Static IP for HB Compliance

Multi-portal trust, administered by hand

Healthier Business Group serves 1,700+ UK recruitment agencies from four locations, and its platform is built around secure API integrations, login-gated portals, and compliance workflows where every decision is logged and audit-ready. Access for connected agency systems is a matter for their engineering team, and that conversation goes far better when your addresses never change.

Three portals plus an API

RAM handles registration assurance monitoring, bls takes virtual BLS training bookings, tdta runs The Direct Training Academy's face-to-face sessions, and the integration API sits behind the same domain. Each is a separate host your automation has to be recognized on, and a platform that knows your agency by address has no concept of "same customer, new server".

Candidate data rides these wires

HB's own integration pitch says candidate data is submitted automatically from agency ATS, occupational health, and LMS systems. That payload is names, screening outcomes, and training records for clinicians entering NHS-adjacent work. A receiving side has every reason to be strict about whose traffic it accepts, and your egress address is the one part of that story your agency controls.

The trust decision is not self-service

In practice, trusted-IP access for a connected agency is arranged with HB's engineering team, not clicked into a dashboard. That makes egress churn genuinely expensive: every fresh address a cloud provider hands you after a redeploy means another round of emails before your traffic is trusted again, and until then the integration you depend on is running on borrowed goodwill.

Portal sessions want a steady origin

The portals sit behind email and password logins with CSRF-protected Laravel sessions. When your origin address drifts between requests, each session shows up in HB's logs as a different visitor, and an access story that keeps changing shape is the first thing a compliance reviewer or security audit asks you to explain.

The Solution

Register two fixed EU IPs once, then let the question rest

Your Agency Stack

ATS · LMS · OH systems

HTTPS Proxy

(Static EU IP)

HB Compliance

ram · bls · tdta · API

Once HB's engineering team has your two fixed EU addresses on file, every request your systems make lands on their side from a pair the platform already recognizes, whether it left a booking script, a scheduled candidate sync, or a compliance officer's browser. A proxy node failing over changes nothing HB can see.

Declare HTTPS_PROXY once in your environment and every HB surface, the RAM portal, BLS bookings, TDTA sessions, and the integration API, sees traffic leave through the same pair.

Both addresses are on file from the first day, and either one can carry the traffic, so a failover between our nodes never sends anyone back to HB's engineers to vouch for a new address.

TLS runs straight through to hbcompliance.co.uk. Portal logins, session cookies, and candidate payloads stay encrypted past the proxy hop, because we relay ciphertext rather than conversations.

Why agencies route HB Compliance traffic through OutboundGateway

One pair for every HB surface

RAM for compliance monitoring, bls for virtual training, tdta for practical sessions, and the agency API all recognize the same two addresses. One registration covers the whole footprint, and there is no per-portal plumbing to keep straight.

An egress story that matches the audit

HB's platform is sold on decisions that are logged, traceable, and audit-ready, and agencies inherit that standard across the whole workflow. A fixed pair gives your leg of the journey the same one-address legibility, so "where did this access come from" always has a two-line answer.

The same pair across your automation

Agencies typically drive the ATS side of this with workflow tools. Our n8n static IP guide and Zapier guide show the same two addresses at work there, so the pair HB trusts also covers the rest of your compliance stack.

Designed for

Agencies whose HB traffic has to arrive recognized, on every host it touches.

Agencies wiring their ATS into HB

HB's platform is explicitly built for secure API integrations with agency compliance systems, ATS platforms, OH providers, and LMS tools. Handing their engineering team two fixed addresses turns the integration kickoff into a one-time setup instead of a running obligation.

Training and booking automation

Scripting virtual BLS bookings with certificate retrieval, or CSTF-aligned practical sessions at The Direct Training Academy's Manchester, Birmingham, London, and Reading venues, means hitting bls and tdta on a schedule. Both inherit the same trusted pair as everything else.

Compliance officers on the RAM portal

Registration assurance monitoring covers candidate screenings, document verification, and workforce compliance status, which is sensitive personal data all day long. Working those sessions from a fixed, documentable address keeps the agency's side of the audit as clean as the platform's.

Agencies on rotating cloud egress

If your stack runs on platforms that hand out a fresh egress address on every deploy, you cannot give HB's engineers a stable answer to trust. Two fixed EU addresses front the whole estate, whatever it is built on, and the answer you give at onboarding stays true.

Implementation

One environment variable carries every portal session and API call out of your fixed EU pair.

Shell / environment

Set the variable wherever the traffic originates: booking scripts, sync workers, or the box a compliance officer logs in from. Every hbcompliance.co.uk host is plain HTTPS on the other side.

# .env, task definition, or wherever env config lives
HTTPS_PROXY=https://user:pass@eu-01.outboundgateway.com:8443

# any HB host, now leaving from your fixed EU pair
curl -s "https://ram.hbcompliance.co.uk/"
curl -s "https://bls.hbcompliance.co.uk/"
curl -s "https://tdta.hbcompliance.co.uk/"

# the integration API your ATS uses rides the same variable

Python (requests)

Plain requests picks up HTTPS_PROXY from the environment on its own, no extra wiring needed.

import requests

# requests reads HTTPS_PROXY from the environment automatically
resp = requests.get("https://ram.hbcompliance.co.uk/")
resp.raise_for_status()

# portal logins are email + password sessions with CSRF
# protection; your client owns the cookies and tokens, and
# the proxy only fixes the address every request departs from

Node.js (undici ProxyAgent)

Node's built-in fetch ignores proxy environment variables, so hand it undici's ProxyAgent explicitly.

import { ProxyAgent } from 'undici';

const res = await fetch('https://bls.hbcompliance.co.uk/', {
  dispatcher: new ProxyAgent(process.env.HTTPS_PROXY),
});

// the explicit dispatcher is the point: without it, Node's
// fetch skips the env var and leaves from the platform address.
// Every HB host works identically through the pair.

Register the pair with HB once

Both addresses, one email thread, and the trust question is settled for the life of the integration.

# getting the pair trusted, once:
#   reach the HB team via hbcompliance.co.uk
#   (0141 889 5522, Mon-Fri 09:00-17:00)
#   hand over BOTH fixed IPv4 addresses on your account
#   their engineering team pins the pair for your agency
#   and confirms once your traffic is trusted

# there is no self-service whitelist to revisit, which is
# exactly why the addresses you register should never need
# replacing; redeploys, autoscaling, and region moves all
# present the same two addresses to HB

One registration, then the question stays closed

Every account gets its own pair of static EU IPv4 addresses. Once HB's engineers have both on file, redeploys, new services, and scale events stop being a conversation: the platform sees the same two addresses no matter what changed behind them.

Which traffic is covered? Outbound HTTPS to hbcompliance.co.uk: portal sessions on ram, bls, tdta, and portal, plus the secure API integrations that submit candidate data from agency systems. The setup is outbound only; nothing on HB's side needs to reach back into yours, so there is no inbound leg to configure.

📖 Complete Documentation: For detailed examples, error handling, and advanced configurations, see the Python guide, the Node.js guide, or all guides.

Workforce data with a fixed European origin

Healthier Business Group has held SEQOHS accreditation since 2015 alongside ISO 9001 certification and Cyber Essentials, serving the healthcare recruitment sector since 2007. The origin of your side of each request is the part your agency controls, and it is worth controlling well.

UK GDPR, treated as it deserves

Occupational health outcomes, training records, and candidate identifiers moving between an agency and its compliance provider are personal data under the UK GDPR and the Data Protection Act 2018. Egress from European data centres keeps the outbound leg of every record's journey consistent, inside Europe, and easy to describe in writing.

A posture that matches the platform's

HB's portals sit behind email and password logins with CSRF-protected sessions, under a Cyber Essentials certified operation. Meeting that posture from your side means presenting one fixed European pair instead of a rotating cloud range, with TLS passed through untouched so logins and payloads stay sealed past the proxy hop.

What you get

Four hosts, one decision

RAM, BLS, TDTA, and the integration API all recognize the same two addresses. Register the pair once and the entire HB footprint is covered, no matter which system originates the traffic.

No ticket per deploy

Infrastructure changes stop triggering conversations with HB's engineers. Redeploys, autoscaling events, and platform migrations all present addresses the platform already trusts.

Failover without a re-registration

The two addresses back each other up in HB's records, so a proxy node stepping out is invisible to your portals and syncs. Nothing needs re-filing while traffic continues through the survivor.

Growth without paperwork

New workers, regions, and services inherit the pair automatically. The registration you make at onboarding is still complete when the agency has doubled the automation running on it.

Ciphertext in, ciphertext out

Portal logins, session cookies, and candidate payloads travel inside TLS the proxy passes through untouched. We relay encrypted bytes, never the conversations inside them.

Simple pricing

Starting from €19/month. Flexible plans for every scale. Cancel anytime.

Frequently asked questions

Does HB Compliance support IP whitelisting?

Trusted-IP access for connected agencies is handled by HB's engineering team when systems are integrated, rather than through a self-service dashboard. The platform is built for secure API integrations with agency ATS, OH, and LMS systems, and the company holds Cyber Essentials certification alongside ISO 9001 and SEQOHS accreditation, so strict network controls fit its posture. The practical step is simple: hand the team both fixed addresses and ask them to pin the pair.

How do I route HB portal and API traffic through the proxy?

Set HTTPS_PROXY once wherever the traffic originates. Curl and Python requests honor it automatically, while Node's fetch needs an explicit undici ProxyAgent because it skips proxy environment variables. The same value covers ram, bls, tdta, and portal hosts plus the integration API, so there is nothing to configure per surface.

Which HB portals does the pair cover?

All of them. RAM is the Registration Assurance Monitoring portal for workforce compliance, bls handles virtual BLS training bookings and certificates, tdta is The Direct Training Academy for face-to-face practical sessions across its UK venues, and the agency API sits behind the same domain. One registered pair is recognized on every host equally.

Two addresses HB's engineers can file once

Describe what your agency stack runs on and where the automation lives, and we will map the exact insertion points.

Contact Our Founders →