SaaS connectivity

Your SaaS needs data from your customer's network. Get it without the VPN circus.

Your customers' APIs, databases, and internal tools live behind firewalls you don't control. ngrok gives your SaaS secure, scoped access without VPN setup, open ports, or VPC peering projects.

Follow the quickstart Talk to an engineer

How it works

One agent per customer. Every service on their network.

Your customer runs a lightweight agent behind their firewall. It dials out to ngrok on port 443 and gives you private endpoints to the APIs, databases, and services you're authorized to reach.

Diagram showing how traffic flows from your cloud through ngrok to customer networks

Customers run a lightweight agent that creates secure tunnels: outbound TLS connections from agents to the ngrok cloud on port 443.

Authorize connections with your choice of mTLS, IP restrictions, or JWTs. ngrok relays traffic from your cloud directly to the target service.

Diagram showing private addressability with the ngrok Kubernetes Operator wrapping connections in mTLS

Connections from your cloud to ngrok are wrapped in mTLS by the ngrok Kubernetes Operator. Only your cluster can ping the URL, so there's no need for auth.

Not running in Kubernetes? We also support private URLs with our agent CLI and Go SDK. Talk to an engineer

Diagram showing multiple services and endpoints connected through ngrok

Access more services on other protocols with one setup—DBs, web apps, IoT devices, and much more.

Expand from one to many customers with the same agent configuration and new private endpoints.

Why ngrok?

Customers can run an agent without networking projects. That shortens onboarding time and gets integrations live faster.

Keep customer networking out of your support queue. Your team focuses on product value instead of firewall tickets and peering issues.

One integration works for every enterprise topology. AWS, Azure, on-prem, and hybrid environments all use the same connection model.

Databricks did it. You can too.

Read the case study

Proven at enterprise scale.

Databricks evaluated 17 alternatives before choosing ngrok for secure ingress into customer environments across cloud and hybrid deployments.

Cut customer deployment time from months to hours and days.
Reached enterprise preview in roughly three months.
Reduced security review cycles with a single ingress model.
Eliminated public IP requirements across worker nodes.

Security

Pass your customer security review on the first try.

The ngrok agent already runs in banks, healthcare systems, and Fortune 100 networks. Your customers' security teams have seen it before.

Access a service, not your customer's whole network

Tightly scope your access to the APIs and databases you need and not a single port or process more.

Diagram showing scoped access to customer environment

Encrypt end-to-end with your own keys

Terminate TLS in your customer's network at the upstream service or the ngrok agent. The ngrok cloud service only sees ciphertext.

Restrict traffic regions for data residency

Comply with data residency requirements by selecting the exact ngrok data centers used to relay your connections.

Safe multi-tenancy with least-privilege agent ACLs

Agents operate with only the permissions you explicitly define. ACLs control which endpoints they can create and ensure strict separation across customer environments.

All the boxes you need to check

Your customers have questions.
We have answers.

Send your customers a complete Q&A on how ngrok works and why it's secure.

Check it out

Reliability

Hit all the 9s in your SLA.

Network failures are inevitable. Identify and recover from them automatically.

Reconnect automatically

You can't control your customer's network. That's why the ngrok agent runs in the background and heartbeats its connection to recover quickly after it sees connection reset by peer.

Heartbeat connection recovery visualization

Alert on issues before customers notice

Publish tunnel status and connection events to your telemetry platform. When a connection drops, you'll know before your customer does.

High availability with agent redundancy

Run multiple agents in your customer's network and ngrok will balance connections among them. You'll stay connected even when a machine running one agent fails.

Stay online during region outages

Agents create secure tunnels to multiple regions of the ngrok cloud service. You won't go down when entire datacenters fail (cough, us-east-1, cough).

Production Ready

Built for multi-tenant SaaS at scale.

Ship the agent to every customer

The ngrok agent is a cross-platform, dependency-free binary pre-packaged for Docker, Kubernetes, Windows, Linux, and macOS.

SDK installation commands for Rust, Python, Node, and Go

`import ngrok`

Embed the agent directly in your application with an SDK for BYOC deployments where your software already runs in the customer environment.

Package installation commands for Windows, Linux, Kubernetes, and Docker

Automate every customer

APIs for every feature, a Terraform provider for IaC, and bot users plus wildcard domains to automate per-customer onboarding.

White-label everything

Brand your URLs, agent connect address, and dedicated IPs with your own domains so customers associate the connection with your product.

Need to self-host ngrok?

Inquire about private edition

Connect your SaaS to your first customer network in 10 minutes.

No upfront costs. No contact sales. Pay only for what you use.

Follow the quickstart Talk to an engineer

Frequently asked questions

A pattern where your cloud-hosted software connects to private APIs, databases, or services running inside a customer's private network. Because ngrok uses secure tunnels, you don't need to ask your customer to adopt a VPN, open firewall ports, or enable IP allowlisting on their side.

Anything with a network address: REST APIs, databases (PostgreSQL, MySQL, MongoDB), internal web apps, IoT device APIs, legacy systems. If it has a port, you can reach it with ngrok and secure tunnels.

VPNs give you broad network access and require your customer's IT team to configure and maintain them. ngrok scopes access to specific services, runs as a lightweight agent container your customer deploys, and connects outbound over port 443.

Yes. ngrok replaces site-to-site VPNs, IPsec tunnels, and VPC peering for connecting one network to another. Instead of standing up VPN appliances and opening inbound ports, your customer runs an agent that dials out over an outbound-only reverse tunnel, so there are no open ports and no VPN to maintain.

A site-to-site VPN links two whole networks; a point-to-site VPN connects a single device into a network. Both grant broad network-level access and need configuration on the remote side. ngrok is neither: it exposes only the specific APIs, databases, or services you scope, with no network-wide access and nothing for your customer to configure beyond running the agent.

All three create outbound tunnels, but ngrok is built for SaaS vendors that need to reach services inside many customers' networks at once. It gives you per-customer agent ACLs, white-labeled connect URLs, and a full API and Terraform provider for automating the rollout. If you're evaluating a Cloudflare Tunnel or Tailscale alternative for multi-tenant site-to-site connectivity, that productization is the difference. For a use-case-by-use-case breakdown of where each tool wins, see our ngrok vs. Tailscale comparison.

Yes. Run the ngrok agent next to the database, whether it's PostgreSQL, MySQL, MongoDB, or anything with a port, and your cloud app reaches it over a secure tunnel. It works for hybrid cloud and multi-cloud setups where a service in AWS, Azure, or GCP needs to talk to a customer's on-premise data, with no firewall changes on their side.

PrivateLink and VPC peering only connect networks within the same cloud and still require setup on both sides. ngrok is cloud-agnostic: it connects your cloud to a customer's network over outbound tunnels, whether that network runs in any cloud, hybrid cloud, or on-prem. That makes it a PrivateLink alternative when your customers aren't all in the same AWS account or region.

No. The ngrok agent makes outbound TLS connections to the ngrok cloud on port 443, which is the same port as regular HTTPS traffic, to establish the secure tunnel. Most firewalls allow this by default.

The agent heartbeats its connection to the ngrok cloud every 10 seconds. If it doesn't get a response within 15 seconds, it terminates and immediately attempts to reconnect. You can also run multiple redundant agents per customer, and agents connect to multiple regions so a regional outage doesn't take you down.

Through ngrok's regional points of presence, which are available in the US (Ohio and California), EU (Frankfurt), APAC (Sydney, Singapore, Tokyo, Mumbai), and South America (São Paulo). You can pin traffic to specific regions to satisfy data residency requirements.

SOC 2 Type II, HIPAA/BAA, GDPR, CCPA, and EU-US DPF. Full documentation and audit reports are available at trust.ngrok.com.

You don't need to. We've written a complete Q&A you can send directly to your customers explaining how ngrok works and why it's secure. Check out the guide.

You only pay for what you use. Pricing is based on how often your endpoints are active, the traffic you push through ngrok, the number of Traffic Policy executions, and more. See full pricing.

Your SaaS needs data from your customer's network. Get it without the VPN circus.

One agent per customer. Every service on their network.