Network requirements

Who this page is for

This page is for IT and network administrators at organisations whose people use Therapyway from a managed connection. That includes NHS trusts, GP practices and clinics, schools and colleges, local authorities, and employers that run a corporate firewall, web filter or proxy. If you have been sent this link by a colleague who can reach the Therapyway website but can't make a video call work, or can't sign in, you are the right person to read it. Individual users at home, on mobile data or on an unfiltered connection generally won't need any of this and can ignore the page.

Before you start

We can tell you what the Therapyway app needs to reach. We can't see inside your network, and we can't change how your firewall, proxy or filtering is configured. Those settings are yours to manage, and Therapyway is not responsible for an organisation's internal network configuration or for any change you make to it. Treat the allow-list below as a request to your own IT team, and have them apply it in line with your own security policies. Adding the entries here will not weaken your network: you are permitting traffic to a specific set of Therapyway and supporting services, not opening anything up wholesale.

Therapyway platform

Allow these over HTTPS (TCP 443). They are required for the app to load and run.

• therapyway.co.uk and www.therapyway.co.uk for the marketing website. It is a static site with no backend of its own, so nothing else is needed for it.
• app.therapyway.co.uk for the product app and its backend API, where therapists and clients sign in, book, message and attend video calls.

The app's backend runs on AWS under app.therapyway.co.uk, so there is no separate backend domain to allow. If your proxy intercepts traffic, also allow secure WebSocket connections (wss://) to app.therapyway.co.uk so live features keep working.

Video calls

Video sessions run in the browser using WebRTC on our self-hosted Jitsi Meet server. They carry audio and video over UDP as well as HTTPS, so the media port matters as much as the web address.

• meet.therapyway.co.uk for the video server: joining a call, signalling, and the call interface, over HTTPS (TCP 443).
• Outbound UDP to meet.therapyway.co.uk on port 10000 carries the audio and video media stream. This is the one most often blocked on managed networks.
• TCP 443 to meet.therapyway.co.uk as a fallback, used when UDP 10000 is unavailable.

Allowing outbound UDP 10000 to the video host is the single most important step for reliable calls. If both UDP 10000 and the TCP 443 fallback are blocked, a call will connect but the picture and sound will fail.

Payments

Payments are handled by Stripe, which loads its scripts in the browser. Allow these over HTTPS (TCP 443).

• js.stripe.com and *.stripe.com for Stripe's payment scripts and API.

Analytics (optional)

These are for usage analytics. Blocking them does not stop the app from working; allowing them helps us improve it.

• PostHog: eu.i.posthog.com and eu-assets.i.posthog.com
• Google Analytics: www.googletagmanager.com, *.google-analytics.com and *.analytics.google.com

Error monitoring (optional)

We use Sentry to spot and fix problems quickly. Allowing it helps but is not required for the app to work.

• *.ingest.sentry.io for Sentry error reports from the browser (or *.ingest.de.sentry.io if the Sentry project is in the EU region).

Email delivery

So account, booking and verification emails reach your users, allow mail from our addresses in your spam filter and mail gateway.

• noreply@therapyway.co.uk sends automated account, booking and verification emails.
• contact@therapyway.co.uk is used for replies and support correspondence.

Browsers and devices

The app runs in the browser, so the simplest fix is often to use a current, supported one. We test against the latest versions of Google Chrome, Microsoft Edge, Mozilla Firefox and Apple Safari, on desktop and mobile. Keep the browser updated, since video calling relies on features older versions handle poorly. Internet Explorer is not supported. JavaScript and cookies both need to be enabled for the domain, as sign-in and the session depend on them. If your organisation locks browser settings down centrally, ask IT to allow JavaScript, cookies, and camera and microphone access for app.therapyway.co.uk. Private or incognito windows usually work, but some setups block the camera and microphone there, so a normal window is a safer first try when a call won't start.

Bandwidth for video calls

A one-to-one video call needs roughly 1 to 2 Mbps up and down for a steady picture. It will run on less, but the video softens and may freeze when the connection is tight. If several people share the same line, account for each call separately. Video calling uses WebRTC over UDP, so if your firewall blocks outbound UDP, calls either fail to connect or fall back to a lower-quality path. A wired connection is steadier than wi-fi for the person hosting. On the device, the browser needs permission to use the camera and microphone; the first time someone joins a call the browser asks, and that prompt has to be allowed. On managed devices that permission is sometimes set centrally and may need an admin to grant it for our domain.

If something is blocked

If something is blocked, the usual culprit is the firewall, web filter or proxy between the user and the app. Work through it in order. First confirm the user can open app.therapyway.co.uk at all; if the page won't load, the domain is being filtered and needs allowing. If the page loads but video won't connect, the problem is almost always UDP being blocked or the media servers not being reachable, so check those next. A transparent or intercepting proxy can break WebRTC even when ordinary pages work, so test the same user on an unfiltered connection, such as a phone on mobile data, to confirm whether the network is the cause. If a call works off the corporate network but not on it, that points firmly at the firewall or proxy. When you have ruled out the obvious, email us with the user's browser and version, the organisation's name, and a short description of what fails and at which step.

Contact

For help, or to request the exact hostnames to add for your network, get in touch.