AWS · Azure Private Link
Dedicated connectivity. No public internet.
Private Link is bem's dedicated, single-tenant connectivity option. Your traffic travels from your VPC to your bem endpoint over the AWS or Azure private backbone, never the public internet. Same API, same SDKs, same observability.
Provisioning takes one business day. Existing pay-as-you-go function pricing applies on top of the add-on.
$500
per month, on top of usage
What is included
- A dedicated VPC Endpoint Service
- NLB across three availability zones
- AWS PrivateLink and Azure Private Link
- Cross-region routing over the private backbone
- Customer-managed key support
Same product. Private wire.
Your application keeps calling the same v3 API. The only thing that changes is that the hostname resolves to a private endpoint inside your VPC, and the packets never see a public IP.
- Per-customer endpoint
Single-tenant connectivity
A dedicated VPC Endpoint Service is provisioned for your organization. Your traffic ends on infrastructure that nobody else shares.
- Multi-AZ · auto-failover
NLB across three AZs
bem fronts your endpoint with a Network Load Balancer striped across three availability zones, so there is no single-zone failure mode.
- Cross-region capable
AWS and Azure
AWS PrivateLink and the Azure Private Link equivalent. Cross-region connections are supported over the private backbone.
Your VPC. Our data plane. One private hop.
bem provisions a VPC Endpoint Service in the region of your choice. You create an Interface VPC Endpoint in your account and point a private DNS record at it. From then on, every call to the bem API stays on the cloud provider's private backbone.
- Your VPCapi.internal.bem.ai10.0.1.45
- VPC EndpointInterface ENIYour account
- bem regionNLB across 3 AZsus-east-1 · eu-west-1
- 01
Service
We provision a dedicated VPC Endpoint Service for your organization.
- 02
Endpoint
You create an Interface VPC Endpoint in your VPC.
- 03
Private DNS
You point private DNS at the endpoint IP.
- 04
Result
Traffic stays on the cloud provider's private backbone.
The audit-friendly default.
Most teams start on multi-tenant cloud and add Private Link when procurement or the internal security team flags public-internet egress as a blocker.
- 01
Regulated industries
Financial services, insurance, healthcare, and government workloads, where public-internet traffic is a deal-breaker on security review.
- 02
Sensitive data
PHI, PII, financial statements, claims data, and defense-adjacent records: anything where the audit trail has to show that traffic never left the private cloud backbone.
- 03
Audit requirements
SOC 2, HIPAA, PCI, and internal IT controls that require documented private connectivity for any outbound integration that carries sensitive payloads.
$500 a month. On top of usage.
A flat add-on to your existing bem subscription. Function call pricing stays pay-as-you-go, with the same volume curve as multi-tenant. No setup fee.
$500
per month
Includes the dedicated VPC Endpoint Service, NLB across three availability zones, cross-region routing, and customer-managed key support. Billed monthly, cancel anytime.
Stacks with
- Pay-as-you-go function calls, on the same volume curve
- The first 100 function calls every month, free
- Graduated volume discounts
- A HIPAA BAA, included at any tier
One business day.
Tell us your AWS or Azure account ID, your preferred region, and your private DNS plan. We provision the endpoint service, you create the endpoint, and the same v3 API answers on a private IP.