VPC

Large providers such as Amazon, Microsoft, or Google rent out computing power in their data centers. Instead of buying their own computers, customers rent them there. The problem: thousands of other customers work on the very same machines. A VPC, short for Virtual Private Cloud, solves this. It is a delimited area within this rented environment in which only the computers of a single customer are allowed to talk to each other. From the outside, only what the customer has explicitly permitted can get in.

Why companies don’t put their servers openly on the internet

Without any separation, every rented server would be directly reachable from the open internet. That is dangerous. Automated programs scour the network around the clock looking for poorly secured machines. An unprotected database is often found within minutes. In a VPC, by contrast, a database has no public address at all. It is only visible to the other machines belonging to the same customer.

On top of that comes legal pressure. Anyone processing health data, account transactions, or personnel files must prove that this data is kept separate from other data. Auditors and data protection authorities ask precisely about this. A VPC provides this proof, because every rule can be documented. One can show in black and white exactly which path into the network is permitted.

A third reason is simply control over errors. If an application behaves oddly, one wants to know who it is talking to. In a clearly delimited network, this can be logged. In an open network, one quickly loses track.

Address ranges, subnets, and security rules

When setting up a VPC, the customer first defines an address range. Every computer on the network is assigned a number from this range, similar to a house number. These numbers are only valid within the VPC. Two customers can use the same range without interfering with each other. In the background, the provider ensures that the data packets are never mixed up regardless.

The address range is then divided into smaller sections, so-called subnets. A common split is into public and private. The public subnet holds the web server that visitors are meant to reach. The private subnet holds the database and internal services with no direct connection to the outside at all. The web server is allowed to talk to the database, but the open internet is not.

Who decides what is allowed and what is not? For this there are rule lists, often called security groups. One such rule might read: connections on port 443, i.e. encrypted web pages, are allowed, everything else is discarded. A comparison with an office building fits well. The address range is the building, the subnets are the floors, and the security groups are the door locks with their access lists.

VPCs in the training of AI models

Practically every company that runs software in the cloud works with VPCs. You just never see them. When a banking app runs smoothly, behind it lies a network in which the account data sits in a private section. For developers, setting up a VPC is one of the first steps in a new project.

The term comes up especially often in AI news. Companies want to train or fine-tune their own models using internal documents. These documents are not supposed to leave the company’s domain. Providers therefore advertise that training and operation take place entirely within the customer’s VPC. The provider supplies only the software; the data stays within the sealed-off network.

A common misconception is that a VPC means dedicated, physically separate hardware. That is usually wrong. The separation is created by software; the machines themselves can be shared. Anyone who genuinely needs exclusive hardware must order it separately and pay significantly more. A VPC should also be distinguished from a Private Cloud: there, the machines belong to the company itself and are often housed in its own basement.