1. Navigate to your team's Settings → Networking.
2. Click Create Network to start the setup process.
3. Select your desired Region: choose the region closest to your backend infrastructure for best performance.
4. Optionally expand Advanced options to configure:
   • CIDR Address Block: Specify a custom private IPv4 address range.
   • Availability Zones: Select specific AWS Availability Zones within your chosen region.
5. Click Next to review your settings.
6. Click Create Network to provision your network.

When you enable Secure Compute on a project, Vercel attaches your project's build container and subsequent deployment inside a Secure Compute network with a specific IP address pair ( dedicated IP). You can choose to exclude the build container from the private network.

Secure Compute networks and dedicated IP addresses

Each private network has its own dedicated IP pair and is isolated from others, ensuring no sharing across teams. You can assign multiple projects to a Secure Compute network, but each project belongs to only one active and one passive network.

You can create multiple Secure Compute networks for your team directly from the dashboard. For example, separate networks for different projects, environments, or teams. Navigate to your team's Settings → Networking and click Create Network to add additional networks.

Once your IP pair is ready, add it to your backend's access control list. You'll still need to use a username/password or authentication key on top of the IP filtering. The IPs alone aren't enough.

Specific region

When you create a Secure Compute network, you select the Vercel Function region where it will be provisioned. For the best performance, pick the same region where your backend runs.

Vercel applies Secure Compute to Vercel Functions using the following runtimes:

• Node.js
• Ruby
• Go
• Python

The Edge Runtimeis not supported meaning features like Routing Middleware and Vercel Functions using the edge runtime will not use the provided dedicated IP addresses.

Region failover

Secure Compute supports automatic region failover using the active and passive network concept. Each project environment can have:

• Active Network: The primary Secure Compute network where your functions run
• Passive Network: A secondary network in a different region for automatic failover

To set up region failover:

1. Create networks in different regions: Navigate to your team's Settings → Networking and click Create Network to create Secure Compute networks in your primary and failover regions.
2. Connect project environments: In your project's Settings → Networking, configure each environment (Production, Preview, etc.) with an Active Network (primary) and an optional Passive Network (failover).
3. Automatic failover: When enabled, Vercel automatically switches to the passive network if the primary region becomes unavailable, ensuring your Vercel Functions continue to operate.

Add a project to your Secure Compute network

To add a project to your Secure Compute network:

1. Navigate to your project's Settings → Networking.
2. For every environment you want to connect to Secure Compute:
   • Select an Active Network.
   • Optionally select a Passive Network to enable passive failover.
   • Optionally enable Builds to include the project's build container in the network.
3. Click Save to persist your changes.

To change multiple environments at once:

1. Select the environments using checkboxes or use the checkbox in the table header to select all environments.
2. Click Edit Selected.
3. In bulk edit modal:
   • Select an Active Network.
   • Optionally select a Passive Network to enable passive failover.
   • Optionally check Include Builds to include the project's build container in the network.
   • Click Apply to modify the selected environments.
4. Click Save to persist your changes.

Managing the build container

When you add a project to a Secure Compute network, you can choose to include the project's build container in the network. This is useful if your application calls your data sources at build time.

You can opt the build container out of using the dedicated IP addresses. This is useful if your application only calls your data sources at run time and not at build time.

By opting out of including the build container, you will not incur the 5s delay when provisioning a secure build container.

To manage the build container during the project connection process select Include Builds.

To manage the build container after the project is connected to the Secure Compute network:

1. Navigate to your team's Settings → Networking.
2. Select a private network from the list.
3. Open Projects in the sidebar.
4. Click the
5. Check/uncheck Include Builds to include/exclude the project's build container in the network.
6. Click Save.

Multiple Secure Compute networks

You can use one network with multiple projects in the same team. In this case, the same IP pair is shared across multiple projects.

If you require additional security or have a large team, you can have one network for each project so that each project will have its own dedicated IP pair.

Connecting a project to multiple networks across different regions is currently not supported. Each project environment can only be linked to a single active network within a single region. A passive network in a different region may only be used for failover.

VPC peering

Virtual private cloud (VPC) peering is a method of connecting two VPCs in the same or different region. When you use Secure Compute, Vercel accepts a VPC peering connection between your Vercel Secure Compute network and your AWS VPC.

To set up VPC peering:

1. Create a Secure Compute network: Navigate to your team's Settings → Networking and click Create Network. Select your desired region and optionally specify a CIDR block. The CIDR blocks of your Secure Compute network and your AWS VPC must not overlap.
2. Set up peering in AWS: In your AWS VPC dashboard, configure the peering connection by copying the values from your Secure Compute network settings, and pasting in the AWS VPC peering connection settings:
   • Requester VPC ID: Your VPC ID
   • Account ID: The AWS account ID
   • Accepter VPC ID: Your Vercel Secure Compute network's VPC Peering ID
   • Region: Your Vercel Secure Compute network's region
3. Create peering connection: In the AWS VPC peering connection settings, click Create Peering Connection to establish the connection.
4. Accept peering connection: Go back to your Vercel dashboard and click Accept to accept the connection.
5. Update route tables: Go to AWS's VPC dashboard, select Route Tables, and configure routing to allow traffic from Vercel's CIDR block.

The connection can be deleted from either the Vercel dashboard, or the AWS VPC dashboard.

VPN support

Because Secure Compute gives you a dedicated network that Vercel runs on your behalf, you can establish private connectivity with networks in any cloud provider, including your own data centers. Where VPC peering covers AWS, a site-to-site (S2S) VPN terminated on your Secure Compute network covers everything else:

• Microsoft Azure: connect to an Azure Virtual Network. Once the connection is established, your Vercel Functions can reach Azure services exposed in the same network, including VMs, Kubernetes clusters, or platform services through Private Endpoints. See Using Vercel with Microsoft Azure.
• Google Cloud: connect to a Google Cloud VPC network and the services running inside it.
• On-premises and other environments: connect to a data center or any other network that terminates a standard site-to-site VPN.

If your current security and compliance obligations require more than dedicated IP addresses, contact us for guidance related to your specific needs.