A regulated client requires that no traffic between their data centre and your SaaS platform traverses the public internet. Design the connectivity and justify the cost.

Two distinct requirements hiding in one sentence

Traffic must not traverse the public internet — a routing requirement.

The client must be able to demonstrate it — an evidence requirement, and in regulated engagements the harder of the two.

Design for both; a solution that satisfies the first but produces no auditable evidence will fail review.

The connectivity design

Dedicated circuit as primary. A physical connection from their data centre to the cloud region. Consistent latency, predictable high bandwidth, and cheaper per-gigabyte transfer than internet egress — which for high volume can repay the fixed cost outright.

Costs: weeks to months to provision, meaningful fixed monthly charge, and it is a single physical thing that can be cut by a digger.

IPsec VPN as automatic backup, over the internet. This is the standard resilient pattern — and note it is encrypted, so failover does not violate the requirement in substance, though you should confirm the client's policy permits it explicitly rather than assuming.

Two circuits from different providers entering different premises where the requirement is strict enough to fund it.

Private endpoints to expose your service into their network — the mechanism designed for exactly this, so their traffic reaches your platform without either side exposing anything publicly.

Prerequisites people miss

Non-overlapping address ranges on both sides. This is the most common blocker and it is discovered late, when renumbering is expensive. Confirm it before signing anything.

Route summarisation on their side, because route tables have entry limits and an on-premises network advertising many specific prefixes can silently exceed them.

Route propagation enabled on every relevant route table — the classic cause of "it works from some subnets only".

Justifying the cost

Frame it as three savings against one charge: reduced egress charges at volume, removal of a compliance blocker that gates the contract, and lower operational cost than the bespoke alternative.

Then be honest about what it does not buy: private connectivity is a network control, not an access control. It does not authenticate, authorise or encrypt at the application layer. mTLS, authorisation and audit logging are still required, and saying so improves your credibility in the review.