Broch runs your tunnels on your own infrastructure. ngrok runs them on its cloud.

Your regulated traffic shouldn’t transit a third party — at all.

Broch keeps the entire data path inside your perimeter — decrypted only on servers you control, with no vendor edge in the middle. No processor to assess, no DPA to negotiate, no new box in your audit diagram; Broch runs on your servers like your database does. ngrok is certified and encrypts in transit, but on its cloud every request still crosses ngrok’s edge, decrypted there by default — and end-to-end encryption only keeps ngrok to ciphertext; the traffic leaves your network either way. For PCI-scoped webhook data, ePHI, or anything under a data residency rule, “encrypted through the vendor” isn’t “it never left our network.”

SSO at creation — every tunnel tied to an IdP identity.

Every Broch tunnel is opened through the IdP you already run — Okta, Entra ID, Auth0, any OIDC provider — and an admin-assigned policy has to permit it (deny-by-default). The tunnel and its activity are logged and attributed to the IdP identity that created it. So when your security team asks “who exposed what, and when,” there’s a name on it — not an anonymous URL.

Deny-by-default, not expose-by-default.

With Broch, a developer with no admin-assigned policy can expose nothing — not even their own localhost. An admin grants a policy to permit loopback; to reach anything beyond it — a database, an internal API, another host — the admin registers that target in Broch’s Service Registry and names it in the policy. The grant is live: revoke it and the developer’s running tunnels drop. Access tunnels are deny-all until an admin grants an endpoint to an IdP group. Broch reaches only what an admin registered.

ngrok inverts the burden. A developer can point a tunnel at “any address or URL reachable from the agent” — their own docs — a database, an admin panel, a whole other website. ngrok can limit which inbound public URL a developer gets, but nothing checks the destination.

Audit and operational logs stream to your SIEM, in real time.

Broch emits structured events as they happen — every tunnel, every policy decision, every admin change, plus operational logs — straight to your own logging stack (Datadog, Seq, OpenTelemetry, stdout). They land in your SIEM live, retained and alerted on by your own tools. The record of who did what is generated in your infrastructure and stays there — nothing to pull from a vendor dashboard, nothing that lived in someone else’s cloud first.

Licensed per seat — and we don’t track your users.

Broch is licensed per developer seat. You set the seat count; seats auto-assign on first use, up to that count — nobody hand-picks who gets one. Hit the limit and the developer gets a clear message; an admin raises the count from the console and it applies live, prorated. And per-user pricing would mean counting your people; we don’t. What Broch reports for licensing is a seat count, never an identity. Your user list isn’t our business — the same way your traffic isn’t.