Networking

Connect your projects to backend services that require IP allowlisting, AWS PrivateLink, or dedicated private networking.

Vercel has four networking options: Static IPs, AWS PrivateLink, Secure Compute, and Bring Your Own Cloud. This section details the requirements and costs of each option.

Review the requirement for each option and choose the first one that matches your situation:

• Your backend, database, or API needs a set of known source IPs to add to an allowlist, and public connectivity is acceptable. Use Static IPs.
• Your target service is hosted on AWS behind a PrivateLink endpoint service, and traffic must stay off the public internet. Use AWS PrivateLink.
• You need VPC peering into your own AWS environment, a dedicated single-tenant VPC, or network isolation to satisfy a regulatory requirement. Use Secure Compute.
• A compliance or data-residency mandate requires your compute to run inside your own AWS account. Use Bring Your Own Cloud.

When your database or API needs to see traffic from known IP addresses, Static IPs give you shared static egress IPs that won't change. Perfect for Pro and Enterprise teams who need IP allowlisting without the complexity.

• Use case: IP allowlisting for databases, APIs, and legacy systems
• Network: Shared VPC with subnet-level isolation
• Pricing: $100/month per project + Private Data Transfer at regional rates

Learn more about Static IPs

When an AWS-hosted service exposes an AWS PrivateLink endpoint, PrivateLink keeps traffic on the AWS private network instead of the public internet. It extends the same shared-network model as Static IPs with endpoint-specific routing and Vercel-managed DNS names.

• Use case: Private connectivity to RDS, SaaS with PrivateLink endpoints, S3 or DynamoDB gateway endpoints, and compliance-focused deployments
• Network: Shared VPC with dedicated endpoint interfaces per connection

Learn more about AWS PrivateLink

For when you need your own private Virtual Private Cloud (VPC). Secure Compute gives you dedicated networks with VPC peering — your infrastructure stays completely isolated from other customers.

• Use case: Full network isolation and VPC peering
• Network: Dedicated VPC per customer

Learn more about Secure Compute

Bring Your Own Cloud runs your functions inside your own AWS account, so your compute and data never leave your cloud boundary. Vercel orchestrates routing and invocation, and responses return over an encrypted connection.

It exists to satisfy strict security, compliance, or data-residency mandates that require workloads to run in your own cloud. Because it moves infrastructure out of Vercel's managed boundary, plan for a substantial setup project and ongoing ownership of your AWS account's service quotas, scaling headroom, and account health.

• Use case: Compliance or data-residency mandates that require workloads in your cloud
• Network: Compute runs in your own AWS account

Bring Your Own Cloud is available on the Enterprise plan. To scope it, contact the Vercel sales team or your Vercel account team.

Static IPs and Secure Compute usage includes Private Data Transfer priced regionally based on the regional pricing documentation.

PrivateLink usage is tracked separately on your team's Usage tab. See AWS PrivateLink for setup and behavior.

Bring Your Own Cloud is an Enterprise feature with no published price. Contact the Vercel sales team to scope it.

Data transfer costs kick in for all traffic to or from your Vercel Functions, including those to external services and to the Vercel CDN:

• Database queries and responses
• API calls to third-party services
• File uploads and downloads
• Any other inbound or outbound network traffic

Keep tabs on your usage in the Team Settings Usage tab under the Private Data Transfer section.