For IT teams
MedJot is a browser-based clinical documentation tool used by clinicians on phones, tablets and desktops. It is a Progressive Web App: there is no installer, no app store package and no MDM app to deploy.
This section is written for the people who have to approve it, connect it and support it.
If you only do one thing
Add medjot.app and *.medjot.app to your TLS/SSL do-not-decrypt list.
TLS interception is the single most common reason MedJot fails on a managed network, and it fails as a hard block with no click-through — because .app is an HSTS-preloaded top-level domain. Your users cannot work around it, and neither can we.
The pages
| Page | For |
|---|---|
| Network requirements | Firewall, proxy and allow-list configuration |
| TLS inspection | Why decryption breaks it, and the exemption we ask for |
| Cisco Umbrella | The specific configuration that causes this most often |
| Data flows | What crosses the network and what does not |
| Security model | Authentication, transport, headers, application security |
| Privacy and governance | DPIA and IG review material, lawful bases, retention, DSARs |
| Subprocessors | Who processes what, and where |
| Deployment and devices | Browsers, MDM, storage policy, installation |
| Security questionnaire answers | Short answers to standard assurance questions |
| Diagnosing a blocked deployment | Working out what is blocking it, in a few minutes |
The summary you probably need
What it is. A web app at https://medjot.app. All traffic is HTTPS on port 443. HTTP/3 is advertised, so permitting UDP 443 avoids a needless fallback delay.
Where clinical data lives. On the device, in browser storage. It is not transmitted to us by autosave, not backed up and not visible to us. This is architectural rather than configurable.
What does cross the network. Authentication tokens, subscription and licensing status, usage counters, support enquiries, and — only when a clinician runs an AI feature — a redacted summary of structured clinical findings in which the patient is referred to only as "Pt". Full detail in Data flows.
What to allow. medjot.app, plus Google Firebase endpoints for authentication. Stripe only if clinicians pay individually. Analytics endpoints are optional and safe to block. See Network requirements.
What is needed on the device. A current browser. Nothing installed. Critically, a policy that does not clear website data automatically — that would discard clinicians' in-progress reports. See Deployment and devices.
The precise position on inspection
We would rather be accurate than reassuring, since this is the decision that matters to you:
- Intercepting MedJot yields no clinical content, because none is in transit.
- It does place Firebase authentication and refresh tokens, and all
/api/*traffic, in front of the inspecting appliance. Those tokens are an account-takeover surface on a clinical system.
That trade is the reason we ask for the exemption. The full argument →
Talking to a person
hello@swyftscale.com. We are happy to speak directly with network security teams, and to supply what you need for an information governance or DPIA review.
If there is a certificate warning, tell us which authority issued the certificate your devices receive. That one detail usually identifies the cause immediately.