Dedicated Static IPs Per Tenant for Multi-Tenant Trading Platforms

If you run a multi-tenant algo trading platform, copy-trading service, or broker-integration SaaS, your clients' broker API keys are tied to registered IP addresses. Your platform's shared egress IP can't represent ten clients cleanly. Per-tenant dedicated IPs can.

One Enterprise Subscription Per Tenant Gives Every Client Its Own IP Pair

Dedicated IPs are an Enterprise feature. Each QuotaGuard Enterprise subscription comes with two load-balanced static IPs that are exclusive to that subscription. No other customer's traffic touches them, and in a per-tenant setup, no other tenant's traffic does either.

QuotaGuard provisions each dedicated pair as its own subscription, so adding or removing a tenant never touches another tenant's traffic. All of the subscriptions sit under one account and one dashboard. Your provisioning workflow maps one tenant to one subscription to one IP pair.

This isn't a theoretical pattern. Keygen runs it in production: their enterprise tier provisions a dedicated QuotaGuard proxy per customer, with no shared network infrastructure between customers. The same QuotaGuard infrastructure is available to your platform directly.

Per-Tenant IPs Keep Broker Allowlists Clean

Many broker and exchange APIs bind API keys to registered source IPs. Check your brokers' documentation for the specifics, but the multi-tenant consequence is the same everywhere: if every tenant's orders exit through one shared IP, then one registration is every tenant's registration.

That creates three problems a per-tenant pair solves. Registration stays truthful, because the IPs registered on a client's broker account carry only that client's traffic. Isolation holds, because one tenant's activity can't affect how a broker or exchange treats another tenant's source address. And offboarding is clean, because a departed client's broker allowlist doesn't keep pointing at an IP your remaining clients still use.

Routing Per Tenant Is One Proxy URL Per Client

Trading traffic is financial data, so use QuotaGuard Shield. Shield uses SSL passthrough, which means QuotaGuard never decrypts your traffic. The TLS session runs end to end between your tenant's worker and the broker's API.

Each tenant's subscription has its own connection URL:

https://username:password@us-east-shield-01.quotaguard.com:9294

The region in the hostname is selected when each subscription is created. Pick the region closest to the broker or exchange endpoints that tenant trades against. Changing a subscription's region later means contacting support, so it isn't something you edit in the connection string.

In your platform code, the proxy URL becomes part of each tenant's configuration, right next to their API credentials. Python:

import requests
 
def session_for_tenant(tenant):
    """Each tenant's orders exit through that tenant's dedicated IP pair."""
    session = requests.Session()
    session.proxies = {
        "http": tenant.quotaguard_shield_url,
        "https": tenant.quotaguard_shield_url,
    }
    return session

The setup per tenant is the same 2-minute proxy configuration you'd do for a single app: create the subscription, copy the connection URL into that tenant's config, and route their HTTP client through it. For non-regulated tenant workloads, QuotaGuard Static works identically with a QUOTAGUARDSTATIC_URL style configuration instead.

Register Both IPs of Each Pair

Every subscription's two IPs are shown in the dashboard. Both go on that tenant's broker allowlist. The pair is load-balanced, so traffic can leave from either address, and registering only one produces intermittent rejections that look random in your order logs.

Edge Cases: Regions and Offboarding

Each dedicated pair lives in one AWS region. A tenant who needs egress from two regions needs two subscriptions. Plan your tenant-to-region mapping before you provision, since the region is fixed at subscription creation.

Offboarding is the inverse of provisioning. Cancel the departing tenant's subscription and their IP pair goes with it. Nothing else in your account changes, and no remaining tenant's allowlist entries are affected.

QuotaGuard Static Pricing Starts at $19/Month

Bandwidth is bundled. No per-GB overage fees. On lower tiers, your two assigned IPs are still static, but shared with other customers. Dedicated IPs are included on QuotaGuard Static Enterprise at $219/month, which is the per-tenant configuration for non-regulated workloads.

QuotaGuard Shield Pricing Starts at $29/Month

Shield costs slightly more than Static at each tier because SSL passthrough adds routing overhead. For trading traffic, QuotaGuard Shield Enterprise at $269/month per tenant is the configuration this post describes: a dedicated, exclusive IP pair carrying one client's encrypted order flow.

All plans include a 3-day trial. Enterprise plans include a 7-day trial. Credit card required.

See the full pricing table at quotaguard.com/products/pricing. Planning a rollout across more than a handful of tenants? Contact us and we'll map out provisioning with you.

Add a Tenant, Add a Subscription, Hand the Broker Two IPs

Multi-tenant platforms outgrow shared egress the day the second client's broker asks which IP their orders come from. One Enterprise subscription per tenant answers that question permanently: every client gets an exclusive pair, isolation is structural, and offboarding is one cancellation. Start with the first tenant and provision the rest as they onboard.