Limits and fair use

Every plan comes with resource and network limits sized to the tier. Most apps never touch them; they exist to keep one workload from crowding out others, and to stop a bug or a compromised dependency from being used for abuse. If a limit is in your way for a legitimate reason, open a support ticket from your dashboard and we'll raise or lift it for your app or your whole team, usually the same day.

Compute (per plan)

Your plan sets each replica's CPU, memory, and disk, plus how many replicas and deployment slots you can run. You can change plan any time without redeploying. The full grid is on each app's Scaling tab and the pricing page. See Scaling and HA.

Outbound network (egress)

Two things govern what your app can send outbound. Neither affects serving: inbound requests and their responses always flow. This only limits connections your app itself initiates.

Where it can connect

By default an app can reach:

  • The public internet over HTTPS and HTTP (ports 443 and 80) - third-party APIs, webhooks, OAuth providers, and the like.
  • Its own managed Postgres and Valkey bound in the same project, whether in-cluster or over their external endpoint.
  • DNS.

Everything else outbound is blocked: other ports on the public internet, raw UDP, and the internal platform network. This is a security default. It means a compromised app can't be turned into an internet port-scanner, a UDP flood source, or a spam relay, and it can't reach cloud metadata or other tenants.

If your app legitimately needs to reach an external service on another port - an external database on 5432, a managed Redis on 6379, an SMTP server, an SSH or Git host, a WebRTC/UDP endpoint - open a support ticket and we'll open outbound for your app or your whole team. We grant these on request; we just don't leave every port open for everyone by default.

How much it can send

Each plan has an egress bandwidth cap (the sustained outbound rate), scaling with the tier from a few Mbit/s on the entry plan up to around 1 Gbit/s at the top. It's generous for real web traffic but low enough to blunt abuse. Short bursts are fine; sustained saturation on a small plan is usually a sign to size up. Need more on your current plan? Open a ticket for a per-app raise.

There's no per-GB egress fee and no monthly data-transfer meter - only this rate cap, plus the soft fair-use guideline described in Billing.

Outbound email (SMTP)

App pods can't open direct SMTP connections (ports 25, 465, 587, 2525), to prevent spam-relay abuse. Send mail through a transactional email API over HTTPS (Postmark, Resend, SendGrid, SES, and similar) - those run over 443 and are unaffected. If you have a genuine need for direct SMTP, open a support ticket.

Environment variables

  • Keys: up to 200 characters, matching ^[A-Za-z_][A-Za-z0-9_]*$.
  • Values: up to 4000 characters. Put larger blobs (certificates, big JSON) in object storage and store the URL. See Environment variables.

Requesting a change

For any limit above, open a support ticket from your dashboard with your app or team name and what you need. Egress opt-outs, bandwidth raises, direct-SMTP grants, and resource-limit increases are all granted per app or per team on request.