Database connectivity

Connect to on-prem databases from the cloud without a VPN.

Reach PostgreSQL, MySQL, MongoDB, and SQL Server inside your customer's network without firewall changes, open ports, or an IT ticket. One lightweight agent makes outbound-only, end-to-end encrypted connections.

Follow the quickstart Talk to an engineer

How it works

Skip the VPN, PrivateLink, and VPC peering.

Your customer installs a lightweight agent that dials out on port 443. You get a private endpoint that reaches their database directly across cloud, on-prem, and hybrid environments.

Diagram showing how traffic flows from your cloud through ngrok to customer networks

Customers run a lightweight agent that creates secure tunnels: outbound TLS connections from agents to the ngrok cloud on port 443.

Authorize connections with your choice of mTLS, IP restrictions, or JWTs. ngrok relays traffic from your cloud directly to the target service.

Diagram showing private addressability with the ngrok Kubernetes Operator wrapping connections in mTLS

Connections from your cloud to ngrok are wrapped in mTLS by the ngrok Kubernetes Operator. Only your cluster can ping the URL, so there's no need for auth.

Not running in Kubernetes? We also support private URLs with our agent CLI and Go SDK. Talk to an engineer

Diagram showing multiple services and endpoints connected through ngrok

Access more services on other protocols with one setup—DBs, web apps, IoT devices, and much more.

Expand from one to many customers with the same agent configuration and new private endpoints.

Why ngrok?

Skip the 6-week VPN setup. Customers deploy an agent container and you're connected in minutes, not months.

Access the database, not the whole network. Scope connectivity to exactly the database host and port you need, nothing more.

You sell software, not networking. ngrok handles the connectivity layer so your team can focus on product and integrations.

Databricks did it. You can too.

Read the case study

Proven at enterprise scale.

Databricks evaluated 17 alternatives before choosing ngrok for secure ingress into customer environments across cloud and hybrid deployments.

Cut customer deployment time from months to hours and days.
Reached enterprise preview in roughly three months.
Reduced security review cycles with a single ingress model.
Eliminated public IP requirements across worker nodes.

Security

Sail through the most rigorous security assessments.

The ngrok agent already runs in banks, healthcare systems, and Fortune 100 networks to deliver private connectivity.

Access a service, not your customer's whole network

Tightly scope your access to the APIs and databases you need and not a single port or process more.

Diagram showing scoped access to customer environment

Encrypt end-to-end with your own keys

Terminate TLS in your customer's network at the upstream service or the ngrok agent. The ngrok cloud service only sees ciphertext.

Restrict traffic regions for data residency

Comply with data residency requirements by selecting the exact ngrok data centers used to relay your connections.

Safe multi-tenancy with least-privilege agent ACLs

Agents operate with only the permissions you explicitly define. ACLs control which endpoints they can create and ensure strict separation across customer environments.

All the boxes you need to check

Your customers have questions.
We have answers.

Send your customers a complete Q&A on how ngrok works and why it's secure.

Check it out

Reliability

Hit all the 9s in your SLA.

Network failures are inevitable. Identify and recover from them automatically.

Reconnect automatically

You can't control your customer's network. That's why the ngrok agent runs in the background and heartbeats its connection to recover quickly after it sees connection reset by peer.

Heartbeat connection recovery visualization

Alert on issues before customers notice

Publish tunnel status and connection events to your telemetry platform. When a connection drops, you'll know before your customer does.

High availability with agent redundancy

Run multiple agents in your customer's network and ngrok will balance connections among them. You'll stay connected even when a machine running one agent fails.

Stay online during region outages

Agents create secure tunnels to multiple regions of the ngrok cloud service. You won't go down when entire datacenters fail (cough, us-east-1, cough).

Production Ready

Everything you need to productize and scale.

Prepackaged for every OS, Docker & Kubernetes

The ngrok agent is a cross-platform, lightweight, dependency-free executable. We've pre-packaged it to make distribution easy for you.

SDK installation commands for Rust, Python, Node, and Go

`import ngrok`

Embed the ngrok agent in your own code with an SDK if a sidecar isn't right for you. Great for when your software is already running in your customer's environment (like bring-your-own-cloud).

Package installation commands for Windows, Linux, Kubernetes, and Docker

Automate everything with APIs

There's an API for every feature so it's easy to scale across all your customers. We've also integrated ngrok into the declarative IaC tools you use to manage the rest of your production infra.

White-label everything your customers see

Brand your URLs and the address the agent connects to with your own domains. You can assign them dedicated IPs, too.

Need to self-host ngrok?

Inquire about private edition

Connect to your first customer database in 10 minutes.

No upfront costs. No contact sales. Pay only for what you use.

Follow the quickstart Talk to an engineer

Frequently asked questions

A pattern where your cloud-hosted software connects to private APIs, databases, or services running inside a customer's private network. Because ngrok uses secure tunnels, you don't need to ask your customer to adopt a VPN, open firewall ports, or enable IP allowlisting on their side.

Anything with a network address: REST APIs, databases (PostgreSQL, MySQL, MongoDB), internal web apps, IoT device APIs, legacy systems. If it has a port, you can reach it with ngrok and secure tunnels.

VPNs give you broad network access and require your customer's IT team to configure and maintain them. ngrok scopes access to specific services, runs as a lightweight agent container your customer deploys, and connects outbound over port 443.

Yes. ngrok replaces site-to-site VPNs, IPsec tunnels, and VPC peering for connecting one network to another. Instead of standing up VPN appliances and opening inbound ports, your customer runs an agent that dials out over an outbound-only reverse tunnel, so there are no open ports and no VPN to maintain.

A site-to-site VPN links two whole networks; a point-to-site VPN connects a single device into a network. Both grant broad network-level access and need configuration on the remote side. ngrok is neither: it exposes only the specific APIs, databases, or services you scope, with no network-wide access and nothing for your customer to configure beyond running the agent.

All three create outbound tunnels, but ngrok is built for SaaS vendors that need to reach services inside many customers' networks at once. It gives you per-customer agent ACLs, white-labeled connect URLs, and a full API and Terraform provider for automating the rollout. If you're evaluating a Cloudflare Tunnel or Tailscale alternative for multi-tenant site-to-site connectivity, that productization is the difference. For a use-case-by-use-case breakdown of where each tool wins, see our ngrok vs. Tailscale comparison.

Yes. Run the ngrok agent next to the database, whether it's PostgreSQL, MySQL, MongoDB, or anything with a port, and your cloud app reaches it over a secure tunnel. It works for hybrid cloud and multi-cloud setups where a service in AWS, Azure, or GCP needs to talk to a customer's on-premise data, with no firewall changes on their side.

PrivateLink and VPC peering only connect networks within the same cloud and still require setup on both sides. ngrok is cloud-agnostic: it connects your cloud to a customer's network over outbound tunnels, whether that network runs in any cloud, hybrid cloud, or on-prem. That makes it a PrivateLink alternative when your customers aren't all in the same AWS account or region.

No. The ngrok agent makes outbound TLS connections to the ngrok cloud on port 443, which is the same port as regular HTTPS traffic, to establish the secure tunnel. Most firewalls allow this by default.

The agent heartbeats its connection to the ngrok cloud every 10 seconds. If it doesn't get a response within 15 seconds, it terminates and immediately attempts to reconnect. You can also run multiple redundant agents per customer, and agents connect to multiple regions so a regional outage doesn't take you down.

Through ngrok's regional points of presence, which are available in the US (Ohio and California), EU (Frankfurt), APAC (Sydney, Singapore, Tokyo, Mumbai), and South America (São Paulo). You can pin traffic to specific regions to satisfy data residency requirements.

SOC 2 Type II, HIPAA/BAA, GDPR, CCPA, and EU-US DPF. Full documentation and audit reports are available at trust.ngrok.com.

You don't need to. We've written a complete Q&A you can send directly to your customers explaining how ngrok works and why it's secure. Check out the guide.

You only pay for what you use. Pricing is based on how often your endpoints are active, the traffic you push through ngrok, the number of Traffic Policy executions, and more. See full pricing.

Connect to on-prem databases from the cloud without a VPN.

Skip the VPN, PrivateLink, and VPC peering.