Browser and network access

Basefund in your browser

What your browser and your organization’s network need to allow so Basefund keeps you signed in and remembers the devices you trust.

Everything Basefund runs on one domain and its subdomains

*.basefund.com

Signing in, the application itself, and the data service behind it all live under basefund.com. If your organization keeps a list of allowed sites, this one entry covers all of it. Two more hosts matter: documents you open are served from Google Cloud Storage, and the sign-in screens load their images and fonts from our sign-in provider. Both are listed below.

Allow by hostname, not by IP address. Our traffic is served through Cloudflare, and the addresses change without notice.

Asked to sign in, or to trust your device, more than you expect?

Basefund keeps you signed in for up to 18 hours of use, and remembers a device you trust for a year. If you are asked to sign in every time you open your browser, or asked to trust a device you already trusted, your browser is not keeping the small files that record that. Almost always, a setting or policy is deleting them when the browser closes.

Try this first · takes one minute

Check what your browser keeps

Sign in to Basefund and choose Trust this device when asked.
Close every browser window, then open the browser again.
Go to app.basefund.com.

Still signed in, and not asked to trust the device again? Everything is working. Asked again? Your browser discarded what we saved. The causes are below, and the For IT administrators section has the fix.

A private or incognito window always asks again, which is what those windows are for.

If your organization manages your browser

Ask IT to let basefund.com keep its cookies

Managed browsers and virtual desktops are often set to delete cookies when they close. An exception for basefund.com fixes this for everyone in the organization at once.

Forward the For IT administrators section below to your IT or security team. It has everything they need.

How Basefund keeps you signed in

When you sign in, we store two small cookies on app.basefund.com that carry your session. When you choose Trust this device, our sign-in service stores one more on auth.app.basefund.com. All three are first-party cookies: set by basefund.com, read only by basefund.com, never shared with anyone else. Nothing about signing in depends on your IP address or location, so moving between the office, home, and a VPN changes nothing.

30 minutes

a session token lasts, renewed while you work

18 hours

the longest a sign-in lasts before we ask again; 8 hours idle ends it sooner

1 year

a trusted device stays trusted

If any of those cookies is missing on your next visit, the next visit starts from scratch. The usual causes:

Clear-on-exit policies

Managed Chrome and Edge are often configured to delete cookies and site data when the last window closes. Everything we saved goes with them, so the next visit means signing in again and trusting the device again.

Session-only cookies

A cookie setting that keeps data only until the browser closes has the same effect. In Chrome it reads Delete data sites have saved to your device when you close all windows.

Virtual and shared desktops

Non-persistent virtual desktops, kiosk profiles, and machines that reset the browser profile at sign-out discard cookies by design. Every desktop session is a brand-new browser.

Security gateways

A gateway that inspects HTTPS traffic can strip or rewrite the cookie our sign-in service sets on auth.app.basefund.com. Sign-in still works, but the device is never remembered.

Blocked hosts

If app.basefund.com, api.basefund.com, or auth.app.basefund.com is blocked, the application or the sign-in screen will not load at all. If storage.googleapis.com is blocked, documents will not open.

Private windows

Incognito and InPrivate windows keep nothing between sessions. That is normal.

Opening Basefund from a link in web-based email may pause on our home page for a moment before taking you to the page you asked for. That is expected and does not sign you out. Links opened from a desktop mail client, a bookmark, or the address bar go straight through.

Quick checks

Close every browser window and reopen. If you are still signed in, your browser is keeping our cookies.
After signing in, open your browser’s developer tools, then Application, then Cookies. You should see cookies for app.basefund.com (DS and DSR) and for auth.app.basefund.com, each with an expiry date in the future rather than Session.
Try a different browser on the same computer. If it behaves, the first browser’s settings or policy are the cause.
If the sign-in screen is blank or never finishes loading, check that auth.app.basefund.com and descopecdn.com are reachable from your network.
If documents will not open or download, check storage.googleapis.com.

For IT administrators

Basefund is a web application served entirely over HTTPS on port 443 from basefund.com and its subdomains, behind Cloudflare. Allow by hostname rather than IP address: the addresses change and we do not publish them. Nothing is installed on the workstation, no third-party cookies are used, and no browser security setting needs to be lowered.

Hosts to allow

`app.basefund.com`	RequiredThe application, including its session checks and the error reports your browser sends us.
`api.basefund.com`	RequiredThe data service the application calls (HTTPS requests only; no WebSockets).
`auth.app.basefund.com`	RequiredSign-in: passkeys, email and text-message codes, Microsoft and Google sign-in, and the trusted-device cookie.
`.descope.com` `.descopecdn.com`	RequiredImages, fonts, and styles for the sign-in screens, served by our sign-in provider.
`storage.googleapis.com`	RequiredDocuments and attachments users open or download.
`basefund.com`	RequiredThis website, and where links in our email land.
`login.microsoftonline.com` `accounts.google.com`	OptionalOnly for users who sign in with a Microsoft or Google account.
`fonts.googleapis.com` `fonts.gstatic.com`	OptionalFonts. If blocked, text renders in a system font.
`.intercom.io` `.intercomcdn.com` `.intercom-messenger.com` `.intercomassets.com`	OptionalThe in-app Help and chat button. If blocked, the button is missing and nothing else changes. Chat uses WebSockets.
`*.cobrowse.io`	OptionalScreen sharing, used only when a user starts a support session with us. Uses WebSockets.
`plausible.io`	OptionalPrivacy-friendly usage analytics, with no cookies and no personal data.

Cookies and storage

`DS`, `DSR` on `app.basefund.com`	Session and refresh cookies. First-party, `Secure`, `SameSite=Strict`, restricted to that one host. `DS` expires after 30 minutes and is renewed while the user works; `DSR` expires after 18 hours.
Trusted device on `auth.app.basefund.com`	Set by our sign-in service when a user chooses Trust this device. First-party, valid for one year. Without it the user is asked to trust the device on every sign-in.
Third-party cookies	None. Every cookie is set and read by the same basefund.com host, so third-party cookie blocking and tracking prevention do not affect Basefund.
Local storage	Preferences only: dismissed announcements and product tours. Signing in does not depend on it.

Managed browsers, gateways, and virtual desktops

Google Chrome	Add `[.]basefund.com` to `CookiesAllowedForUrls`, and make sure it is not covered by `CookiesSessionOnlyForUrls` or by a `ClearBrowsingDataOnExitList` that includes cookies and site data. On an unmanaged machine: Settings* › Privacy and security › Third-party cookies › On-device site data, then either turn off Delete data sites have saved to your device when you close all windows or add basefund.com under Allowed to save data on your device.
Microsoft Edge	Add `[.]basefund.com` to `CookiesAllowedForUrls`. If `ClearBrowsingDataOnExit` is enabled, also list `[.]basefund.com` in `SaveCookiesOnExit`.
Security gateways and HTTPS inspection	Exclude `*.basefund.com` from HTTPS inspection, or at least make sure the gateway passes `Set-Cookie` headers from `auth.app.basefund.com` through unchanged. Applies to Zscaler, Netskope, Palo Alto, Fortinet, Network Box, and similar.
Virtual desktops	Persist the browser profile, or at least its cookies, between sessions (roaming profiles, FSLogix, Citrix Profile Management, or the equivalent for Windows 365 and Amazon WorkSpaces). A non-persistent desktop presents a brand-new browser every session.

Basefund never needs third-party cookies, never installs software, and never asks anyone to lower a browser security setting.

What we do on our side

Everything is served over HTTPS from basefund.com and its subdomains. The application, sign-in, and the data service each have their own hostname, so each can be allowed precisely.
Session cookies are first-party and locked to the host that set them. They are never shared across subdomains or with any other site.
Trusting a device is remembered by a cookie, not by your location, so VPNs, travel, and office moves never trigger new prompts on their own.
Error reports from your browser go to app.basefund.com, not to a third-party service.
We do not rely on fixed IP addresses, and we never ask you to allow any.

Still being asked to sign in?

Email support@basefund.com with the browser you use, whether your organization manages it, and what you see. If your IT team can include the output of chrome://policy or edge://policy from the affected computer, that usually settles it in minutes.