VPN options

Connect Patchworks to resources inside your private network - such as on-premise systems or internal APIs - using a dedicated VPN connection.

Overview

Some integrations require Patchworks to reach resources that aren't accessible over the public internet - such as internal ERP systems, on-premise databases, or private APIs behind a corporate firewall. VPN options give you a secure, dedicated tunnel between Patchworks' infrastructure and your network.

Two tiers are available, depending on whether you need to run custom scripts that also require VPN access:

Connector + Scripts

Full VPN access

VPN access for both connectors and custom scripts that need to reach private network resources.

Includes

• ✓ Connector access to VPN resources

• ✓ Custom script access to VPN resources

• ✓ Node group(s)

• ✓ Dedicated customer queue (push/pull)

• ✓ Dedicated subnet(s)

• ✓ AWS Site-to-Site VPN tunnel

Connector only

Connector VPN access

VPN access scoped to connectors only. Custom scripts continue to run on the shared infrastructure.

Includes

• ✓ Connector access to VPN resources

• ✗ Custom scripts (shared queue)

• ✓ Node group

• ✓ Dedicated customer queue (push/pull)

• ✓ Dedicated subnet(s)

• ✓ AWS Site-to-Site VPN tunnel

Both options give your company its own node group(s), providing entirely dedicated, separated traffic. Push/pull jobs also run on a dedicated customer queue. Custom scripts are an exception - they use the shared queue in both tiers.

How it works

Both VPN tiers are built on AWS Site-to-Site VPN, which creates an encrypted IPsec tunnel between your network and the dedicated Patchworks VPC (Virtual Private Cloud) provisioned for your company.

🔗AWS Site-to-Site VPN — official documentation docs.aws.amazon.com

At a high level, the provisioning process works like this:

Your network

──── IPsec tunnel ────

AWS VPN gateway

→

Customer VPC

Inside the Customer VPC

New subnet(s)

→

Node group(s)

→

Dedicated queue

Dedicated infrastructure

Unlike standard Patchworks tenancy - where node groups and queues are shared across customers - VPN customers receive:

• A new set of subnets provisioned per customer inside the AWS VPC

• A dedicated node group (or multiple, depending on your workload) - ensuring your traffic is never co-mingled with other customers

• A dedicated push/pull queue - so inbound and outbound events are isolated end-to-end

Custom scripts run on a shared script queue in both tiers. If your custom scripts also need to reach private network resources, you need the Connector + Scripts tier

Tier comparison

Feature	Connector only	Connector + Scripts
Connector access to VPN resources	✓ Yes	✓ Yes
Custom script access to VPN resources	✗ No	✓ Yes
Dedicated node group(s)	✓ Yes	✓ Yes
Dedicated push/pull queue	✓ Yes	✓ Yes
Dedicated subnets (per customer)	✓ Yes	✓ Yes
VPN technology	AWS Site-to-Site VPN	AWS Site-to-Site VPN

• The current implementation uses AWS Site-to-Site VPN.

• Final pricing will be confirmed during customer review.

• Setup requires coordination with your network team to configure the VPN tunnel from your side.

Getting started

VPN connectivity is set up on a per-customer basis by the Patchworks team. To get started:

1

Contact Patchworks

Contact your Patchworks account manager or reach out via support to express interest.

2

Share network resource details

Share details about the network resources that Patchworks needs to reach (endpoints, protocols, ports).

3

Configure the customer-side VPN endpoint

Your network team will need to configure the customer-side VPN endpoint - Patchworks will provide the AWS VPN gateway details.

4

Provision dedicated infrastructure

Patchworks provisions your dedicated subnets, node group(s), and queue.

5

Test connectivity

Connectivity is tested end-to-end before go-live.

There is no self-service setup for VPN connectivity. All provisioning is handled by the Patchworks infrastructure team in coordination with your network administrators.