For IT Departments
Thank you for supporting EMS students who are utilizing the EMCE platform as a critical component of their education. This document outlines essential technical considerations for ensuring smooth integration of EMCE into your organization’s IT environment.
Overview of EMCE
Section titled “Overview of EMCE”EMCE (pronounced “M‑C”) is a specialized, cloud-based software platform designed for Emergency Medical Services (EMS) education, enabling students to document clinical experiences, track competencies, and complete required evaluations. Students use EMCE extensively in hospital and public safety settings to comply with educational and accreditation requirements.
EMCE operates entirely within a secure cloud environment hosted by Google Cloud Platform (GCP). It relies on internet connectivity to communicate securely with Google’s Firebase services, including the Firestore database, and other critical services. EMCE maintains SOC 2 Type 2 certification, demonstrating adherence to stringent security, availability, and confidentiality standards.
Network and Proxy Compatibility
Section titled “Network and Proxy Compatibility”EMCE relies on direct communication with cloud services via encrypted HTTPS/TLS. Due to technical limitations and security practices, EMCE does not support:
- Network proxies (particularly packet-inspecting proxies)
- Packet sniffing or shaping devices
These devices often disrupt secure connections to Google Cloud Firestore and related services, causing connection failures or degraded performance.
Known Issue:
- Zscaler proxies intermittently drop HTTP/2 streams to Google Cloud Firestore, causing 499/502 errors. Google and Zscaler have acknowledged the defect; contact Zscaler support and request the latest “Dynamic Content Classification Engine” patch or a bypass rule for
*.googleapis.com,*.firebaseio.com,*.firebasedatabase.app, and*.emce.app.
Recommended Network Configuration
Section titled “Recommended Network Configuration”Domain Allow List
Section titled “Domain Allow List”All EMCE traffic is outbound HTTPS on TCP port 443. To ensure optimal performance and uninterrupted access, please add the following domains to your network’s allow list. Where a wildcard (*.) is shown, the subdomains are required, not optional.
EMCE Domains
| Domain | Used for |
|---|---|
emce.app, *.emce.app | The web app and all EMCE backend services. The web app talks to core.emce.app; the iOS and Android apps also connect directly to core2., core-d., labs-d., and scheduling-d. subdomains, plus beta. and ca. variants |
emceapp.link, *.emceapp.link | Shared links and “Open in EMCE” deep links |
docs.emce.help | The EMCE Help Center |
releases.emce.so | Release notes (“What’s New”), hosted on Notion (*.notion.site) |
status.emce.health | The EMCE service status page |
emceapp.com | The EMCE marketing website (not required by the app) |
EMCE Support email is sent from @emce.help and @emce.co addresses; please ensure those sender domains are not filtered.
Google Cloud Platform and Firebase Domains
| Domain | Used for |
|---|---|
*.googleapis.com | Firestore database, Authentication, Storage (attachments and photos), App Check, Remote Config, Installations, and Cloud Messaging |
*.firebaseio.com, *.firebasedatabase.app | Firebase Realtime Database (required from EMCE 5.3.0). Uses WebSockets (wss://), which must not be downgraded or intercepted |
*.firebaseapp.com | The sign-in helper used by Google, Apple, and Microsoft sign-in |
*.gstatic.com | Firebase SDK, reCAPTCHA, and fonts |
www.google.com, recaptcha.google.com | reCAPTCHA Enterprise, which backs EMCE’s app-integrity protection (Firebase App Check). Blocking these prevents sign-in entirely. |
accounts.google.com, apis.google.com | Sign in with Google |
*.googleusercontent.com | Google account profile photos |
www.googletagmanager.com, analytics.google.com, stats.g.doubleclick.net | Google Analytics. Optional; blocking only affects usage telemetry |
Third-Party Service Domains
| Domain | Used for |
|---|---|
appleid.apple.com, appleid.cdn-apple.com | Sign in with Apple |
login.microsoftonline.com | Sign in with Microsoft |
use.typekit.net, p.typekit.net | Web fonts |
img.logo.dev | Organization logos |
browser.sentry-cdn.com, sentry.io, *.sentry.io | Error and crash reporting |
cdn.amplitude.com, *.amplitude.com | Product analytics |
Mobile Push Notifications
Students using the EMCE iOS or Android app also need the platform push-notification services, which use ports other than 443:
- Apple Push Notification service (iOS):
*.push.apple.comon TCP port 5223, with fallback to port 443. See Apple’s requirements. - Firebase Cloud Messaging (Android):
mtalk.google.comand*.googleapis.comon TCP ports 5228–5230, with fallback to port 443. See Google’s requirements.
This list was last audited against the production web app on September 15, 2026.
A Note on Egress Filtering
Section titled “A Note on Egress Filtering”EMCE is delivered as a hosted web and mobile application, so its network footprint is a small set of domains rather than fixed IP addresses. If your environment applies default-deny outbound filtering, we recommend implementing these rules by hostname (FQDN or SNI) rather than IP, since our infrastructure and its supporting CDNs use dynamic, anycast-routed address ranges that change without notice. IP-based rules will break intermittently and generate support tickets on both sides.
We also encourage IT teams to consider where strict egress control adds security value and where it mostly adds friction: it is highly effective on servers and single-purpose devices, but on general-purpose student and instructor workstations a category-based web proxy or DNS filtering paired with endpoint protection typically delivers comparable risk reduction with far less rule maintenance.
Network Performance Requirements
Section titled “Network Performance Requirements”Students require access to a WiFi network capable of consistently achieving:
- Ping latency of less than 100 ms to EMCE and GCP domains.
- Bandwidth of at least 5–10 Mbps to ensure reliable operation.
Personal Device Use Exceptions
Section titled “Personal Device Use Exceptions”We respectfully request that exceptions to your facility’s personal device policies (including the use of mobile phones, tablets, and laptops) be granted to EMS students. EMCE is a mandatory component of their educational program and compliance with accreditation standards, necessitating regular use of personal or school-issued technology.
IT Support and Inquiries
Section titled “IT Support and Inquiries”Should you have any technical questions or require further assistance configuring your network to support EMCE, please contact our technical team at: requests@emce.help
We greatly appreciate your cooperation and support in creating a conducive learning environment for EMS students using EMCE.
Thank you,
The EMCE Engineering Team