Network & IT requirements
This page is for network and security administrators. Refract Clinical is a browser-based professional development platform used by senior physicians to run structured 360-degree feedback for CPD. If a clinician at your organisation has asked for it to be allowed through your web filter, everything you need to assess that request is below.
Domains to allow
| Host | Protocol | Purpose |
|---|---|---|
refractclinical.com | HTTPS / TCP 443 | The application itself, and all of its static assets.Always |
checkout.stripe.com | HTTPS / TCP 443 | Hosted payment page, if a cycle is paid for individually. Departmental programmes are invoiced separately and never reach it.Individual purchases only |
refract-clinical.fly.dev is the origin host and issues a permanent redirect to refractclinical.com. Allowing the canonical domain is sufficient.
Two things that commonly break
Blocking JavaScript or font files by type breaks the site silently
The application is a single-page app. Its code is served from refractclinical.com/_next/static/ as .js, .css and .woff2files. A policy that permits the HTML document but blocks those file types leaves a page that renders normally and does nothing at all — buttons that don't respond, form validation that never runs. It does not look like a blocked site to the user, which is why it is usually reported as “the website is broken” rather than as a filtering issue.
Long-lived HTTPS connections must not be buffered or cut short
The interviews are conducted with an AI facilitator and stream their responses using server-sent events over ordinary HTTPS. A single response holds one connection open for up to roughly two minutes. Proxies that buffer responses until complete, or that apply a short idle timeout, will cause interviews to stall part-way through. An idle timeout of at least 180 seconds on this domain avoids it.
Minimum browser versions
| Browser | Minimum version |
|---|---|
| Chrome | 111 or newer |
| Edge | 111 or newer |
| Firefox | 111 or newer |
| Safari | 16.4 or newer |
These are the versions the application is compiled for, all released in March 2023. On anything older the JavaScript does not parse and the page renders as static HTML that does nothing — the same symptom as a filtering block, and the second most common cause of it. A managed desktop with a pinned browser build is the usual case; if yours is below these versions, no filter change will help.
The application detects this and tells the user their browser is too old rather than blaming your network, so a ticket about a blocked site should not be reaching you for this reason. Internet Explorer is not supported in any version.
What the product does not do
- No software, browser extension or agent is installed.
- No inbound connections to the user's machine or network.
- No VPN, and no non-standard ports — HTTPS on TCP 443 only.
- No third-party fonts, script CDNs or analytics. Every asset is served from refractclinical.com itself.
Data and hosting
| Hosting | Fly.io, Sydney (ap-southeast) region |
| Data residency | Australia |
| Transport | TLS 1.2+ on TCP 443; HSTS enabled |
| Patient data | No patient-identifiable information is collected or stored |
| Content held | Professional development feedback about participating clinicians |
| Email sender | noreply@refractclinical.com |
Access is by emailed invitation link. If your mail gateway rewrites or strips links, invitations may arrive unusable — allowing the sending domain avoids this.
Suggested filtering category
Refract Clinical is a hosted business application— a browser-based tool used by professionals at work, which stores their data. Most vendors have a category of exactly that name or close to it; Forcepoint's is Business and Economy: Hosted Business Applications, and Business / Economy is the right parent elsewhere.
It is not a clinical service, a consumer health site, or an educational resource: no treatment or medication information is published, nothing is offered to the public, and there is no user-generated public content, no messaging between members of the public and no file sharing. Health and education categories are both restricted by default in many networks, so classifying it under either tends to cause the block this page exists to prevent.
If your filter reports the domain as uncategorised, unknown, or newly registered, that is the most likely cause of a block or a warning — not any judgement about the site. We submit categorisation requests to the major filtering vendors directly; if you tell us which product you use, we will follow it up at our end rather than leaving it with you.
Zscaler: “Miscellaneous or Unknown”
Zscaler shows an interstitial reading “Are you sure you want to visit this site?” with the category given as Miscellaneous or Unknown. That is Zscaler saying it holds no classification for the domain, and its default response to an unclassified site is to caution the user. There is a Continue button and the page works normally beyond it, but clinicians reasonably read a security warning as a reason to stop. Categorising the domain removes it.
Contact
For anything not covered here — security questionnaires, penetration test summaries, or a specific configuration question — email support@refractclinical.com. We would rather answer a question from your team directly than have a clinician relay it.