Private Endpoint

A private endpoint is a network interface inside your own virtual private cloud that resolves to a managed service, so traffic to that service travels over the cloud provider's internal network instead of the public internet. Each major platform has its own name for the mechanism — AWS PrivateLink, Azure Private Endpoint, Google Cloud Private Service Connect — and the shape is the same: the service gets a private IP in your address space, your route tables and security groups govern access, and there is no public path to reach it. Buyers ask for private endpoints when a security review objects that a managed database, a model API, or a SaaS integration is reachable from the open internet even though it is authenticated. The control being bought is reachability, not confidentiality: TLS already protects the traffic in transit, so a private endpoint does not make an unencrypted connection safe. What it removes is exposure to the internet as an attack surface, along with the class of incidents that begins with a credential leaking and someone reaching the endpoint from anywhere. It also gives you a clean answer to the network-diagram question that recurs in every enterprise security questionnaire. There are practical costs. Private endpoints are usually gated to a vendor's enterprise tier, they carry an hourly charge plus per-gigabyte processing on most clouds, they only work when both sides are on the same cloud provider, and they add DNS complexity because the service hostname must resolve differently inside your network than outside it. For a small team the honest comparison is against IP allowlisting and short-lived credentials, which cover much of the same risk at a fraction of the operational cost.