Automation with the security of on-prem, but none of the hassle.
Critical automation without traversing the public Internet. Connect to Bem directly through our private link.
Deployment Options
Choose the model that fits your security posture.
The Old Way (SaaS)
Traditional APIs force you to whitelist public IPs and send sensitive payloads over the open internet. Security audits become a nightmare.
The Hard Way (On-Prem)
Self-hosting allows isolation but forces you to manage GPUs, heavy containers, and constant model updates. It’s a massive maintenance burden.
The Bem Way (Private Link)
The Best of Both Worlds. You get a fully managed SaaS experience that lives logically inside your private network. No maintenance, zero exposure.
How It Works
The Service
We provision a dedicated VPC Endpoint Service for your organization.
The Endpoint
You create an Interface VPC Endpoint in your VPC to connect to our service.
The Routing
You configure your private DNS to resolve api.bem.ai to your local VPC Endpoint IP.
The Result
Your application traffic travels exclusively via the private cloud backbone. No internet gateways required.
Deployment Comparison
| Feature | Public API | Private Link | Self-Hosted |
|---|---|---|---|
| Network Exposure | Public Internet (TLS) | Private VPC Only | Air-Gapped / Internal |
| Maintenance Effort | Zero (SaaS) | Zero (SaaS) | High (Customer Managed) |
| Latency | Standard Internet | Optimized (Private Backbone) | Local Network Speed |
| Security Posture | Standard Enterprise | Private & Isolated | Defense Grade |
| Setup Time | Instant | Managed Provisioning | Weeks |
Deep Dive
Read more about our approach to private connectivity.
Frequently Asked Questions
No. Private Link is a fully managed service. We run the infrastructure; you just manage the network connection endpoint. It operates exactly like using Snowflake or Confluent via Private Link.
It doesn't. Your integration code remains exactly the same. You simply update your environment variable for the API URL to point to your new private endpoint (e.g., https://api.internal.bem.ai).
Yes. We support cross-region Private Link connections (e.g., US-East-2 to US-East-1) over the private backbone, so you don't need to be in the same region as our infrastructure.