# Private Services

Render private services are just like [web services](web-services), with one exception: *private services aren't reachable via the public internet.* They _do not_ receive an `onrender.com` subdomain:

[diagram]

However, private services _are_ reachable by your other Render services on the same [private network](private-network)! This means they're perfect for services that only your own infrastructure needs to talk to.

Private services can listen on _almost_ any port ([see details](private-network#port-restrictions)) and communicate using any protocol.

> *Private services must bind to at least one port.*
>
> If your service won't receive incoming traffic, instead create a [background worker](background-workers). See details [below](#private-service-or-background-worker).

## Examples

Here are some deployment guides for tools that make great private services:

- [Deploy an Elasticsearch server](deploy-elasticsearch)
- [Deploy Clickhouse](deploy-clickhouse)

## Private service or background worker?

Like private services, your [background workers](background-workers) are unreachable via the public internet. _Unlike_ private services, *background workers aren't even reachable via their [private network](private-network):*

[diagram]

- If your internal service will bind to _at least one port_ and receive private network traffic, create a private service.
- Otherwise, create a background worker.

Background workers can _send_ private network requests to other services but can't _receive_ them. They usually perform long-running or resource-intensive tasks, which they fetch from a job queue that's often backed by a [Render Key Value instance](key-value).

## Connect to your private service

See [Private Network Communication](private-network#how-to-connect).