Required Software

This Policy applies to the following components of the MazeVault Applications:

This Policy does not apply to:

• the Customer’s infrastructure (hardware, OS, network infrastructure, Kubernetes cluster, database, backups, monitoring, physical security) — the Customer alone is responsible for these areas, unless expressly agreed otherwise;
• the Partner’s infrastructure (where the Customer uses the Partner’s cloud operation) — the Partner is responsible for this;
• the Customer’s application code or integration logic created by the Customer on top of the Applications’ API;
• third-party services integrated with the Applications (Azure Entra ID, Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, external CA) — these are governed by the terms of the respective third parties;
• custom development and professional services — governed by a separate work contract;
• training and certification — governed by a separate agreement.

Support operates under the following model:

External ports:

• TCP 443 for HTTPS
• TCP 80 for redirect to HTTPS

Internal ports that must not be publicly exposed to the Internet without proper firewall protection or another adequate means under the License Terms:

• TCP 8080 for the API
• TCP 8081 for OCSP
• TCP 5432 for PostgreSQL
• TCP 6379 for Redis

Outbound communication depending on the functions used:

• HTTPS 443 to the MazeVault License Server – https://license.mazevault.com
• HTTPS 443 to Azure Entra ID when using SSO
• HTTPS 443 to Azure Key Vault or other external vaults when using integrations
• HTTPS 443 to an external CA when using external certification authorities
• HTTPS 443 to the MazeVault agent / proxy when used in hybrid infrastructure mode outside the LAN
• UDP 123 to an NTP server for time synchronization
• TCP 1433, 1521, 5432 and others to various database platforms for database integrations for the management and rotation of Secrets and Certificates
• any custom ports chosen by the Customer when integrating components with the MazeVault system (JIRA, Teams, e-mail, SIEM, ELK, Slack and other existing or newly added integrations)

Software and services required for standard operation of the Applications:

• PostgreSQL 15+;
• Redis 7.x+;
• Docker Engine 24+ or Podman;
• Docker Compose 2.20+ or podman-compose;
• Nginx 1.24+ or another reverse proxy or ingress equivalent;
• a web browser in a supported version.

Software and services required for the Kubernetes operating variant:

• Kubernetes 1.28+;
• Helm 3.12+;
• kubectl 1.28+;
• Azure CLI 2.50+;
• External Secrets Operator and Workload Identity when using the customer Azure model with Azure Key Vault.

Conditionally required software or services when the corresponding functions are used:

• Azure Entra ID when using SSO;
• Azure Key Vault, AWS Secrets Manager or HashiCorp Vault when using external secrets or key management;
• external CA systems when issuing certificates outside the internal CA;
• HSM when deploying HSM functions.

The Customer acknowledges that, in addition to the Provider’s License, licenses or authorizations to third-party software and services governed by the terms of the respective third parties may also be necessary for proper use of the Applications.

Versions marked “security updates only” are technically supported by MazeVault software but may not meet the stated contractual minimum of Rocky Linux / RHEL 9+, PostgreSQL 15+ and Redis 7.x+. Customers running older versions do not meet the minimum technical requirements of the Agreement; the Provider may proceed under the terms of the relevant agreement.