Install on a Managed Network

Allowlist

Allow outbound HTTPS (TCP/443) to:

licensing.binaryintelligence.ai
binaryintelligence.ai
*.binaryintelligence.ai
downloads.binaryintelligence.ai
mimir.binaryintelligence.ai

The downloads host fronts an Azure Blob CDN; if your proxy uses SNI-based allowlisting, the SAS-signed download URLs will work.

TLS inspection / MITM proxies

The client pins the C2Consultants signing key ring for license signature verification — this is independent of the TLS chain to the website and is not affected by TLS inspection.

For HTTPS interception of API calls, install your inspection-proxy root CA in the Windows trust store. The client uses the system trust store (no custom pinning to the TLS chain).

HTTP proxy

The client honors the system proxy (WinHTTP / WinINET). For explicit configuration:

netsh winhttp set proxy proxy-server="http=proxy.corp.local:8080;https=proxy.corp.local:8080" bypass-list="<local>"

To override at install time:

msiexec /i BinaryIntelligenceClient.msi /qn HTTPS_PROXY=http://proxy.corp.local:8080

GPO / Intune mass deployment

Use a software-deployment package or Intune Win32 app. To pre-activate during install (so no end-user input is required):

msiexec /i BinaryIntelligenceClient.msi /qn ACTIVATION_KEY=XXXX-XXXX-XXXX-XXXX

The installer hashes the key, hands it to the client service, and discards the plaintext. Use a single SMB-tier activation key across all machines up to the seat count.

Air-gapped segments

Fully air-gapped operation requires the Enterprise on-prem Server tier. The standalone Home/SMB clients require periodic license refresh (~6h) and Mimir corpus access.

For partially-isolated segments, a single internal HTTPS relay to *.binaryintelligence.ai is sufficient; the client does not require direct internet on every endpoint.

Need a deeper review?

Larger deployments get a deployment-architecture review free of charge. Talk to sales.