Bonito PDF · Bonito Scan
Relay server: information for network administrators
Bonito PDF (version 2.1 and later, for Mac and Windows) receives scanned PDFs from Bonito Scan (version 2.0 and later, for iPhone and iPad). The two apps first try a direct connection over the local network. When that is not possible (for example on a managed Windows PC, or when the phone is on another network), both apps send ordinary HTTPS requests to Seared Bonito's relay server, relay.prod.searedbonito.com, which passes the end-to-end encrypted data from one app to the other. No WebSocket is used. This page is for network and security administrators who need to allow it.
What to allow
| Host | relay.prod.searedbonito.com Served by Cloudflare. Its IP addresses are Cloudflare's and can change, so allow the host name rather than addresses. |
|---|---|
| Port and direction | TCP 443, outbound only, from the computer and from the iPhone or iPad. Nothing inbound. |
| Protocol | Ordinary HTTPS (TLS 1.2 or later) request and response, nothing else: HTTP/1.1 POST requests to the paths /r1/h/open, /r1/h/x, /r1/g/open and /r1/g/x, and GET /r1/health, with Content-Type application/octet-stream, a User-Agent that names the app, and request headers whose names begin with "Bonito-Relay". No WebSocket permission is needed: the apps use no WebSocket and no HTTP upgrade. Any query string that a proxy appends to a request is ignored. The apps send a request about every 25 seconds while nothing is being transferred; the relay answers each request within about 55 seconds and a request carries at most about 1 MiB. A proxy that holds or closes requests sooner than that, or that sandboxes unknown binary bodies, can slow a transfer; allowing the host avoids it. |
| Proxy | The apps use the operating system's proxy settings, including PAC files and WPAD and, on Windows, settings applied by Group Policy. A proxy that asks for Negotiate or NTLM sign-in is answered with the signed-in Windows account, and on a Mac with the credentials in the Keychain. The apps never ask for a password. |
| TLS inspection | The apps do not pin certificates. They trust the operating system's certificate store, including enterprise root certificates deployed by MDM or Group Policy, so an inspecting proxy whose root certificate the device trusts works. TLS inspection is fine and the host does not need to bypass it: the content is end-to-end encrypted, so an inspecting proxy sees the request headers and encrypted bodies, never the key, the code, file names or PDFs. If the device does not trust the proxy's root certificate, the request fails and the app says that the network's security software intercepts the connection. |
| URL filtering | If your filter blocks new or uncategorised hosts, add relay.prod.searedbonito.com to its allow list. |
What passes through the relay
- The transfer is encrypted end to end between the two devices (P-256 key agreement, AES-256 and HMAC-SHA256), with a one-time key that is in the QR code shown by Bonito PDF and is never sent to the relay. The relay, Cloudflare and an inspecting proxy see only encrypted data.
- Besides the encrypted data, the relay sees identifiers of the connection derived from the QR code that do not reveal the key, the IP addresses of the devices, the time, duration, amount of data and number of requests of each connection, and the app's name and version.
- Nothing is stored. The apps pass data on with repeated HTTPS requests; data waiting to be collected is held only in the relay's memory, for at most 60 seconds, and is never stored. The relay keeps no files, names or logs; it keeps only daily usage counts, which are deleted within 24 hours. The details are in the privacy policies of Bonito PDF (Article 9, paragraph 8) and Bonito Scan (Article 9, paragraph 6).
Not using the relay
- In Bonito PDF, choose Direct only as the connection method of Receive from Bonito Scan; the QR code then carries nothing for the relay. In Bonito Scan, turn off Settings › Use internet connection.
- To keep a whole network off the relay, block relay.prod.searedbonito.com. The apps then connect only over the local network.
Direct connections on the local network
- While the Receive from Bonito Scan panel is open and the connection method is Automatic or Direct only, Bonito PDF accepts TCP connections from the phone on the computer's private local-network addresses, on a port chosen by the operating system. These connections never leave the local network.
- On Windows, the Microsoft Store version of Bonito PDF declares a firewall rule for this (inbound TCP, Domain and Private profiles). When Windows has no rule that allows Bonito PDF and the user is not an administrator, the app does not listen at all, so no firewall prompt appears and no Block rule is created; it uses the relay instead. To allow direct transfers on managed PCs, allow inbound TCP for the Bonito PDF application on the Domain and Private profiles.
- On a Mac and on the iPhone or iPad, the operating system asks the user once to allow the app to use the local network.
Contact
Questions from network administrators: support@searedbonito.com