Network Security
For SaaS warehouses, you can use Public Link with an IP allowlist or PrivateLink. BYOC warehouses use the networking in your own cloud environment and do not use the SaaS Public Link or PrivateLink access model. This guide explains which access path the IP allowlist governs and which paths need private-network controls instead.
In this guide, Console data-plane operations are actions in the VeloDB Console that require communication with a warehouse to read, write, or inspect data. Examples include running queries in SQL Editor, importing data through Import Data, and viewing query activity in Query Audit.
For the step-by-step connection workflow, use Connection.
Access Methods
Choose the control that matches the access path:
| Access method | What it covers | Main security control | Operational page |
|---|---|---|---|
| Public Link (SaaS) | Console data-plane operations and warehouse connections over the public network. | IP allowlist. | Public Link |
| PrivateLink (SaaS) | Direct private connections from your VPC. | Cloud-provider private endpoint and network controls. The IP allowlist does not apply. | Access VeloDB from Your VPC |
| Public Access Allowlist (BYOC) | Console data-plane operations. BYOC does not expose a separate VeloDB-managed public endpoint for direct warehouse connections. | IP allowlist. It does not affect control-plane operations or direct private connections. | Connect to a BYOC Warehouse |
For SaaS, Public Link and PrivateLink are independent access options. Validate PrivateLink before removing Public Link access for production workloads. An IP allowlist restricts source IP addresses for the applicable public access paths. It does not encrypt traffic. Connections to the VeloDB Console use HTTPS. For transport-encryption coverage by protocol and network path, see Encryption in Transit.
Public Link and IP Allowlist
On the warehouse Connection page, switch to the Public Link tab to manage public-network access. The IP allowlist governs Console data-plane operations and warehouse connections over the public network. It does not apply to PrivateLink connections.
To access the warehouse over the public network, add the source public IP address or CIDR block to the allowlist. You can add, disable, or remove allowlist entries at any time.
The default allowlist entry is 0.0.0.0/0, which opens the warehouse to the entire public internet. Remove it as soon as you have added your real source IPs to reduce security risks.
Clients connecting from an allowlisted source IP can use the public connection methods shown on the Connection page, such as MySQL, JDBC, or HTTP.
PrivateLink
PrivateLink lets applications in your VPC access VeloDB Cloud privately across VPC boundaries. It simplifies the network architecture and avoids exposing warehouse access to the public internet.
A PrivateLink connection has two components: an Endpoint Service and an Endpoint.
| Direction | VeloDB Cloud owns | Customer owns | Use case |
|---|---|---|---|
| Access VeloDB from your VPC | Endpoint Service. | Endpoint in your VPC. | BI tools, applications, reporting jobs, and log analytics jobs that connect to the warehouse. |
| VeloDB accesses your VPC | Endpoint created by VeloDB Cloud. | Endpoint Service in your VPC. | VeloDB reads from resources inside your VPC, for example a data source for import. |
PrivateLink setup is region-scoped. The cloud-provider region must match the VeloDB warehouse region. Security groups, subnets, and endpoint DNS names are configured in the cloud-provider console as described in Connection.
BYOC Public Access Allowlist
For a BYOC warehouse, open Connection and use Public Access Allowlist > Edit IP Allowlist. BYOC does not expose a separate public endpoint for direct warehouse connections. This allowlist restricts the source IP addresses from which users can perform Console data-plane operations.
It does not affect control-plane operations, such as creating, deleting, or scaling resources, or direct private connections. Use the private-network controls for your deployment to govern direct private connections.
Selecting Nowhere blocks Console data-plane operations through the public access path. If no private access path is configured, Console features that require warehouse connectivity cannot reach the warehouse. This is not an organization-wide disablement control. To request organization-wide disablement, contact VeloDB Support.
BYOC Network Placement
In BYOC deployments, warehouse compute and customer warehouse storage are deployed in your cloud environment. The BYOC creation pages document provider-specific setup for AWS, Google Cloud, and Azure, including VPC or subnet preparation and cloud-resource orchestration.
For BYOC security operations, see BYOC Security. For provider-specific setup, see Create BYOC Warehouse.
Security Summary
Security Features summarizes the VeloDB Cloud network security model:
- External network access must go through the gateway.
- Operations and maintenance access must go through VPN.
- Organizations are isolated from each other.
- Public network access is restricted by IP allowlist.
- Private network connection limits access sources through cloud-provider private networking.