Network Security
This guide covers network security for VeloDB Cloud SaaS warehouses and endpoint services used by both SaaS and BYOC warehouses. For a SaaS backend warehouse service, you can use a public endpoint with an IP allowlist or private connectivity to the warehouse. The warehouse-specific console endpoint and the Metrics API can use a private endpoint published in each supported region. For BYOC-specific network placement and access controls, see BYOC Network Security.
For the step-by-step warehouse connection workflow, use Connection.
Access Methods
Choose the control that matches the access path:
| Access method | What it covers | Main security control | Operational page |
|---|---|---|---|
| Public Endpoint (SaaS) | Warehouse connections and warehouse-specific console traffic over the public network. | IP allowlist. | Public IP allowlist |
| Private connectivity to a warehouse (SaaS) | Applications in your VPC connect privately to the backend service of a specific warehouse. | VeloDB Cloud publishes the Endpoint Service. You create the private endpoint and control access from your cloud network. The IP allowlist does not apply. | Access VeloDB from Your VPC |
| Private connectivity from a warehouse to your VPC (SaaS) | A warehouse connects privately to a data source in your VPC. | You publish the Endpoint Service. VeloDB Cloud creates the private endpoint. | Grant VeloDB Access to Your VPC |
Public and private endpoints are independent access options. Validate the private endpoint before removing public endpoint access for production workloads. An IP allowlist restricts source IP addresses for the applicable public access paths. It does not encrypt traffic. Connections to the VeloDB Cloud console use HTTPS. For transport-encryption coverage by protocol and network path, see Encryption in Transit.
Public endpoint and IP allowlist
Manage public-network access with the Public IP Allowlist in Warehouse Settings > Security. The IP allowlist governs console data-plane operations and warehouse connections over the public network. It does not apply to connections through a private endpoint.
Click Edit IP Allowlist, and then choose an access policy:
- Select Any IP address to allow the public access path from all source IP addresses.
- Select No public access to block the public access path.
- Select Specific IP addresses, and then enter the IP addresses or CIDR blocks that can use the public access path.
Click Save changes to apply the policy.
Warning:
Any IP address exposes the public access path to all source IP addresses. Use Specific IP addresses whenever possible.
Clients connecting from an allowlisted source IP can use the public connection methods shown on the Connection page, such as MySQL, JDBC, or HTTP.
Private Connectivity to a Warehouse
This is the private access path to the backend service of a specific warehouse. For every SaaS warehouse, VeloDB Cloud automatically creates and publishes an Endpoint Service. You create a private Endpoint in your VPC or VNet and connect it to the published service.
Applications in your private network can then connect to the warehouse without traversing the public internet. The IP allowlist does not apply to this path. Control access through the private endpoint, security groups, subnets, and other controls in your cloud environment.
This endpoint is separate from the warehouse-specific Console private endpoint, which carries data-plane requests from the frontend Console UI.
The Endpoint Service and your private Endpoint must be in the warehouse region. For setup instructions, see Access VeloDB from Your VPC.
Private Connectivity from a Warehouse to Your VPC
Use a separate connection model when a warehouse needs to access a data source in your VPC. You create and publish the Endpoint Service in your VPC. VeloDB Cloud creates and manages the Endpoint that connects to it.
For setup instructions, see Grant VeloDB Access to Your VPC.
Private Connectivity to Endpoint Services
VeloDB Cloud publishes a regional endpoint service for supported access paths such as warehouse-specific Console endpoints and the Metrics API. You create a private endpoint in the same region and configure hostname-specific private DNS records to route traffic through it.
For the service model, supported access paths, DNS considerations, and cloud-provider references, see Endpoint Services.
SaaS Security Summary
Security Features summarizes the VeloDB Cloud network security model:
- External network access must go through the gateway.
- Operations and maintenance access must go through VPN.
- Organizations are isolated from each other.
- Public network access is restricted by IP allowlist.
- Private network connection limits access sources through cloud-provider private networking.