Private endpoints are not an exfiltration control

This one gets conflated constantly, including in vendor architecture material, and the two controls address entirely different threats.

Private Service Connect gives Google APIs an internal address inside your VPC. Traffic doesn’t traverse the public internet, and the API isn’t reachable from it either. That is genuinely valuable: a leaked credential stops working from an arbitrary network, and your egress firewall policy no longer needs a broad allow rule to a large, shifting set of public ranges.

What it does not do is constrain what a caller may do once connected.

The operation never crosses your boundary

An authorized user inside your network can copy a dataset to a project in an entirely different organization. That operation happens through the API. It never crosses the network boundary you just secured. Private connectivity does precisely nothing to prevent it.

The control that addresses that is VPC Service Controls, which draws a perimeter at the API level and refuses operations that cross it regardless of the caller’s identity or network position.

Two controls, two threats

These get discussed as though they’re alternatives, or as though one implies the other. They don’t:

• Private endpoints without a perimeter. Data movement is unconstrained for anyone already inside.
• A perimeter without private endpoints. The API remains reachable from the public internet.

You want both, and you should be able to say which threat each one is addressing. If a design document lists private connectivity under “data exfiltration controls” with nothing else beside it, that is the gap.

And neither one covers IAM

Worth stating plainly: neither control does anything about an over-broad role grant inside the project. A user with Editor on a project holding sensitive data can do a great deal of damage without ever crossing a perimeter or leaving the network.

That remains the most frequent failure mode by a wide margin — and it is the one least likely to appear in an architecture diagram, because it isn’t a box or a line. It’s a permission somebody granted eighteen months ago for a migration that has since finished.