If your app processes payments through Stripe, Braintree, Adyen, or another gateway that requires IP whitelisting, you need a static IP. If you're on Heroku, Render, or another PaaS with rotating IPs, that usually means adding a proxy.
Here's the part that catches teams off guard: most proxies create a PCI compliance problem while solving the IP whitelisting problem.
How Standard Proxies Handle TLS
A typical proxy works by terminating your SSL connection. Your app sends encrypted traffic to the proxy. The proxy decrypts it, reads the request, re-encrypts it, and forwards it to the destination.
This means cardholder data exists in plaintext on the proxy server. Briefly. But it's there.
PCI-DSS Requirement 4.1 is specific about this: "Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks." That applies to every hop. Every server that touches the traffic. Including your proxy.
When an assessor asks "Where does cardholder data get decrypted?" and the answer includes "on the proxy server," that's a finding.
SSL Passthrough: A Different Approach
QuotaGuard Shield uses SSL passthrough instead of SSL termination. Your app's TLS connection to the payment processor stays intact. Shield routes the encrypted traffic without unwrapping it.
The proxy sees encrypted bytes. It routes them. It never decrypts. Cardholder data never exists in plaintext on our servers.
When your PCI assessor asks about decryption, the answer is clean: "The proxy uses SSL passthrough. It never terminates the TLS connection. Cardholder data is encrypted end-to-end."
Two Problems, One Fix
Teams processing payments on a PaaS typically need two things from their infrastructure. First, static IPs for payment gateway whitelisting. Second, encryption compliance for PCI-DSS.
Shield provides both. You get two load-balanced static IPs with automatic failover. Same reliability as QuotaGuard Static. Plus SSL passthrough that maintains encryption integrity.
Shield starts at $29 per month. You get the static IPs, the SSL passthrough architecture, and the compliance guarantee.
Where This Comes Up
The typical scenario: a SaaS company runs a subscription service. Users enter card details. The app makes requests to a payment processor. The processor requires whitelisted IPs.
Without Shield, there are three options. Run a dedicated server (expensive, doesn't scale). Use a standard proxy (creates the PCI gap described above). Or skip IP whitelisting entirely (which means you're not using your processor's security features).
Shield is a fourth option that handles both requirements at once.
For older payment systems that use raw TCP instead of HTTPS, QGTunnel provides transparent TCP tunneling through Shield. Same static IPs, same encryption benefits, for non-HTTP protocols.
What PCI Assessors Focus On
During a PCI assessment, the infrastructure diagram gets scrutinized. Assessors ask where sensitive data gets stored and where it gets decrypted. If you have a proxy in your architecture, they want to know how it handles encryption.
With Shield, you describe SSL passthrough. You explain that the proxy never terminates TLS. You show that cardholder data is encrypted from your app to the processor. The assessor documents it and moves on.
Regional Data Residency
Some companies need traffic locked to specific regions. GDPR requirements for EU customers, or data sovereignty rules in specific jurisdictions.
Shield supports this as a $899/month add-on. You can keep all traffic within the US or within the EU. No cross-continental hops.
Testing It
You can verify the setup yourself at https://ip.quotaguard.com. It shows the static IP your traffic exits from. Set up Shield, route a test request through it, and confirm the IP is consistent.
Getting Started
If you're processing payments through a proxy and you're not sure how your current setup handles TLS, it's worth checking before your next PCI assessment.
Sign up for Shield and test it with your payment processor. The setup takes about 20 minutes. You can verify the SSL passthrough behavior and static IP assignment before committing to anything.
QuotaGuard Static IP Blog
Practical notes on routing cloud and AI traffic through Static IPs.
.webp)
.webp)
.webp)
