The IBM Secure Gateway Service is not a VPN. It uses a server-client pair to create a persistent secure connection from the on-premises network to BlueMix that allows connections to specific resources in the on-premises network. Rather than bridging the environments at the network level, it provides granular resource control on both the cloud and on-premises. Rather than starting with everything exposed and limiting connectivity with a VPN, we only require two outbound requests from the on-premises network, and default to denying access to local resources. \r