Changelog

Environments can now terminate a site-to-site IPsec tunnel on a dedicated, stable public IP. Point your peer at that address, agree on the proposals, and your services reach the remote network as if they sat inside it.

• One gateway per environment, on a fixed public IP that never changes
• IKEv2 with configurable phase 1 and phase 2 proposals, authenticated by pre-shared key
• You own the addressing on your side, so overlapping subnets stay your call

Partners that require a unique, non-overlapping subnet per tenant — banks especially — can now be onboarded without a bastion hop.

Publishing a front end no longer means writing a Dockerfile. Create a static site service, push your files, and they are served from a bucket behind our edge.

• Publish files inline through the API, the CLI, or an AI agent over MCP
• Custom domains attach as bucket aliases, with certificates issued automatically
• Publishing new files replaces the old ones in place, with no downtime

Every TCP or UDP ingress port can now carry a list of allowed source ranges. Traffic from anywhere else is dropped at the load balancer, before it ever reaches your service.

Set the ranges when you add a port, or edit them later from the networking tab. Leave the list empty to keep the port open to the world.

Kafka joins Postgres and Redis as a fully managed service. Clusters run in KRaft mode — no ZooKeeper to operate — and we handle node pools, storage and internal topic replication for you.

• Standalone mode combines broker and controller roles on one node, ideal for development
• Cluster mode splits brokers and controllers into pools that scale independently
• Internal topic replication is matched to your broker count, so small clusters still come up healthy

Kafka is reachable from services inside your environment over the private network.

Instead of running a service per database, add extra databases and users to an existing Postgres service. Each user gets a generated password, surfaced as a ready-to-use connection string in the dashboard.

Ownership and grants are reconciled continuously, so a role you remove in the console is removed on the cluster too.

Enable two-factor authentication from account settings, scan the QR code with Google Authenticator, 1Password or any TOTP app, and confirm with a code. From then on, signing in asks for a second factor.

You are issued ten recovery codes at setup — store them somewhere safe. If you lose both your device and your codes, support can reset the factor for you.

We sample usage every minute and keep thirty days of history. Open the metrics tab on any service to see per-pod CPU and memory, over ranges from the last hour to the last month.