Network Access & Firewall Whitelisting

A one-page reference for the IT team supporting your clinical staff using Whetstone Health.

Last updated: May 20, 2026

Quick summary

Whetstone Health is hosted entirely on Microsoft Azure in the East US 2 region. We're covered under Microsoft's Business Associate Agreement (BAA) for HIPAA-eligible services. No third-party CDN, no overseas data residency, no third-party trust extension to manage.

If your firewall is blocking access — typically because Azure anycast IPs occasionally appear mis-tagged in older geo-IP databases — please whitelist the addresses below.

Service overview

Provider

Microsoft Azure (East US 2)

BAA

Microsoft Online Services BAA — covers Azure Static Web Apps, Container Apps, and PostgreSQL Flexible Server. Available on request.

Data residency

United States only. No PHI is stored or processed outside the US.

Transport encryption

TLS 1.2+ end-to-end

Authentication

Microsoft Entra ID, Google OAuth, Apple Sign-In, or username/password — all via Supabase Auth

Domains to whitelist

Whetstone Health uses the following hostnames. All resolve to Microsoft Azure infrastructure:

whetstone.health — main application (Azure Static Web Apps)
www.whetstone.health — www redirect (Azure Static Web Apps)
chat.whetstone.health — API endpoint for transcript analysis (Azure Container Apps, East US 2)

IP ranges

Microsoft publishes an authoritative, machine-readable JSON file containing all current Azure IP ranges, updated weekly. Most enterprise firewalls (Palo Alto, Fortinet, Check Point, Zscaler, Cisco ASA, SonicWall) support importing this file with automatic refresh.

Microsoft Azure IP Ranges (official, weekly) → Azure Service Tags documentation →

The two service tags relevant to Whetstone

AzureCloud.eastus2 — covers Static Web Apps + Container Apps origin IPs
AzureFrontDoor.Frontend — covers the anycast edge IPs that serve whetstone.health

If your firewall already allows Microsoft 365, Microsoft Teams, OneDrive, or Dragon Medical traffic, the AzureCloud.* ranges are likely already in your trust list. AzureFrontDoor.Frontend is the same anycast pool that fronts Outlook on the web, the Azure portal, and most Microsoft healthcare services including Microsoft Dragon Copilot.

Geo-IP database note

Some older geo-IP databases (MaxMind GeoLite2 versions older than 2024, and similar) mis-tag certain Microsoft anycast IPs by their original allocation country rather than the actual point-of-presence currently serving the request. This can cause a US-based hospital firewall using country-block rules to falsely flag a request as originating outside the US even when the actual POP is in Virginia or Texas.

Two remedies, either of which works:

Update your geo-IP database. Recent versions of most commercial IP databases correctly identify these IPs as Microsoft Azure US ranges.
Whitelist by Microsoft Service Tag rather than by geo-country. This is the Microsoft-recommended approach for any organization using Azure services, and it's what most enterprise firewalls do automatically when integrated with Microsoft 365.

Test connectivity

After whitelisting, the following URL should return HTTP 200 from any host on the hospital network:

curl -I https://chat.whetstone.health/healthz

If it returns 200 OK, you're done — clinicians on your network can use Whetstone fully.

Questions

For account onboarding, BAA documentation, or institutional-tier inquiries: [email protected]