Private delivery: from SIM to your cloud, never over the internet
Private delivery means your devices’ data goes from the SIM to your own network (AWS, Azure, Google Cloud, Oracle Cloud or your datacenter) without crossing the public internet. The SIM uses a private APN, receives a private IP address, and its traffic is handed to you over a private link. Nobody on the internet can reach your devices, and your devices cannot reach the internet unless you decide so.
Status: Coming soon (checked 26 October 2026) · Notify me when available
Key points
- No public IP, no exposure. Devices get private addresses (RFC 1918 ranges you choose), so port scans and brute-force attacks from the internet cannot reach them.
- One SIM, any destination. The same SIM can be delivered into AWS, Azure, Google Cloud, Oracle Cloud or your racks. Changing destination is a network setting, not a new SIM.
- Works abroad. Roaming traffic comes home over the inter-operator IPX network, which is private by design.
- No software on the device. Privacy comes from the network path, so even NB-IoT sensors benefit.
How the data travels
- Radio. The device attaches to a local mobile network, at home or abroad.
- Back to the home core. The visited network sends the data session to the home core network of your SIM over the IPX network, the private backbone between mobile operators described in GSMA IR.34.
- Private APN. In the core network, your SIMs belong to your private APN: their own IP range, their own routing table.
- Hand-off. From there, your APN is connected to your destination by a private link (see the table below).
- Your network. Traffic arrives in your VPC, VNet or datacenter as ordinary private IP traffic. Replies follow the same path back.
Delivery options
| Destination | How it is connected | Crosses the public internet? | Page |
|---|---|---|---|
| AWS | AWS Direct Connect to a Transit Gateway or virtual private gateway | No | AWS |
| Microsoft Azure | Azure ExpressRoute | No | Azure |
| Google Cloud | Cloud Interconnect | No | Google Cloud |
| Oracle Cloud | OCI FastConnect | No | Oracle Cloud |
| Your racks in a colocation facility | Cross-connect (fibre) in the building | No | Datacenter |
| Any site or any cloud | IPsec VPN (AWS, Azure, Google Cloud, firewall) | Yes, encrypted | Datacenter |
IPsec is the fastest to set up and costs the least, but the encrypted tunnel does cross the internet. When that matters (regulated data, industrial control, payment), choose a cloud interconnect or a cross-connect.
Private delivery or internet delivery?
| Internet delivery | Private delivery | |
|---|---|---|
| Device address | Shared or static public IP | Private IP from your own range |
| Reachable from the internet | Yes if public IP | No |
| Where your traffic goes | Anywhere on the internet | Only your declared destinations |
| Security controls | On each device | In your network, for the whole fleet |
| Typical use | Consumer trackers, prototypes | Fleets, industry, payment, health, cameras |
Internet delivery is described on its own page, including the static public IP option.
Who it is for
- Industrial and OT teams connecting PLCs, RTUs and sensors who must keep control networks off the internet. See cellular connectivity for SCADA and OT.
- Cloud-native IoT teams who want device traffic to land in the same VPC as their backend, with no public endpoint to protect.
- Security cameras and routers that should be reachable by your staff but invisible to everyone else. See SIM cards for security cameras.
- AI agents and automation: every SIM, APN and destination can be managed by API or by an AI agent through our MCP server.
Limits, stated plainly
- A private APN does not encrypt the radio leg beyond what the mobile network already does. If your data needs end-to-end encryption, keep TLS between device and server.
- Private delivery adds a recurring cost per destination (the private link), on top of the SIM data price. Prices are public on the pricing page.
- Some countries restrict permanent roaming whatever the delivery mode. Check our permanent roaming rules by country before deploying.
Learn more
- Integrations: connect privately delivered devices to cloud IoT services
How cellular devices on a private APN reach AWS IoT Core, Azure IoT Hub, Event Grid, Pub/Sub or your own MQTT and LwM2M servers on private IPs. - Deliver IoT SIM traffic into your datacenter or office
Receive cellular IoT traffic in your own racks by cross-connect in a colocation facility, or at any site by IPsec. No public internet between SIM and server. - Deliver IoT SIM traffic privately into AWS
Connect cellular IoT devices to your AWS VPC without the public internet, using AWS Direct Connect, Transit Gateway or IPsec VPN. Reference architecture inside. - Deliver IoT SIM traffic privately into Google Cloud
Connect cellular IoT devices to your Google Cloud VPC without the public internet, using Cloud Interconnect or HA VPN. Reference architecture inside. - Deliver IoT SIM traffic privately into Microsoft Azure
Connect cellular IoT devices to your Azure virtual network without the public internet, using ExpressRoute or VPN Gateway. Reference architecture inside. - Deliver IoT SIM traffic privately into Oracle Cloud
Connect cellular IoT devices to Oracle Cloud Infrastructure without the public internet, using FastConnect private peering or an IPsec VPN.
Frequently asked questions
What is a private APN for IoT?
A private APN is a dedicated access point name on the mobile core network. Devices that use it get private IP addresses and their traffic goes only to the destinations you define, such as your cloud network, instead of to the public internet.
Does private delivery work when devices roam in other countries?
Yes. Roaming traffic travels from the visited mobile network back to the home core network over the inter-operator IPX network, a private network defined by the GSMA (IR.34), and then into your cloud over a private link.
Can devices on a private APN still reach the internet?
Only if you allow it. By default they reach your private destinations only. You can route internet-bound traffic through your own firewall in your cloud, so every flow passes your security controls.
Is an IPsec VPN the same as private delivery?
No. An IPsec tunnel is encrypted but crosses the public internet. A cross-connect or a cloud interconnect (AWS Direct Connect, Azure ExpressRoute, Google Cloud Interconnect, Oracle FastConnect) never touches it. We offer both and say which one you are buying.
Do I need a VPN client on each device?
No. The privacy is built into the network path, not into the device. Devices with small modules (LTE-M, NB-IoT) do not have to run any VPN software.