Private Connections Into Your Clouds, Sourced on Your Terms
A private cloud connection carries traffic between your network and a cloud provider without crossing the public internet. Getting one means choosing a port type, an on-ramp, a carrier to reach it and a pricing model, often under separate contracts. TREU sources the cloud provider's port and competes the partners, exchanges and carriers that reach it, sequences the orders so billing starts as close to go-live as the terms allow, and manages the terms for as long as they run.
Book a conversationHow Private Cloud Connections Work, and When You Need One
There are two ways in. A dedicated connection is a physical port on the cloud provider's equipment, reserved for you, at a facility where the provider meets other networks. A hosted connection is capacity on a partner's port, sized to what you buy and accepted in your cloud console. Either way, you still need a path from your sites to that facility: a cross-connect if your equipment is there, or a carrier circuit if it is not.
When it makes sense
- Large or steady data transfer, since providers that publish both rates price data transfer over a private connection below their internet rates.
- Workloads that need consistent latency, which one major provider positions private connections to deliver.
- Regulated workloads where traffic should stay off the public internet, or where a dedicated port gives the physical isolation some regulated workloads call for.
- A hybrid estate, where systems in your data centers and workloads in the cloud depend on each other.
When it does not
In our judgment, the internet may serve you well enough when:
- Cloud use is light and tolerates the internet.
- The traffic is your productivity suite. One major provider built its suite for internet access and recommends private connections to it only in specific cases.
- The workloads are development and test, where an internet VPN can serve. One major provider does not recommend a VPN as the backup for latency-sensitive, mission-critical or bandwidth-heavy workloads.
Sometimes the internet is the right path. We will show which workloads justify paying for a private one.
Internet VPN, hosted or dedicated
| Internet with VPN | Hosted connection | Dedicated connection | |
|---|---|---|---|
| What you buy | Encrypted tunnels over your internet circuits | Capacity on a partner's port, at the rate you choose | A whole port on the cloud provider's equipment |
| Equipment at the on-ramp | None | None; the partner is already there | Yours, or your carrier's |
| Changing capacity | Add internet bandwidth | Through the partner; at one provider, traffic above the rate is dropped | Often means a new port or circuit |
| Cloud provider's service level | Your internet circuits' terms | May depend on the partner's contract | Set by your design; highest for multi-site |
| Best fit | Light, internet-tolerant use and testing | Most needs, without equipment at the on-ramp | Sustained large transfers, strict isolation or many cloud networks on one link |
Technical Considerations
The cloud provider publishes the rules for its side of the connection. These are the ones that catch buyers between the order and the first packet.
Resiliency is a published design
The largest cloud providers publish resiliency models, and the strongest put separate connections on separate devices in more than one location. One does not recommend anything but its multi-site designs for production. Another calls one circuit at one site its least resilient option and no longer offers it in some locations. We help you choose the model your workloads need and write it into the order.
Diversity has to hold end to end
Two cloud circuits on one fiber, or two carriers in one conduit, still fail together. One major provider says redundancy must extend through your own network and your carrier's, using different providers or locations, and recommends running both connections active and testing failover. We check the physical paths, not just the circuit IDs.
Private is not encrypted
Private connections are not encrypted by default. MACsec encrypts only the link between your router and the provider's, so a carrier circuit between your site and the on-ramp is not covered, and it is offered only on certain port types and locations. On one provider, the default setting lets traffic fall back to unencrypted if key negotiation fails. Where you need encryption end to end, IPsec over the private connection is the alternative, with tunnel charges on top at one provider.
Port speeds are hard to change
At one major provider, a dedicated port's speed cannot change after ordering. At another, circuit bandwidth can rise but not fall. At one provider, hosted connections drop traffic above the purchased rate, so bursty workloads can see less than they expect. Size for the term, not the first month.
Reach and optics
Dedicated ports expect single-mode long-reach optics over a limited distance, so a router outside the facility needs a carrier circuit, a wavelength or dark fiber to reach it. Link aggregation is required at one provider and not supported at another, so router configuration differs by cloud.
Route and change limits
Providers cap the routes they accept on a connection, and exceeding the cap can drop the session. At one provider, changing packet size on an interface can briefly interrupt every interface on the connection, so plan it in a maintenance window.
Letters of authorization and cross-connects
After a dedicated port is ordered, the provider issues a letter of authorization (LOA-CFA) that your carrier or colocation operator needs to order the cross-connect. The letter can expire if the cross-connect is not finished in time, and one provider deletes a port that never comes up. Cross-connect pricing comes from the facility operator, not the cloud provider.
What It Gives IT and Finance
For IT and network leaders: a cloud path you can rely on
- A connection built to the provider's own resiliency model, with physical diversity checked end to end.
- Encryption decided before the order, not discovered in an audit.
- Port, carrier circuit and cross-connect ordered in sequence, so the link is ready when the project needs it.
- One advisor across every partner, exchange and carrier on the path, so your team is not sequencing port orders, letters of authorization and cross-connects itself.
For finance: charges you can see coming
- A pricing model chosen for your volume: per-gigabyte transfer, a flat port rate or transfer included, compared before you sign.
- Billing that starts as close to go-live as the terms allow, because the orders were sequenced.
- Partner, carrier and cross-connect agreements, each with its own term and exit, on one calendar.
The Four Stages Behind a Private Cloud Connection
See how we work-
Supplier identification
We map where your workloads run, where your sites and data centers are, and how much traffic moves between them. Then we source the cloud provider's own port and find the on-ramps, exchanges, partners and carriers that can reach it, wherever your sites are.
-
Buying cycle
We decide with you between internet, hosted and dedicated connections, choose the provider's resiliency model with you, and compare pricing models over the full term. We negotiate the partner, carrier and exchange terms with your legal team.
-
Implementation oversight and accountability
We time the port order, the letter of authorization, the carrier circuit and the cross-connect with you and the providers, so billing starts as close to go-live as the terms allow. Then we check the first invoice against the contract.
-
Client and supplier lifecycle management
We track every term and renewal date on the path, join business reviews, renegotiate before renewal and source new connections as your cloud footprint grows. We do not monitor the link. We source the providers who do.
What to Watch For in a Cloud Connection Contract
A private cloud connection is often two or three contracts that have to work as one. These are the terms we check first.
-
Which contract covers what.
The cloud provider's port, the partner or carrier service and the cross-connect are often separate agreements, billed separately. Get each one's service level, term and exit terms in writing.
-
Service level coverage.
At one major provider, the service level does not cover service through a partner's hosted connection. There, the partner's contract is your service level.
-
When billing starts.
Billing can start before traffic flows: on activation, or a set time after the order or the letter of authorization, whichever comes first. Line up the carrier circuit and cross-connect with the port order.
-
Credits.
At one major provider, credits are a share of port charges only, applied to future bills, and must be requested within a set window. Data transfer and partner charges are not credited.
-
Choices you cannot undo.
Port speed and encapsulation can be fixed when the port is created, and circuit bandwidth may not come down without a new circuit.
-
Exchange renewals.
One exchange operator renews minimum terms automatically, at the same term and price, unless renewal is turned off before the end date, and a lapsed term loses its discount. In our experience, the work starts months before the notice date, not weeks.
-
Early termination.
At one exchange operator, ending early costs the rest of the term, waived only if you order a replacement of equal or greater rate and term within a short window. Negotiate the replacement right before you need it.
-
The pricing model.
Per-gigabyte, flat-rate and included-transfer models now sit side by side, and at one provider the lower private rate applies only to traffic from the local region. Model your volume and destinations before signing, and again at renewal.
-
The on-ramp's future.
Connection locations change. One provider has marked a facility for end of support, with no new connections. Ask the provider and the facility operator about planned changes before a multi-year term.
This list is a starting point for your review. TREU is not a law firm. Your counsel gives the legal advice.
Questions Buyers Ask About Cloud Connectivity
Should we choose a dedicated or a hosted connection?
In our judgment, a hosted connection fits most needs, especially if you have no equipment at the on-ramp: it comes in smaller sizes and a partner provides it. A dedicated port fits sustained large transfers, strict isolation or many cloud networks on one link, and needs you or your carrier at the facility. Check which service level applies, because at one major provider the cloud provider's service level does not cover hosted connections.
Is a private cloud connection encrypted?
Not by default. MACsec can encrypt the link between your router and the provider's on certain dedicated ports, but it covers only that link, not the carrier circuit back to your site. For encryption end to end, run IPsec over the private connection.
How many connections do we need?
Follow the provider's published model for production. The strongest designs use connections in more than one location, and one major provider recommends, at minimum, one circuit split across two sites in a metro for production. One connection at one site is a design for development and test.
What does a private cloud connection cost?
The cloud provider charges for the port, usually by the hour, and often for data leaving the cloud. Some include data transfer in the port charge or offer flat-rate options. The partner, carrier and cross-connect are billed separately, outside the cloud bill. Because the right model depends on your volume and destinations, we model the options side by side over the term.
What is an LOA-CFA?
A letter of authorization and connecting facility assignment. The cloud provider or exchange issues it after you order a port, and your carrier or the facility needs it to place the cross-connect. At one provider, it is digitally signed so the facility can reject a modified letter, and it can expire if the cross-connect is not done in time.
When does billing start?
Often before traffic flows. Some providers bill a dedicated port from activation or a set time after the order, whichever comes first, and hosted connections bill once you accept them. We time the port, circuit and cross-connect orders with you and the providers, so the charges and the link start together as closely as the terms allow.
Do we need a private connection for our SaaS applications?
Often not. One major provider built its productivity suite for internet access and recommends private connections to it only in specific cases. In our judgment, a private connection earns its cost when data volume, latency or compliance make the internet a poor fit.
Does TREU monitor the connection?
No. TREU sources the cloud port and the partners, exchanges and carriers that provide and support the connection, holds them to their commitments through installation, acceptance and the first invoice, and stays on the agreements after that: tracking terms and renewal dates, joining business reviews and renegotiating before each renewal. Service issues go to the provider first, and we can help in certain cases. We do not claim service credits.