Relay Service Deployment Guide

Introduction

The Relay Service is a mandatory component of every [Ai]levate deployment — SaaS or On-Premise. It acts as a secure bridge between a customer’s on-premise EHR datastore and the Cloud Services Layer hosted in the cloud.

By enforcing an outbound-only traffic model, the Relay eliminates the need for inbound firewall changes, reducing the attack surface while still allowing [Ai]levate services to access the EHR datastore as if it were local.

This guide describes how to connect a local NextGen EHR instance to the [Ai]levate Platform using the [Ai]levate Relay Service.

This document provides:

• The technical prerequisites customers must prepare.
• The step-by-step installation process, including the onsite or remote work performed by [Ai]levate engineers.

General Approach

The Relay Service is deployed as a dedicated Linux VM inside the customer’s network, on the same LAN as the EHR datastore. It initiates an outbound TLS 1.2+ connection (port 443) to [Ai]levate Cloud Services. Once connected, [Ai]levate can securely query the EHR through the Relay as if the database were local, while the database itself remains private.

For both SaaS and On-Prem deployments, the Relay is mandatory. In SaaS, it is the only component the customer hosts. In On-Prem, it complements customer-managed storage and compute. In both cases, the Relay enforces encryption, authentication, and strict isolation.

What the Relay VM does

• Initiates an encrypted outbound connection to your dedicated [Ai]levate Platform endpoint on the Internet (TCP 443).
• Bridges that connection back to your SQL Server over your LAN (typically TCP 1433).
• Presents a stable, private endpoint to your [Ai]levate Platform so our services can use SQL as if it were local — while your database remains private.

Deployment overview

sequenceDiagram
    participant C as Customer SysAdmin
    participant E as "[Ai]levate Engineer"
    participant R as Relay VM
    participant SQL as EHR Datastore
    participant CS as "[Ai]levate Cloud Services"

    %% Preparation
    Note over C: Preparation
    C->>R: Provision Relay VM, validate SQL connectivity (1433)

    %% Deployment
    Note over E,R: Deployment
    E->>R: Install Azure Arc agent
    R->>CS: Register as Connected Machine (443 TLS)

    %% Registration
    Note over C,CS: Registration
    C->>CS: Register EHR endpoint in console

    %% Validation
    Note over E,C: Validation
    CS->>SQL: Test query through Relay
    CS->>C: Confirm tunnel + logs healthy
    E->>C: Provide runbook + ops docs

The installation of the Relay Service follows a clear sequence

Technical Prerequisites

The customer must prepare the following before the onsite installation.

Relay VM Requirements

TLS requirements

The Relay is a mode of data using Transport Layer Security (TLS) instead of a VPN.

To use TLS 1.2, your Relay server must support at least one of the following cipher suites as of 24 January 2024:

• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

The Relay also supports HTTP proxy with or without authentication if your network requires a proxy server to reach the internet

Important: The customer is responsible for patch management of the relay VM, including OS and security updates. Root/sudo privileges are mandatory during installation.

Network & DNS Requirements

Administration

Registration phase

Once all prerequisites are in place, a meeting with an [Ai]levate engineer (or a certified partner) must be scheduled to finalize the deployment of the [Ai]levate Relay Service and the registration service. This session can be conducted either on-site or via remote access and is expected to take no longer than three hours.

During this session, the [Ai]levate engineer remotely register the [Ai]levate Relay Service using its secured administrative access. The focus of this activity is to configure the relay VM so it becomes the trusted network bridge between your local SQL Server datastore and the [Ai]levate Platform.

The process unfolds in several phases described below.

Networking

Bandwidth Requirements

The Relay Service is lightweight from a compute perspective but network bandwidth is critical to ensure consistent performance. Bandwidth needs vary depending on the volume of claims processed per minute, since every denied claim transmitted between the EHR datastore and [Ai]levate must flow through the Relay.

flowchart LR
    subgraph Customer["Customer Environment"]
        EHR["EHR Datastore"]
        Relay["Relay VM (Outbound-only)"]
    end

    subgraph Ailevate["[Ai]levate Cloud Services (Azure)"]
        Services["Cloud Services Layer"]
    end

    EHR --> Relay
    Relay -->|1–30 Mbps depending on claims| Services

The table below provides minimum and recommended bandwidth values based on typical workloads. These requirements apply to both SaaS and On-Prem deployments, as the Relay is mandatory in each case.

Network Flow Matrix

The Relay Service requires a set of well-defined network flows to operate correctly. The table below summarizes all flows, including source, destination, protocol/port, encryption, and who is responsible for configuration. This matrix applies to both SaaS and On-Prem deployments since the Relay is mandatory in all cases.

flowchart TD
    subgraph Customer["Customer Environment"]
        EHR["EHR SQL Datastore"]
        Relay["Relay VM (Outbound-only)"]
        DNS["DNS Resolver"]
    end

    subgraph Ailevate["[Ai]levate Cloud (Azure)"]
        Cloud["Cloud Services Layer"]
        Arc["Azure Arc Services"]
    end

    Relay -->|443 TLS| Cloud
    Relay -->|443 TLS| Arc
    Relay -->|1433 TCP| EHR
    Relay -->|53 UDP/TCP| DNS
    Cloud --> Relay

Security Responsibilities

[Ailevate] Responsibilities

The purpose of this section provide guarantees to system administrators and security teams that the [Ai]levate Relay Service is designed with a minimal attack surface and follows industry best practices. By keeping the SQL Server datastore private, restricting connections to outbound-only, and installing only lightweight components on the relay VM, the integration balances operational functionality with strong security controls.

Customer Responsibilities

To maintain the same level of protection after deployment, the customer’s security and sysadmin teams are responsible for the following tasks:

Checklist (summary)

Appendix – Relay VM Runbook

This appendix provides operational procedures for system administrators. These tasks allow the customer to verify, monitor, and manage the [Ai]levate Relay Service without requiring escalation.

Service Management

Two lightweight services run on the relay VM:

• ailevate-tunnel.service → Handles the secure outbound tunnel to the [Ai]levate Platform.
• ailevate-proxy.service → Provides the local TCP proxy from the relay VM to SQL Server.

Log Management

Logs are journaled via systemd.

Connectivity Checks

System Maintenance

Common Issues & Fixes