Network and Security Requirements for School and Organization IT Teams
If MyTherapyWizard won’t load, sign-in codes don’t arrive, or documents won’t open on your organization’s network, the cause is usually a web filter or firewall. Share this article, or the PDF below, with your IT team. It lists everything they need to allow.
✨ Available on: All plans. Written for school district and organization IT teams, and useful for anyone whose network uses a web filter or firewall.
🧩 Download for your IT team
Download the Network and Security Requirements (PDF, version 1.0, September 25, 2026)
🧩 1. Summary
- MyTherapyWizard is a web application used in a standard web browser. No software, browser plug-in, VPN or inbound firewall rule is required.
- All traffic is outbound HTTPS on TCP port 443 from the user’s browser.
- Allow access by domain name. The platform does not use fixed IP addresses.
- The platform is hosted on Amazon Web Services (AWS) in the US East (N. Virginia) region.
🧩 2. Required domains (allow for all staff)
| Domain | Used for |
|---|---|
| app.mytherapywizard.com | The application |
| api.mytherapywizard.com | All application data |
| files.mytherapywizard.com | Profile photos, assessment images and videos, and the platform’s legal documents |
| mtw-files-prod-246488453758.s3.amazonaws.com | Signed download links for stored documents (consents, authorizations, invoices, provider orders and completed forms) |
- If your filter supports wildcards, *.mytherapywizard.com covers the first three domains.
- Many web filters place amazonaws.com in a cloud storage category. Please allow the exact address above.
🧩 3. Optional domains (specific features only)
| Domain or service | Needed for |
|---|---|
| mytherapywizard.com and www.mytherapywizard.com | The public website, linked from the sign-in page. |
| *.supademo.com | The built-in interactive product tours. The tour player also contacts Supademo’s analytics services: posthog.com, sentry.io and cloudflareinsights.com. Blocking these affects only the tours. |
| *.stripe.com | Stripe payment pages. Needed only by the person who manages the MyTherapyWizard subscription or makes payments. |
| Claim.MD | Only billing staff who file insurance claim appeals from inside MyTherapyWizard. That screen opens a page provided by Claim.MD, the insurance billing clearinghouse. |
Video visit links that staff add to appointments (for example, Zoom) open on that service’s own website.
🧩 4. Ports and protocols
| Port | Protocol | Requirement |
|---|---|---|
| TCP 443 | HTTPS | Required. |
| TCP 80 | HTTP | Optional. It only redirects to HTTPS. |
| UDP 443 | HTTP/3 (QUIC) | Optional. If UDP 443 is blocked, browsers use TCP 443 instead. |
No WebSockets, streaming connections or other ports are used. Each signed-in app tab sends one small HTTPS request every 30 seconds to check for notifications.
🧩 5. IP addresses
The app, files and website are served through Amazon CloudFront, and the API is served through an AWS load balancer. These IP addresses are assigned by AWS and can change at any time, so please allow by domain name.
If your firewall can only use IP ranges, AWS publishes them at ip-ranges.amazonaws.com/ip-ranges.json. Use service CLOUDFRONT for the app, files and website, and service EC2 in region us-east-1 for the API. The API currently answers on IPv4 only. The app, files and website support both IPv4 and IPv6.
🧩 6. Encryption
- Only TLS 1.2 and TLS 1.3 are accepted. TLS 1.0 and TLS 1.1 connections are refused.
- Certificates are issued by Amazon and cover mytherapywizard.com and *.mytherapywizard.com.
- Plain HTTP requests are redirected to HTTPS. The API also sends HTTP Strict Transport Security (HSTS).
- Stored documents are encrypted at rest with AWS Key Management Service (KMS). The app opens them through signed links that expire after 5 to 15 minutes.
- The database is encrypted at rest with AWS KMS and accepts only encrypted (TLS) connections.
🧩 7. SSL/TLS inspection
MyTherapyWizard does not use certificate pinning or client certificates, so SSL/TLS inspection works when your devices trust your inspection certificate. If you inspect this traffic, please make sure your proxy:
- passes the Authorization and X-Timezone request headers unchanged (they carry the sign-in session and the user’s time zone)
- keeps the browser’s User-Agent header (the API’s firewall refuses requests without one)
- allows OPTIONS requests to api.mytherapywizard.com (browsers send them before API calls)
- does not modify or re-request the signed document links (they expire after 5 to 15 minutes)
- allows request bodies of at least 25 MB (file uploads, such as PDFs, are sent inside the request)
- does not cache responses from api.mytherapywizard.com
- allows at least 60 seconds for a response (some steps generate text before responding)
Because this traffic contains confidential student health information, excluding the required domains in section 2 from decryption is recommended if your policy allows it.
🧩 8. Browser settings
- Use a current version of Chrome, Edge, Firefox or Safari, with JavaScript enabled.
- Allow site storage for app.mytherapywizard.com. The sign-in session is kept in the browser’s local storage, not in cookies, so a policy that clears site data when the browser closes will sign users out.
- Allow pop-ups and file downloads from app.mytherapywizard.com. Documents and some reports open in a new tab, and exports download as PDF, Word or CSV files.
- No camera, microphone or location access is needed.
🧩 9. Email
Every sign-in requires the user’s password and a 6-digit code that is emailed at each sign-in and expires after 10 minutes. Please make sure your email system delivers these senders without delay or quarantine:
| Sender | Used for |
|---|---|
| support@mytherapywizard.com | Sign-in codes, account verification, password resets, team invitations, and forms and questionnaires sent from the app |
| notifications@mail.mytherapywizard.com | Messages sent from the app’s Communications feature |
Both senders use Amazon Simple Email Service (SES) and are signed with DKIM. Links the app places in these emails point to app.mytherapywizard.com.
🧩 10. Connectivity test
From a device on your network:
- Open api.mytherapywizard.com/health. The page should show a short message that includes "healthy".
- Open app.mytherapywizard.com. The sign-in page should appear.
- Open Trust & Compliance and select Download the full Agreement. The PDF should open. This confirms files.mytherapywizard.com.
- After signing in, open any stored document, such as a consent. It should open in a new tab. This confirms the signed document links.
🛠️ Quick troubleshooting
| What you see | Most likely cause |
|---|---|
| The app is blank or won’t load | app.mytherapywizard.com or api.mytherapywizard.com is blocked |
| Sign-in code never arrives | support@mytherapywizard.com is delayed or quarantined by the email system |
| Users are signed out every time the browser closes | A policy clears site data on close |
| Consents, orders or forms won’t open | mtw-files-prod-246488453758.s3.amazonaws.com is blocked, or a proxy is changing the signed links |
| Uploads fail | A proxy limits request size below 25 MB |
| Reports or documents don’t open | Pop-ups are blocked for app.mytherapywizard.com |
For device, screen size and browser recommendations, see Technology Requirements for MyTherapyWizard.
🧩 Contact
- Questions: support@mytherapywizard.com
- Trust and compliance: app.mytherapywizard.com/legal/trust-compliance
- Privacy and data protection: app.mytherapywizard.com/legal/privacy-data-protection
📚 See other articles in All Users here.