An enterprise needs its cloud workloads to reach on-premises databases with predictable latency and without traversing the public internet. What are the options and what do they actually guarantee?

What each option actually guarantees

VPN over the internet. Encrypts traffic and provides private addressing. It guarantees confidentiality and reachability, not performance. Latency and jitter follow whatever the internet is doing between the two endpoints, and there is no committed bandwidth. Cheap, fast to provision, and entirely adequate for management traffic, low-volume integration and disaster-recovery paths.

Dedicated private circuits. A physical or virtual circuit between the enterprise network and the cloud provider, bypassing the public internet. Provides committed bandwidth, predictable latency and low jitter, plus lower per-gigabyte data transfer cost — which frequently makes high-volume connectivity cheaper despite the circuit fee. Costs weeks to months to provision and a recurring charge.

Public endpoints with TLS. Confidentiality is fine; the objection is not encryption. What is missing is predictability, and often a compliance position that requires traffic not to traverse the public internet regardless of encryption.

Why the combination

A dedicated circuit is a physical thing that can be cut. A single circuit is a single point of failure with a repair time measured in days, so resilience requires either a second circuit — ideally through a different provider and a different physical path — or a VPN failover.

VPN backup is the pragmatic answer for most enterprises: it is inexpensive, provisioned in hours, and degrades gracefully. The workload runs slower during a circuit outage rather than stopping. The essential discipline is that the failover path must be exercised, or it will not work when needed.

What the workload requires you to check

Latency sensitivity. A chatty application making many sequential round trips to an on-premises database will be unusable at any inter-site latency. The right fix is usually not more bandwidth but fewer round trips — batching, caching, or moving the data. Private connectivity reduces latency; it does not eliminate the speed of light between sites.

Bandwidth profile. Steady high volume favours a dedicated circuit on cost alone. Bursty low volume favours a VPN.

What happens during an outage. If the workload cannot function without on-premises connectivity, the connection is a hard dependency and needs redundancy sized accordingly. If it can degrade — read from a cache, queue writes — the resilience requirement is much cheaper.

The design point most often missed

Private connectivity does not remove the need to design for its failure. Teams treat a dedicated circuit as reliable infrastructure and build hard synchronous dependencies across it. The circuit then fails, and the cloud workload is down because it cannot reach a database in another building.

The better pattern is to treat the link as a network like any other: timeouts, circuit breakers, local caching, and a defined degraded mode — because the most reliable link in your architecture is still a link.