Skip to main content

Network requirements

All traffic is HTTPS on TCP 443.

MedJot also advertises HTTP/3, so UDP 443 should be permitted. If it is blocked, connections fall back to TCP and still work — but permitting it avoids a needless delay on every request.

Required — the application​

HostPurpose
medjot.appThe app, the marketing site, the documentation and the API

A single host covers the application, its API and its static assets.

Required — authentication and configuration (Google Firebase)​

MedJot uses Firebase Authentication. Without these, nobody can sign in.

identitytoolkit.googleapis.com
securetoken.googleapis.com
firebaseinstallations.googleapis.com
*.googleapis.com
*.firebaseio.com          (including wss:// for live updates)
*.firebasestorage.app
warning

*.firebaseio.com needs WebSocket (wss://) support. Proxies that break WebSocket upgrades cause account and licensing state to go stale rather than failing outright, which is a harder fault to diagnose than a clean block.

Required only for individual subscriptions (Stripe)​

js.stripe.com
api.stripe.com
hooks.stripe.com

If your organisation pays for MedJot centrally, clinicians never reach these and they can be omitted entirely. See Organisations.

Optional — product analytics​

Only ever contacted after a user explicitly opts in:

www.googletagmanager.com
www.google-analytics.com
*.google-analytics.com
*.analytics.google.com

Blocking these is entirely safe. Analytics is off unless a user consents, the code is not loaded at all otherwise, and MedJot works normally without it.

Consolidated allow-list​

# Required
medjot.app
*.medjot.app
identitytoolkit.googleapis.com
securetoken.googleapis.com
firebaseinstallations.googleapis.com
*.googleapis.com
*.firebaseio.com
*.firebasestorage.app

# Required only if clinicians subscribe individually
js.stripe.com
api.stripe.com
hooks.stripe.com

# Optional — consent-gated analytics, safe to omit
www.googletagmanager.com
www.google-analytics.com
*.google-analytics.com
*.analytics.google.com

TLS inspection exemption​

medjot.app
*.medjot.app

This is the important one. TLS inspection →

What is not needed​

  • No inbound connections. Nothing connects to your network.
  • No VPN.
  • No fixed IP allow-listing on your side.
  • No SMTP, no file shares, no directory integration.
  • No non-standard ports.

Bandwidth​

Small. MedJot is a text application whose interface is cached on the device after first load. Ongoing traffic is authentication, licensing checks and — where used — AI requests, all of which are small JSON payloads.

The heaviest single event is the first load of the app on a device.

Web notifications​

Optional, and used only to tell a clinician that something they queued has finished. Blocking them is safe. See Queued AI requests.

Verifying reachability​

From an affected device:

  1. Open https://medjot.app — the marketing site should load.
  2. Open https://medjot.app/app — the app should load.
  3. Check the certificate issuer. It must be Let's Encrypt. Anything else means the connection is being intercepted. See Diagnosing a blocked deployment.