Private networking

Private networking lets your applications reach Hindsight on a private IP address inside your own network, so memory traffic never crosses the public internet. This page is for network and security teams connecting a private cloud or BYOC deployment. It covers the options for each cloud, which deployment options support them, and who does what during setup.

Options

Option	Cloud	How it works
AWS PrivateLink	AWS	We publish Hindsight as a VPC endpoint service. You create an interface VPC endpoint to it in your VPC.
GCP Private Service Connect	Google Cloud	We publish Hindsight through a service attachment. You create a Private Service Connect endpoint to it in your VPC.
Azure Private Link	Azure	We publish Hindsight as a Private Link service. You create a private endpoint to it in your VNet.
IP allowlisting	Any	Hindsight's public endpoints accept connections only from the address ranges you specify.

All three private options work the same way: the connection is one-way from your network to Hindsight, and traffic stays on the cloud provider's backbone. You don't need VPC peering, a transit gateway or a VPN, and your address ranges can overlap ours.

Which deployment options support what

Deployment option	Private networking	IP allowlisting
Private cloud	AWS PrivateLink, GCP Private Service Connect, Azure Private Link	Yes
BYOC	AWS PrivateLink, GCP Private Service Connect, Azure Private Link	Yes
On-premises	Not needed: Hindsight runs inside your network	Your own network controls apply
Hindsight Cloud with Enterprise features	Not available: uses public HTTPS endpoints	Not available

A private cloud deployment runs in Vectorize's cloud account, so private networking is how your VPC reaches it without the internet. A BYOC deployment already sits on a private load balancer inside your account, so private networking is how you reach it from your other VPCs, accounts or projects, such as the one your application runs in.

What stays the same

Private networking doesn't change how you use Hindsight:

• Same hostnames. Your applications keep using the Hindsight hostnames for your deployment. Those names resolve to the private endpoint address.
• Same TLS certificate. The endpoint serves the same publicly trusted certificate, so you don't need to change trust stores.
• HTTPS only. Endpoints accept traffic on port 443.

How setup works

Setup is a short exchange between your team and ours. Neither side needs access to the other's network.

1. You tell us who will connect. Send us the identity that will own the endpoint, and the region your application runs in:
   • AWS: the AWS account ID that will create the endpoint.
   • Google Cloud: the project ID that will create the endpoint.
   • Azure: the subscription ID that will create the endpoint.
2. We publish the service. We create the endpoint service in front of your deployment, allow only the identities you gave us, and send you its name:
   • AWS: an endpoint service name such as com.amazonaws.vpce.<region>.vpce-svc-<id>, and the availability zone IDs it's offered in.
   • Google Cloud: the service attachment URI.
   • Azure: the Private Link service alias or resource ID.
3. You create the endpoint. You create the endpoint in your network, pointed at that service, and restrict which of your workloads can use it.
4. We approve the connection. New connections wait for manual approval. We confirm the request comes from the identity you gave us, then accept it.
5. We point DNS at the endpoint. Your deployment's hostnames are set to resolve to the endpoint's private address (details per cloud below).
6. You verify. From inside your network, the API hostname resolves to a private address and requests succeed.

Endpoints are regional. Create yours in the same region as the Hindsight endpoint service. If you need to connect from another region, tell us and we'll plan for it.

AWS PrivateLink

We provide a CloudFormation template that creates the consumer side for you: an interface VPC endpoint and a security group that allows HTTPS from your application only. You supply:

Parameter	What to enter
Endpoint service name	The name we send you.
VPC	The VPC your application runs in.
Subnets	One subnet per availability zone you'll connect from, in the zones the service is offered in.
Allowed security group (preferred) or allowed CIDR	The security group your application runs under, or a CIDR range. Only these clients can reach the endpoint.

A few things to check before you run it:

• Match availability zones by zone ID, not name. Zone names such as us-east-1a map to different physical zones in different AWS accounts. List your zone IDs with aws ec2 describe-availability-zones --query "AvailabilityZones[].[ZoneName,ZoneId]" --output table and use subnets in the zone IDs we send you. If none match, tell us and we'll extend the service to your zones.
• Enable DNS on the VPC. The endpoint uses private DNS, so the Hindsight API hostname resolves to the endpoint inside your VPC. That requires both enableDnsSupport and enableDnsHostnames to be on for the VPC. The stack fails at endpoint creation if either is off. Turn it on and run it again.
• Create the stack in the service's region. The template checks this and stops if the regions don't match.

With private DNS, there's nothing to send back: we've already proven ownership of the hostname to AWS, and your application keeps using its existing hostname. The stack outputs the endpoint ID and DNS name for diagnostics.

GCP Private Service Connect

We publish your deployment's internal load balancer through a service attachment that requires manual acceptance. To connect:

1. Reserve an internal IP address in a subnet of your VPC, in the same region.
2. Create a Private Service Connect endpoint (a forwarding rule) that targets the service attachment URI we sent you.
3. Send us your project ID and the endpoint IP address.

We accept the connection and publish your deployment's UI, API and sign-in hostnames on our domain, resolving to your endpoint's IP address. Clients in your VPC (or networks connected to it) then use those hostnames as usual. Use your VPC firewall rules to control which workloads can reach the endpoint.

Azure Private Link

We publish your deployment's internal load balancer as a Private Link service, visible only to the subscription you gave us. To connect:

1. Create a private endpoint in a subnet of your VNet, in the same region, that connects to the Private Link service alias or resource ID we sent you.
2. Send us your subscription ID and the private endpoint's IP address.

We approve the connection and point your deployment's hostnames at the private endpoint's IP address. Use network security groups on the subnet to control which workloads can reach it.

IP allowlisting

If some clients need to reach Hindsight over the internet, for example people using the UI from your corporate network, we can add a public endpoint that accepts connections only from the address ranges you specify.

• Send us your egress ranges. List the public IP addresses or CIDR ranges your users and applications connect from.
• Combine with private networking. You can keep application API traffic on a private endpoint while sign-in and the UI are reachable from your allowlisted ranges.
• Update at any time. Adding or removing ranges doesn't cause downtime.
• Unlisted addresses are dropped. Connections from addresses outside the allowlist time out at the network layer, before reaching Hindsight.

Next steps

• Choose a deployment option on the deployment overview.
• Once connected, see Accessing your deployment.
• Book a call or contact your Hindsight representative to plan your network setup.