Networking
Connect your projects to backend services that require IP allowlisting or dedicated private networking.
Vercel has three networking options: Static IPs, Secure Compute, and Bring Your Own Cloud. This section details the requirements and costs of each option.
| Option | Best for | What it adds | Network model | Plan |
|---|---|---|---|---|
| Static IPs | Teams that need IP allowlisting without infrastructure changes | A stable, dedicated egress surface you can allowlist | Multi-tenant compute, shared VPC with subnet-level isolation | Pro and Enterprise |
| Secure Compute | Teams that need a private VPC, dedicated networks, or regulatory isolation | A network perimeter isolated from every other customer, with VPC peering | Single-tenant, dedicated VPC | Enterprise add-on |
| Bring Your Own Cloud | Compliance or data-residency mandates that require workloads in your cloud | A network and compute boundary you own end to end | Compute runs in your own AWS account | Enterprise |
Review the requirement for each option and choose the first one that matches your situation:
- Your backend, database, or API needs a set of known source IPs to add to an allowlist, and public connectivity is acceptable. Use Static IPs.
- You need VPC peering into your own AWS environment, a dedicated single-tenant VPC, or network isolation to satisfy a regulatory requirement. Use Secure Compute.
- A compliance or data-residency mandate requires your compute to run inside your own AWS account. Use Bring Your Own Cloud.
When your database or API needs to see traffic from known IP addresses, Static IPs give you shared static egress IPs that won't change. Perfect for Pro and Enterprise teams who need IP allowlisting without the complexity.
- Use case: IP allowlisting for databases, APIs, and legacy systems
- Network: Shared VPC with subnet-level isolation
- Pricing: $100/month per project + Private Data Transfer at regional rates
For when you need your own private Virtual Private Cloud (VPC). Secure Compute gives you dedicated networks with VPC peering — your infrastructure stays completely isolated from other customers.
- Use case: Full network isolation and VPC peering
- Network: Dedicated VPC per customer
Learn more about Secure Compute
Bring Your Own Cloud runs your functions inside your own AWS account, so your compute and data never leave your cloud boundary. Vercel orchestrates routing and invocation, and responses return over an encrypted connection.
It exists to satisfy strict security, compliance, or data-residency mandates that require workloads to run in your own cloud. Because it moves infrastructure out of Vercel's managed boundary, plan for a substantial setup project and ongoing ownership of your AWS account's service quotas, scaling headroom, and account health.
- Use case: Compliance or data-residency mandates that require workloads in your cloud
- Network: Compute runs in your own AWS account
Bring Your Own Cloud is available on the Enterprise plan. To scope it, contact the Vercel sales team or your Vercel account team.
Static IPs and Secure Compute usage includes Private Data Transfer priced regionally based on the regional pricing documentation.
Bring Your Own Cloud is an Enterprise feature with no published price. Contact the Vercel sales team to scope it.
| Feature | Static IPs (Pro) | Secure Compute (Enterprise) |
|---|---|---|
| Monthly cost | $100/month per project | Custom |
| Private Data Transfer | Regional pricing | Custom |
| Network isolation | Shared VPC with subnet-level isolation | Dedicated VPC and subnet per customer |
Data transfer costs kick in for all traffic to or from your Vercel Functions, including those to external services and to the Vercel CDN:
- Database queries and responses
- API calls to third-party services
- File uploads and downloads
- Any other inbound or outbound network traffic
Keep tabs on your usage in the Team Settings Usage tab under the Private Data Transfer section.
Was this helpful?