Network and firewall

This page lists every network connection BioTrack makes, so IT staff can set up firewalls, proxies and allowlists. All connections to the BioTrack cloud are outbound HTTPS on port 443; nothing on the internet connects in to the PC.

From the BioTrack PC

Address	Used for	When
sync.biotrack.co.zw	Linking the PC, the daily licence check, cloud reporting, health reports every 15 minutes, and update checks and downloads	Needed once to link the PC; then whenever it is online
sync.biotrack.alcra.co	The same service under its earlier name	Still answered; see below

The PC needs no internet connection to keep collecting once it is linked. Without one, it simply does not report to the cloud, check its licence or update until the connection returns.

The PC’s Windows clock must be within five minutes of the correct time. The cloud refuses signed requests from a PC whose clock is further out.

Moving from sync.biotrack.alcra.co

BioTrack moved from the biotrack.alcra.co addresses to biotrack.co.zw. Both are served by the same cloud:

• PCs linked through sync.biotrack.alcra.co keep working, and move to sync.biotrack.co.zw by themselves at their next daily licence check.
• A PC that can reach only the old address stays on it and tries to move again the next day.
• New PCs link through sync.biotrack.co.zw.

Allow both while PCs move

If your firewall allows only listed addresses, allow sync.biotrack.co.zw as well as sync.biotrack.alcra.co. Do not remove the old address until Alcra says it is retired.

From your administrators’ browsers

Address	Used for
app.biotrack.alcra.co	The BioTrack portal: signing in with passkeys, approving PC links, attendance, team and billing.
app.biotrack.co.zw	The same portal under its new name. Passkeys do not work here yet, so use app.biotrack.alcra.co for now.
www.paynow.co.zw	Paying for cloud reporting. The portal sends the payer to Paynow and Paynow returns them.
biotrack.co.zw	This documentation. biotrack.alcra.co redirects here.

Any device can be used to approve a PC link, including a phone. Open the portal on this PC on the link screen opens app.biotrack.alcra.co in the PC’s browser.

Email

Invitations, account recovery links and subscription reminders come from no-reply@biotrack.co.zw. If your mail system filters by sender, allow it, or invitations and recovery links will not arrive.

On the local network

These connections stay on the site’s network and never involve the internet.

From	To	Used for
The terminal	The PC, on the callback port chosen at setup (default 8089)	Sending each scan to BioTrack. A Windows firewall rule created during setup allows only the configured terminal’s address on that port.
The PC	The terminal, over HTTPS or HTTP Digest (as chosen at setup)	Checking the terminal, setting its callback and reading the employee list.

Both devices need private IPv4 addresses, and the terminal needs a fixed address. See Requirements and Terminal and connection.

Troubleshooting

Symptom	Check
The link screen cannot get a code	The PC can reach https://sync.biotrack.co.zw, and its clock is correct.
The portal cannot be reached, or passkeys are refused	You are on app.biotrack.alcra.co, not app.biotrack.co.zw.
Cloud reporting stays on Retrying	The PC can reach sync.biotrack.co.zw (or sync.biotrack.alcra.co if it has not moved yet). See Sync status.
Settings → About & support shows an update problem	The PC can reach sync.biotrack.co.zw (or sync.biotrack.alcra.co if it has not moved yet), which also serves the updates. See Updates.
Invitations or recovery emails do not arrive	Spam filters, and that no-reply@biotrack.co.zw is allowed. The portal sends at most three emails an hour to one address.