Feature Requests

Support compliance with HIPAA and enable requesting a Business Associate Agreement (BAA) from Render

Provide the ability to create a unique static IP for a service. This means if I allowlist my service's IP, I'll only allowlist my service, and no other Render services.

Just like Env Groups, it would be great to have Access Control Groups to apply IP address range changes at once for Postgres and Redis. By setting IP ranges one by one, it gets out of sync very quickly. Instead, we could maintain the single source of truth for the IP ranges. This would be helpful especially for fully remote teams.

Right now environment variables are used for secrets, but in general you want secrets to be write-only or at the very least only allow read based on some IAM. A first good step would be to add a "sensitive" checkmark when you create an environment variable so it can only be written to and it cannot ever we read by users. This is the behaviour of github actions, terraform cloud, etc. and generally good enough for a lot of people.

The issue is, that a number of other services are using your service for providing their service. E.g., workleap.com . When a company from the European Union wants to use, e.g. workleap, or any other service using your services, a careful DPO will check the subprocessor list. Eventually s/he will stumble upon render.com beeing used to process personal data as a subprocessor. Since render.com is not part of the eu-us data privacy framework s/he will must likely object to using that service. Since render ist nor part of the eu-us data privacy framework any EU company can in general not legally use a service using render as subprocessor.