diff --git a/docs.json b/docs.json
index 7bc6e57..a3620c0 100644
--- a/docs.json
+++ b/docs.json
@@ -181,6 +181,7 @@
                                     "manage/remote-node/config-file"
                                 ]
                             },
+                            "manage/endpoints-and-pops",
                             "manage/integration-api",
                             "manage/branding"
                         ]
diff --git a/manage/endpoints-and-pops.mdx b/manage/endpoints-and-pops.mdx
new file mode 100644
index 0000000..dfb4889
--- /dev/null
+++ b/manage/endpoints-and-pops.mdx
@@ -0,0 +1,62 @@
+---
+title: "Endpoints & Relays"
+icon: "network-wired"
+description: "Pangolin Cloud hostnames for firewall allowlists and network whitelisting"
+---
+
+import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
+
+<PangolinCloudTocCta />
+
+<Note>
+This page applies to [Pangolin Cloud](https://app.pangolin.net/auth/signup) only. If you self-host Pangolin, see [DNS & Networking](/self-host/dns-and-networking) for the hostnames and ports on your own deployment.
+</Note>
+
+Use this page when you need to allowlist Pangolin in a corporate firewall, proxy, or egress policy. Sites, clients, and browsers connect to two classes of infrastructure on Pangolin Cloud: the **control plane** and **points of presence** (also called relays).
+
+## Control Plane
+
+The control plane is the central Pangolin service that runs the dashboard, REST API, authentication, and configuration orchestration.
+
+| Hostname | Purpose |
+| --- | --- |
+| `app.pangolin.net` | Dashboard, API, authentication, and WebSocket configuration for sites and clients |
+
+Sites and clients use this hostname as their **endpoint**. For example, Sites connect here to register, receive policy, and maintain their control channel.
+
+## Points of Presence
+
+Points of presence (PoPs), also called relays, are the networking edge where sites and clients connect for data traffic.
+
+| Hostname |
+| --- |
+| `uranus.pop.pangolin.net` |
+| `mars.pop.pangolin.net` |
+| `earth.pop.pangolin.net` |
+| `jupiter.pop.pangolin.net` |
+| `saturn.pop.pangolin.net` |
+| `neptune.pop.pangolin.net` |
+| `pluto.pop.pangolin.net` |
+| `mercury.pop.pangolin.net` |
+
+### What PoPs Do
+
+- **Public resources** send all traffic through a PoP.
+- **Private resources** use PoPs to coordinate [NAT traversal](/manage/clients/nat-traversal) between a client and a site. If hole punching fails, traffic relays through the PoP instead.
+
+Pangolin sites and clients automatically select the most optimal PoP to connect to. You do not choose a PoP manually during normal operation.
+
+## Remote Nodes
+
+If you use [remote nodes](/manage/remote-node/understanding-nodes), the point of presence (relay) for your traffic is your self-hosted node, not the cloud PoPs listed above.
+
+The control plane endpoint for dashboard access, API calls, and authentication remains `app.pangolin.net`.
+
+## Whitelisting Checklist
+
+To allow Pangolin Cloud on an outbound firewall or proxy, permit traffic to:
+
+1. `app.pangolin.net` for the control plane
+2. All `*.pop.pangolin.net` hostnames listed above for site and client data traffic
+
+If you use remote nodes, also allow traffic to your remote node's public hostname or IP address.