Inbound & Outbound Static IPs for Clever Cloud Apps
Set one proxy environment variable and your Clever Cloud app's outbound calls exit from two fixed IPs a partner can allowlist, while inbound traffic arrives at one permanent address you can hand to a provider.
Clever Cloud's outbound IPs are shared per region and change as the platform expands.
QuotaGuard gives you two static IPs that never change, with EU or US data residency, and no VPN tunnel to manage.
Enterprise Connectivity & Allowlisting
Clever Cloud runs your app behind its Sōzu load balancers on shared infrastructure, and its own documentation warns that outgoing IP ranges can change at any time as it expands. A partner API that allowlists source IPs will reject your requests when that happens.
Clever Cloud's native answer is a VPN add-on that provisions a fixed-IP outgoing node over IPSec or OpenVPN. That works, but it is a tunnel you manage with a CIDR list, and it only handles outbound. QuotaGuard is a standard HTTP proxy: one environment variable, no tunnel, and it covers inbound as well.
Note: QuotaGuard is designed for connecting Clever Cloud apps to IP-restricted B2B resources like partner APIs, SQL databases, internal services, and enterprise gateways. This solution is not intended for scraping consumer sites that block cloud infrastructure.
Native Configuration
QuotaGuard works through Clever Cloud's environment variables.
No VPN tunnel, no custom runtime image, no CIDR list to maintain. Set the proxy variables from the Console or the Clever Tools CLI and restart.
QuotaGuard vs Clever Cloud's VPN Add-On
Clever Cloud's VPN add-on is the right tool if you want the fixed IP to live inside Clever Cloud's network, you are comfortable running an IPSec or OpenVPN tunnel, and you only need outbound.
QuotaGuard fits when you want setup to be a single environment variable with no tunnel, you need a fixed inbound address as well as outbound, you want the same static IPs to work if you ever move off Clever Cloud, or you need the SSL-passthrough model for regulated data.
Both give you a fixed outbound identity. They differ on inbound coverage, setup complexity, and portability.
QGTunnel for Database and Raw TCP Connections
For connections to a firewalled database over a raw TCP protocol, such as PostgreSQL, MySQL, or a native MongoDB driver hosted outside Clever Cloud, an HTTP proxy is not enough. QGTunnel provides transparent SOCKS5 proxying.
Configure a tunnel for your database host and port in the QuotaGuard dashboard, wrap your start command with QGTunnel, and your driver connects to the original hostname while traffic exits from your two static IPs. No application code changes.
Works Across Clever Cloud Regions and Runtimes
The setup is the same whether your app runs in the Paris region or any other Clever Cloud zone, and whatever runtime you deploy.
The proxy variables are read at the application layer, so there is nothing platform-specific to configure and nothing that breaks when Clever Cloud updates its infrastructure.
Reliability for Production Apps
Traffic comes in bursts and apps scale fast.
QuotaGuard's proxy layer handles that without becoming the bottleneck, and gives you a fixed network identity your partners can trust on every request.
FAQs
Technical Configuration and Setup for Clever Cloud
Yes, through a VPN add-on.
Clever Cloud's documentation describes a VPN add-on that provisions a fixed-IP outgoing node over IPSec or OpenVPN, where you supply a list of CIDRs. It is outbound-only and it is a tunnel you manage.
QuotaGuard is a simpler alternative: one environment variable, no tunnel, and it also gives you a fixed inbound IP, which the VPN add-on does not.
Set your QuotaGuard proxy URL as an environment variable using clever env set or the Console, set HTTP_PROXY and HTTPS_PROXY to the same value, exclude internal hosts with NO_PROXY, then run clever restart.
Outbound HTTP and HTTPS calls then exit from your two static IPs.
From inside the app, after configuring the proxy, make a request to https://ip.quotaguard.com.
The response returns the IP your request came from.
It should match one of the two static IPs in your QuotaGuard dashboard. Check a few times and you will see both IPs in rotation.
Yes, via QGTunnel. The HTTP proxy handles HTTP and HTTPS.
For raw TCP connections to PostgreSQL, MySQL, or a native MongoDB driver hosted outside Clever Cloud, QGTunnel routes those connections through your static IPs.
Configure a tunnel in the QuotaGuard dashboard for the database host and port, then wrap your start command with QGTunnel.
Yes.
The static IPs are assigned to your QuotaGuard account, not to Clever Cloud's infrastructure. Your app reads the proxy URL from its environment and connects through the same two IPs regardless of how Clever Cloud rotates or expands its ranges.
Your partners never need to update their allowlist after the initial setup.
Yes, at three levels.
Running your Clever Cloud app through a QuotaGuard EU region in Frankfurt, Ireland, or London keeps outbound traffic exiting from an EU IP, which meets the literal data-residency requirement on shared infrastructure.
Enterprise plans give you dedicated EU IPs, which removes the shared-tenancy question an auditor will raise.
For the strongest guarantee, the Data Residency add-on locks all proxy traffic, static IPs, and connection logs to the EU with no cross-border failover, starting at $899 per month on top of your plan.
See the US and EU data residency page for details.
Use the VPN add-on if you want the fixed IP inside Clever Cloud's network, you only need outbound, and you are comfortable running a tunnel.
Use QuotaGuard if you want one-variable setup with no tunnel, you need a fixed inbound IP as well as outbound, you want the same IPs to keep working if you move off Clever Cloud, or you need SSL passthrough for regulated data.
Use QuotaGuard Shield for those cases.
Shield uses SSL passthrough and never decrypts your traffic at the proxy, and your TLS keys never leave your servers.
That is the model for HIPAA, PCI-DSS, and SOC 2 workloads.
QuotaGuard Static terminates and re-establishes SSL and is appropriate for everything that is not regulated, but not for regulated data.
Still have questions?
We don’t outsource Support to non-Engineers.
Reach out directly to the Engineers who built Shield to discuss your specific architecture, integration challenges, or compliance constraints here 👇
🚀 Ready to Get Started? Choose Your QuotaGuard Path
QuotaGuard STATIC
QuotaGuard SHIELD
Trusted by Engineering Teams Everywhere
Reliability Engineered for the Modern Cloud
For over a decade, QuotaGuard has provided reliable, high-performance static IP and proxy solutions for cloud environments like Heroku, Kubernetes, and AWS.
Get the fixed identity and security your application needs today.