Networking
Networking
Connect your projects to backend services that require IP allowlisting, AWS PrivateLink, or dedicated private networking.
Choosing a networking option
Vercel has four networking options: Static IPs, AWS PrivateLink, Secure Compute, and Bring Your Own Cloud. This section details the requirements and costs of each option.
| Option | Best for | What it adds | Network model | Plan |
|---|---|---|---|---|
| Static IPs | Teams that need IP allowlisting without infrastructure changes | A stable, dedicated egress surface you can allowlist | Multi-tenant compute, shared VPC with subnet-level isolation | Pro and Enterprise |
| AWS PrivateLink | Reaching an AWS-hosted service behind a PrivateLink endpoint service | Private connectivity to AWS services with no public internet exposure | Shared VPC, dedicated endpoint per connection | Requires Advanced Networking |
| Secure Compute | Teams that need a private VPC, dedicated networks, or regulatory isolation | A network perimeter isolated from every other customer, with VPC peering | Single-tenant, dedicated VPC | Enterprise add-on |
| Bring Your Own Cloud | Compliance or data-residency mandates that require workloads in your cloud | A network and compute boundary you own end to end | Compute runs in your own AWS account | Enterprise |
Review the requirement for each option and choose the first one that matches your situation:
- Your backend, database, or API needs a set of known source IPs to add to an allowlist, and public connectivity is acceptable. Use Static IPs.
- Your target service is hosted on AWS behind a PrivateLink endpoint service, and traffic must stay off the public internet. Use AWS PrivateLink.
- You need VPC peering into your own AWS environment, a dedicated single-tenant VPC, or network isolation to satisfy a regulatory requirement. Use Secure Compute.
- A compliance or data-residency mandate requires your compute to run inside your own AWS account. Use Bring Your Own Cloud.
Static IPs (shared pool)
When your database or API needs to see traffic from known IP addresses, Static IPs give you shared static egress IPs that won't change. Perfect for Pro and Enterprise teams who need IP allowlisting without the complexity.
- Use case: IP allowlisting for databases, APIs, and legacy systems
- Network: Shared VPC with subnet-level isolation
- Pricing: $100/month per project + Private Data Transfer at regional rates
AWS PrivateLink
When an AWS-hosted service exposes an AWS PrivateLink endpoint, PrivateLink keeps traffic on the AWS private network instead of the public internet. It extends the same shared-network model as Static IPs with endpoint-specific routing and Vercel-managed DNS names.
- Use case: Private connectivity to RDS, SaaS with PrivateLink endpoints, S3 or DynamoDB gateway endpoints, and compliance-focused deployments
- Network: Shared VPC with dedicated endpoint interfaces per connection
Learn more about AWS PrivateLink
Secure Compute
For when you need your own private Virtual Private Cloud (VPC). Secure Compute gives you dedicated networks with VPC peering, so your infrastructure stays completely isolated from other customers.
- Use case: Full network isolation and VPC peering
- Network: Dedicated VPC per customer
Learn more about Secure Compute
Bring Your Own Cloud
Bring Your Own Cloud runs your functions inside your own AWS account, so your compute and data never leave your cloud boundary. Vercel orchestrates routing and invocation, and responses return over an encrypted connection.
It exists to satisfy strict security, compliance, or data-residency mandates that require workloads to run in your own cloud. Because it moves infrastructure out of Vercel's managed boundary, plan for a substantial setup project and ongoing ownership of your AWS account's service quotas, scaling headroom, and account health.
- Use case: Compliance or data-residency mandates that require workloads in your cloud
- Network: Compute runs in your own AWS account
Bring Your Own Cloud is available on the Enterprise plan. To scope it, contact the Vercel sales team or your Vercel account team.
Pricing
Static IPs and Secure Compute usage includes Private Data Transfer priced regionally based on the regional pricing documentation.
PrivateLink usage is tracked separately on your team's Usage tab. See AWS PrivateLink for setup and behavior.
Bring Your Own Cloud is an Enterprise feature with no published price. Contact the Vercel sales team to scope it.
| Feature | Static IPs (Pro) | Secure Compute (Enterprise) |
|---|---|---|
| Monthly cost | $100/month per project | Custom |
| Private Data Transfer | Regional pricing | Custom |
| Network isolation | Shared VPC with subnet-level isolation | Dedicated VPC and subnet per customer |
Understanding data transfer costs
Data transfer costs kick in for all traffic to or from your Vercel Functions, including those to external services and to the Vercel CDN:
- Database queries and responses
- API calls to third-party services
- File uploads and downloads
- Any other inbound or outbound network traffic
Keep tabs on your usage in the Team Settings Usage tab under the Private Data Transfer section.