Self-hosted Retool egress connections
Learn about external connections and data egress from self-hosted Retool deployments.
| Self-hosted Retool Availability | |||
|---|---|---|---|
| Self-hosted Edge | Generally Available | ||
| Self-hosted Stable | Generally Available | ||
Self-hosted Retool is available on an Enterprise plan only.
Self-hosted Retool deployments connect to external Retool services for licensing, user management, and usage reporting. Understanding these egress connections helps you configure firewall rules and understand what data leaves your infrastructure.
Retool services
Self-hosted Retool deployments connect to the following external Retool services:
License checks
Retool uses HTTP to connect to licensing.tryretool.com on port 443 to verify your license. License checks are made at least once a day.
Inviting users
Retool connects to invites.tryretool.com and email-service.retool.com on port 443 when inviting users. Retool verifies the users are authorized under your current billing plan, and then sends an invite to their email address.
Usage reporting
Retool sends application usage information to p.tryretool.com on port 443, which is used to inform product decisions.
Usage categories
The categories of usage information sent to Retool includes, but is not limited to, the following:
- Page views, along with the page URL.
- Query saves, including the query name and type.
- Component creation and the component type.
- Query preview, including the query name and type.
- Adding a resource, including the resource name and type.
Events are also sent with the hostname, public IP address, browser user-agent string, and the user's email address.
Retool AI
Self-hosted customers can deploy and embed Retool AI within apps and workflows. When a user performs any action with Retool AI, the input is shared with the applicable third-party LLM provider, listed in our Subprocessors page. Inputs are deleted within 30 days.
You can configure a direct connection to a supported AI platform by providing an API key. You also have the option to use a Retool-managed OpenAI connection. If enabled, AI requests are proxied through Retool The Retool-managed OpenAI connection is disabled by default. Contact your Retool account representative or our support team to gain access.
For production use cases, we recommend you provide an API key and directly connect to an AI platform.
When Retool AI is used to build or configure a query, application, or workflow (e.g., prompting Ask AI to help write queries), any inputs or outputs that correspond to the categories above may continue to be used to inform product improvements. Retool does not use any inputs submitted to, or outputs generated from, Retool AI that is embedded within a deployed application or workflow (e.g., text stored in Retool Vectors). These inputs and outputs are treated as "Customer Data" in according with the Customer Terms of Service, Security Practices, and Data Processing Addendum.