Network Security
This guide covers network security for VeloDB Cloud SaaS warehouses and endpoint services used by both SaaS and BYOC warehouses. For a SaaS backend warehouse service, you can use Public Link with an IP allowlist or private connectivity to the warehouse. The warehouse-specific Console endpoint and the Metrics API can use a private endpoint published in each supported region. For BYOC-specific network placement and access controls, see BYOC Network Security.
For the step-by-step warehouse connection workflow, use Connection.
Access Methods
Choose the control that matches the access path:
| Access method | What it covers | Main security control | Operational page |
|---|---|---|---|
| Public Link (SaaS) | Warehouse connections and warehouse-specific Console traffic over the public network. | IP allowlist. | Public Link |
| Private connectivity to a warehouse (SaaS) | Applications in your VPC connect privately to the backend service of a specific warehouse. | VeloDB Cloud publishes the Endpoint Service. You create the private endpoint and control access from your cloud network. The IP allowlist does not apply. | Access VeloDB from Your VPC |
| Private connectivity from a warehouse to your VPC (SaaS) | A warehouse connects privately to a data source in your VPC. | You publish the Endpoint Service. VeloDB Cloud creates the private endpoint. | Grant VeloDB Access to Your VPC |
Public Link and private connectivity to a warehouse are independent access options. Validate the private endpoint before removing Public Link access for production workloads. An IP allowlist restricts source IP addresses for the applicable public access paths. It does not encrypt traffic. Connections to the VeloDB Console use HTTPS. For transport-encryption coverage by protocol and network path, see Encryption in Transit.
Public Link and IP Allowlist
Manage public-network access with the Public IP Allowlist in Warehouse Settings > Security. The IP allowlist governs Console data-plane operations and warehouse connections over the public network. It does not apply to connections through a private endpoint.
To access the warehouse over the public network, click Edit IP Allowlist and add the source public IP address or CIDR block to the allowlist. You can add, disable, or remove allowlist entries at any time.
The default allowlist entry is 0.0.0.0/0, which opens the warehouse to the entire public internet. Remove it as soon as you have added your real source IPs to reduce security risks.
Clients connecting from an allowlisted source IP can use the public connection methods shown on the Connection page, such as MySQL, JDBC, or HTTP.
Private Connectivity to a Warehouse
This is the private access path to the backend service of a specific warehouse. For every SaaS warehouse, VeloDB Cloud automatically creates and publishes an Endpoint Service. You create a private Endpoint in your VPC or VNet and connect it to the published service.
Applications in your private network can then connect to the warehouse without traversing the public internet. The IP allowlist does not apply to this path. Control access through the private endpoint, security groups, subnets, and other controls in your cloud environment.
This endpoint is separate from the warehouse-specific Console private endpoint, which carries data-plane requests from the frontend Console UI.
The Endpoint Service and your private Endpoint must be in the warehouse region. For setup instructions, see Access VeloDB from Your VPC.
Private Connectivity from a Warehouse to Your VPC
Use a separate connection model when a warehouse needs to access a data source in your VPC. You create and publish the Endpoint Service in your VPC. VeloDB Cloud creates and manages the Endpoint that connects to it.
For setup instructions, see Grant VeloDB Access to Your VPC.
Private Connectivity to Endpoint Services
VeloDB Cloud publishes a regional endpoint service for supported access paths such as warehouse-specific Console endpoints and the Metrics API. You create a private endpoint in the same region and configure hostname-specific private DNS records to route traffic through it.
For the service model, supported access paths, DNS considerations, and cloud-provider references, see Endpoint Services.
SaaS Security Summary
Security Features summarizes the VeloDB Cloud network security model:
- External network access must go through the gateway.
- Operations and maintenance access must go through VPN.
- Organizations are isolated from each other.
- Public network access is restricted by IP allowlist.
- Private network connection limits access sources through cloud-provider private networking.