> For the complete documentation index, see [llms.txt](https://docs.upriverdata.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.upriverdata.com/architecture-and-security/network.md).

# Network

## IP whitelisting for Upriver

Many integrations require your systems to accept **inbound connections from Upriver**. Upriver initiates outbound traffic from its deployment (for example, to query a warehouse, Trino coordinator, or API). If your network uses IP allowlists, firewalls, or security groups, add the Upriver egress IP addresses below.

***

### When you need this

| Scenario                              | Typical action                                                                                                                                                                                        |
| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **SaaS** — Upriver hosts the platform | Allow the SaaS egress IPs on your firewall / security group / network policy for the host and port you expose (see integration docs for ports).                                                       |
| **AWS Redshift (SaaS)**               | Prefer cross-VPC access using Upriver’s AWS account and VPC IDs instead of public IPs when possible.                                                                                                  |
| **Private connectivity**              | Use PrivateLink, VPC peering, or a VPN arranged with your Upriver representative; IP allowlisting may not be required.                                                                                |
| **Self-hosted or hybrid**             | Egress IPs come from **your** Upriver deployment (NAT gateway, proxy, or cluster egress). Your operations team supplies those IPs to internal data platform owners— they are not listed on this page. |

***

### Upriver SaaS egress IP addresses

Add **all** IPs that apply to your contract environment and region. If you are unsure which row applies, ask your Upriver representative.

#### Production

| AWS region    | Egress IP address(es)         |
| ------------- | ----------------------------- |
| **us-east-1** | 18.215.205.156, 184.72.146.68 |
| **eu-west-1** | 34.246.232.236, 54.247.3.179  |

***

### AWS Redshift cross-VPC access

For **Amazon Redshift** on SaaS, Upriver connects via **cross-VPC grants** instead of public IP allowlists. In the Upriver app, open the Redshift integration connect step and select your cluster region to see the current **Account ID** and **VPC ID(s)**—or use the reference values below and confirm with your Upriver representative before production cutover.

#### Production

| AWS region    | Upriver AWS account ID | Upriver VPC ID(s)                                |
| ------------- | ---------------------- | ------------------------------------------------ |
| **us-east-1** | `734764794649`         | `vpc-08f18d0e86a8fdcd0`, `vpc-0ce69a23bd147927f` |
| **eu-west-1** | `734764794649`         | `vpc-0938748283ae03fd6`, `vpc-02629708b2d366418` |

Grant access on your Redshift cluster or workgroup to **one** of the listed VPC IDs for the matching account. See AWS documentation: [Grant cross-VPC access (grantor)](https://docs.aws.amazon.com/redshift/latest/mgmt/managing-cluster-cross-vpc-console-grantor.html).

***

### Checklist for your network team

1. Confirm whether you are on **Upriver SaaS** or **self-hosted / hybrid**.
2. For SaaS, copy the **production** and/or **staging** egress IPs from the tables above into your firewall or cloud security group (**inbound** rules on your side).
3. For Redshift on AWS, evaluate **cross-VPC access** before relying on public IPs.
4. Open the required **ports** for each integration you use.
5. After Upriver announces an infrastructure change, re-verify egress IPs and update allowlists.

If egress IPs are not yet published for your environment, contact your **Upriver representative** or support channel for the current list before go-live.