Legal Notice & Endpoint/IP Addendum
Legal Notice and Change Management
This document is provided as customer-facing implementation guidance. Customer environments, compliance obligations, firewall capabilities, and third-party integrations vary. Validate all production rules, destinations, payment requirements, and stack assignments with the appropriate PAR, customer, processor, MSP, and compliance owners before deployment.
Appendix D. Official Current Endpoint and IP Addendum
This appendix preserves the exact operational endpoint inventory from the current official PAR POS connectivity source used for this update. Use wildcard/FQDN policy wherever supported. Static IP entries are provided for environments that require explicit objects or where the official source calls out firewall platform behavior.
FQDN-First Rule
Use wildcard/FQDN objects where supported. IP-only allowlists are less resilient and must be reviewed whenever PAR or cloud-provider records change. Meraki environments should also include the static IP table from Option #2 because of known DNS filtering behavior called out in the source.
D.1 Recommended Wildcard Policy
| Destination | Ports | Scope |
|---|---|---|
| *.brinkpos.net | TCP 80, 443, 10051 | PAR POS application, API, install/download, and legacy-branded endpoints |
| *.parpos.com | TCP 80, 443, 10051 | PAR POS cloud, Admin Portal, integration, branded service endpoints |
| sqs.us*.amazonaws.com | TCP 443 | AWS queue service |
| queue.*.amazonaws.com | TCP 443 | AWS queue service |
| firehose.*.amazonaws.com | TCP 443 | AWS Firehose |
| kinesis.*.amazonaws.com | TCP 443 | AWS Kinesis |
| *.s3.amazonaws.com | TCP 443 | AWS S3 |
| *.s3.*.amazonaws.com | TCP 443 | AWS regional S3 |
D.2 Production Static FQDN/IP Inventory - Register Front End and Proxy
| FQDN | Main IP | Secondary IP | Port |
|---|---|---|---|
| regfe1-use1.brinkpos.net | 13.248.159.250 | 76.223.18.221 | TCP 443 |
| regfe2-use1.brinkpos.net | 13.248.141.254 | 76.223.9.227 | TCP 443 |
| regfe1-use2.brinkpos.net | 13.248.152.243 | 76.223.28.216 | TCP 443 |
| regfe2-use2.brinkpos.net | 13.248.151.206 | 76.223.27.195 | TCP 443 |
| regfe1-usw1.brinkpos.net | 13.248.132.197 | 76.223.6.220 | TCP 443 |
| regfe2-usw1.brinkpos.net | 13.248.158.254 | 76.223.17.214 | TCP 443 |
| regfe1-usw2.brinkpos.net | 13.248.153.220 | 76.223.32.217 | TCP 443 |
| regfe2-usw2.brinkpos.net | 13.248.145.241 | 76.223.32.246 | TCP 443 |
| regprx-usw1.brinkpos.net | 13.248.145.195 | 76.223.20.212 | TCP 443 |
| regprx-usw2.brinkpos.net | 13.248.150.201 | 76.223.23.237 | TCP 443 |
| regprx-use1.brinkpos.net | 13.248.148.195 | 76.223.22.242 | TCP 443 |
| regprx-use2.brinkpos.net | 13.248.152.232 | 76.223.30.209 | TCP 443 |
D.3 Production Static FQDN/IP Inventory - PAR Data Processing
| FQDN | Main IP | Secondary IP | Port |
|---|---|---|---|
| prod-sqs-us-west-1.parpos.com | 54.215.219.191 | 184.72.57.5 | TCP 443 |
| prod-firehose-us-west-1.parpos.com | 54.215.219.191 | 184.72.57.5 | TCP 443 |
| staging-sqs-us-west-1.parpos.com | 54.215.219.191 | 184.72.57.5 | TCP 443 |
| staging-firehose-us-west-1.parpos.com | 54.215.219.191 | 184.72.57.5 | TCP 443 |
| prod-sqs-us-west-2.parpos.com | 35.86.27.255 | 35.160.217.94 | TCP 443 |
| prod-firehose-us-west-2.parpos.com | 35.86.27.255 | 35.160.217.94 | TCP 443 |
| staging-sqs-us-west-2.parpos.com | 35.86.27.255 | 35.160.217.94 | TCP 443 |
| staging-firehose-us-west-2.parpos.com | 35.86.27.255 | 35.160.217.94 | TCP 443 |
| prod-sqs-us-east-1.parpos.com | 18.235.53.155 | 18.208.11.213 | TCP 443 |
| prod-firehose-us-east-1.parpos.com | 18.235.53.155 | 18.208.11.213 | TCP 443 |
| staging-sqs-us-east-1.parpos.com | 18.235.53.155 | 18.208.11.213 | TCP 443 |
| staging-firehose-us-east-1.parpos.com | 18.235.53.155 | 18.208.11.213 | TCP 443 |
| prod-kinesis-us-east-1.parpos.com | 3.222.142.57 | 34.239.54.195 | TCP 443 |
| staging-kinesis-us-east-1.parpos.com | 3.222.142.57 | 34.239.54.195 | TCP 443 |
D.4 AWS and S3 Named Endpoints
| Endpoint | Port | Purpose |
|---|---|---|
| sqs.us-east-1.amazonaws.com | TCP 443 | SQS |
| sqs.us-east-2.amazonaws.com | TCP 443 | SQS |
| sqs.us-west-1.amazonaws.com | TCP 443 | SQS |
| sqs.us-west-2.amazonaws.com | TCP 443 | SQS |
| firehose.us-east-1.amazonaws.com | TCP 443 | Firehose |
| firehose.us-east-2.amazonaws.com | TCP 443 | Firehose |
| firehose.us-west-1.amazonaws.com | TCP 443 | Firehose |
| firehose.us-west-2.amazonaws.com | TCP 443 | Firehose |
| kinesis.us-east-1.amazonaws.com | TCP 443 | Kinesis |
| kinesis.us-east-2.amazonaws.com | TCP 443 | Kinesis |
| kinesis.us-west-1.amazonaws.com | TCP 443 | Kinesis |
| kinesis.us-west-2.amazonaws.com | TCP 443 | Kinesis |
| brinkinstoredata-staging.s3.amazonaws.com | TCP 443 | In-store data |
| brinkinstoredata-staging.s3.us-east-1.amazonaws.com | TCP 443 | In-store data |
| brinkinstoredata-prod.s3.amazonaws.com | TCP 443 | In-store data |
| brinkinstoredata-prod.s3.us-east-1.amazonaws.com | TCP 443 | In-store data |
| brink.instorelogging.bucket.us-west-2.s3.us-west-2.amazonaws.com | TCP 443 | In-store logging |
| brink.instorelogging.bucket.us-east-1.s3.us-east-1.amazonaws.com | TCP 443 | In-store logging |
| brink.instorelogging.bucket.us-west-1.s3.us-west-1.amazonaws.com | TCP 443 | In-store logging |
| brink.instorelogging.bucket.us-east-1.s3.amazonaws.com | TCP 443 | In-store logging |
D.5 Early Experience and Upgrade Endpoints
| Endpoint | Port | Use |
|---|---|---|
| admin-earlyexp.parpos.com | TCP 10051 | Early Experience environment |
| https://regfe-staging-use1.brinkpos.net | TCP 443 | Early Experience register front end |
| regprx-staging-use1.brinkpos.net | TCP 443 | Early Experience register proxy |
| install.brinkpos.net | TCP 443 | Register upgrade Install.msi download; CDN hosted in AWS |
D.6 Orbit, Integrations, and Optional PAR Services
| Service | Endpoint / target | Port | Direction / use |
|---|---|---|---|
| Orbit API | Primary Register local IPv4 address | TCP 5000 | Inbound to Primary Register for approved local integrations |
| Orbit MQTT | Configured MQTT broker / Primary Register service | TCP 1883 | Outbound/local trusted LAN as designed |
| Orbit Credentials Portal | instore.integrations.parpos.com/* | TCP 443 | Admin Portal workflow only; not required for register runtime |
| Integrations Portal staging | staging.integrations.parpos.com; *.staging.integrations.parpos.com | TCP 443 | Admin Portal > Integrations Portal |
| Integrations Portal production | prod.integrations.parpos.com; *.prod.integrations.parpos.com | TCP 443 | Admin Portal > Integrations Portal |
| BAS production | api.prod.bas.brinkpos.io; util.prod.bas.brinkpos.io | TCP 443 | Production BAS services |
| BAS staging | api.staging.bas.brinkpos.io; util.staging.bas.brinkpos.io | TCP 443 | Staging BAS services |
| Punchh | https://punchh.com/api/pos; https://isl.punchh.com | TCP 443 | Punchh integration |
| Remote Control | stun.kaseya.com | UDP/TCP 3478 outbound | Optimize remote control and file deployment |
D.7 Remote Care Agent
| Destination | External IP | Cloudflare IP | Port |
|---|---|---|---|
| remotecaredq.partech.com | 161.129.221.125 | 172.65.161.108 | TCP 5721 outbound |
| remotecarece.partech.com | 161.129.221.126 | 172.65.170.224 | TCP 5721 outbound |
| remotecarece2.partech.com | 161.129.221.128 | 172.65.173.102 | TCP 5721 outbound |
| remotecarece3.partech.com | 161.129.221.163 | 172.65.204.177 | TCP 5721 outbound |
| remotecarecd4.partech.com | 161.129.221.164 | 172.65.176.253 | TCP 5721 outbound |
D.8 Managed Services - OS Patch, Datto EDR/AV, and Webroot
| Endpoint | Use |
|---|---|
| update.microsoft.com | Windows Update |
| download.microsoft.com | Windows Update |
| download.windowsupdate.com | Windows Update |
| www.windowsupdate.com | Windows Update |
| vsaupdate.kaseya.net | Kaseya/VSA update |
| Endpoint | Port | Use |
|---|---|---|
| partech2.infocyte.com | TCP 443 | Agent communication |
| *.infocyte.com | TCP 443 | Datto EDR/AV; TLS inspection bypass may be required |
| dl.infocyte.com | TCP 443 | CloudFront-backed downloads |
| wss://servalot-prod.es.datto.net | WSS/TCP 443 | EDR broker |
| wss://servalot-prod.es.datto.net:3030 | TCP 3030 | EDR cloud infrastructure |
| wss://servalot-prod.es.datto.net:3031 | TCP 3031 | EDR cloud infrastructure |
| https://mcb1jewkpb.execute-api.us-east-2.amazonaws.com/ | TCP 443 | Datto EDR API/S3 host |
| https://rollbackinstallers.s3.us-east-2.amazonaws.com/ | TCP 443 | Datto EDR install host |
| https://staging.rollbackcommands.s3.us-east-2.amazonaws.com/ | TCP 443 | Datto EDR command host |
| https://s3.us-east-2.amazonaws.com | TCP 443 | Datto EDR S3 host |
| https://staging.rollback.log.s3.us-east-2.amazonaws.com/ | TCP 443 | Datto EDR log host |
| https://rwdlogs.s3.us-east-2.amazonaws.com/ | TCP 443 | Datto EDR log host |
| https://7j3e2hyns2.execute-api.us-east-2.amazonaws.com/ | TCP 443 | Datto EDR API host |
| https://rbinstallers.s3.us-east-2.amazonaws.com | TCP 443 | Datto EDR installer host |
| https://prod-rollbacklogs.s3.us-east-2.amazonaws.com/ | TCP 443 | Datto EDR log host |
| https://s3.us-east-2.amazonaws.com/ | TCP 443 | Datto EDR S3 host |
| https://prod-rollbackmetrics.s3.us-east-2.amazonaws.com/ | TCP 443 | Datto EDR metrics host |
| https://rwdlogs.s3.us-west-2.amazonaws.com/ | TCP 443 | Datto EDR log host |
| https://infocyte-downloads.s3.us-east-1.amazonaws.com | TCP 443 | Datto EDR downloads |
| query-api.eu1.apc.avira.com | TCP 443 | Datto AV Windows |
| fpc-rest.tl.avira.com | TCP 443 | Datto AV Windows |
| v2.web-rep.auc.avira.com | TCP 443 | Datto AV Windows |
| download.avira.com | TCP 443 | Datto AV Windows |
| api.mixpanel.com | TCP 443 | Datto AV Windows |
| prod-auth.eu1.apc.avira.com | TCP 443 | Datto AV macOS/Linux |
| prod-query.eu1.apc.avira.com | TCP 443 | Datto AV macOS/Linux |
| prod-upload.eu1.apc.avira.com | TCP 443 | Datto AV macOS/Linux |
| prod.tl.avira.com | TCP 443 | Datto AV macOS/Linux |
| Endpoint | Port | Use |
|---|---|---|
| *.webrootcloudav.com | TCP 80/443 | Agent communication and updates |
| *.p4.webrootcloudav.com or *.*.webrootcloudav.com | TCP 80/443 | Use if firewall cannot represent double-dotted subdomains with one wildcard |
| *.webroot.com | TCP 443 | Agent messaging |
| https://wrskynet.s3.amazonaws.com/* | TCP 443 | File download/upload |
| https://wrskynet-eu.s3-eu-west-1.amazonaws.com/* | TCP 443 | File download/upload |
| https://wrskynet-oregon.s3-us-west-2.amazonaws.com/* | TCP 443 | File download/upload |
| WSAWebFilteringPortal.elasticbeanstalk.com | TCP 80/443 | Web filtering |
| *.webrootanywhere.com | TCP 80/443 | Management portal/support logs |
D.9 PAR Pay
| Flow | Source | Destination | Transport / port | Requirement |
|---|---|---|---|---|
| PAR POS PAR Pay | PAR POS register static IP | PAR Pay component | TCP 8030 | Mx and Ingenico |
| CCT Software Downloads | Payment component | CCT static IP range | Mx TCP 22; Ingenico TCP 990 and TCP 64000-64500 | Software downloads |
| CCT Transaction Processing | Payment component | CCT static IP range | TCP 443 | Transaction processing |
| Verifone software download primary | Verifone device | pos1.auruspay.com / 198.22.206.246 | TCP 22 | Production outbound |
| Verifone software download secondary | Verifone device | pos41.auruspay.com / 209.236.103.68 | TCP 22 | Production outbound |
| Ingenico software download primary | Ingenico device | pos1.auruspay.com / 198.22.206.246 | Active TCP 990; passive TCP 64000-64500 | Production outbound |
| Ingenico software download secondary | Ingenico device | pos41.auruspay.com / 209.236.103.68 | Active TCP 990; passive TCP 64000-64500 | Production outbound |
D.10 Third-Party Integrator Notice
Third-party vendors outside the PAR POS product suite must provide their own current connectivity requirements. Common examples listed in the source include LevelUp, TokenEx, Incomm, TSYS, WorldPay, Mercury Payments, First Data, SVS, Verifone Point, Heartland, Hypercom, Vantiv, Givex, Paytronix, Valutec, and NCR Loyalty.