# Ensure production environments block cross-environment traffic

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876662561438-ensure-production-environments-block-cross-environment-traffic
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure each production environment has Block cross-environment connections turned on, so that private network traffic cannot cross the environment's boundary. Services inside the production environment can still talk to each other, but staging and test services cannot reach production services or databases over the private network.

**Rationale**

By default, all Render services in the same workspace and region share one private network. A bug or compromise in a staging service could then reach production databases directly. Blocking cross-environment traffic isolates production and prevents non-production systems from connecting to it.

**Impact**

-   Staging and test services cannot reach production over the private network
    
-   Limits the damage from a compromised non-production service
    
-   Existing connections continue until services are restarted
    

**Default Value**

By default, environments do not block cross-environment traffic. Network-isolated environments require a Pro workspace or higher.

**Pre-Requisites**

-   Workspace Admin role
    
-   Pro plan or higher
    
-   Confirmation that no required traffic flows between environments
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home, open the project and scroll to the production environment.
    
3.  Click the ••• menu at the top right of the environment and check whether Block cross-environment connections is turned on.
    
4.  If it is off, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home, open the project and scroll to the production environment.
    
3.  Click the ••• menu at the top right of the environment, then toggle on Block cross-environment connections.
    
4.  Restart the services in the environment to close any existing cross-environment connections.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home, open the project and scroll to the production environment.
    
3.  Click the ••• menu at the top right of the environment and toggle off Block cross-environment connections.
    

**Reference**

-   [https://render.com/docs/projects](https://render.com/docs/projects)
    
-   [https://render.com/docs/private-network](https://render.com/docs/private-network)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.