IPv6 both work. Add a Label (optional), for example the office name.The list holds at most 50 networks.
Do not lock yourself out
Kalima saves a switched-on list only if your current address is in it. The page shows whether your current address is covered. If your company still locks itself out, Kalima support can switch the list off; the entries are kept.
Good to know
- Kalima sees the public address your network has on the internet, not internal addresses such as 192.168.x.x. With a VPN, it is the address of the VPN exit.
- Devices with IPv6 change their address regularly. For IPv6, enter the prefix of your network, such as
/48or/56, not a single address. - Many AI apps (such as Claude and ChatGPT) and Zapier, Make and n8n reach Kalima from their own servers. With Console and app, Kalima refuses these requests unless their addresses are in the list.
- If a device changes networks during a recording, the recording continues to the end. After that the list applies to this device too.
- People outside an allowed network see a page explaining that their company only allows sign-in from certain networks.
- Allowed networks do not apply to Kalima support during an access you granted. See Support access.
What is logged
Every change to the list is in the audit log. Refused requests to the console, the app and the API are there too, at most one entry per person and area every 15 minutes. A refused sign-in also appears in the person's sign-in history.
If your Enterprise plan ends
A list that is switched on stays in force. You can switch it off at any time, but you cannot switch it on again without Enterprise.