PostgreSQL Connection

A Postgres connection lets Mycorr read tables from any Postgres-wire-compatible database — RDS, Cloud SQL, self-hosted, Heroku, Neon, Crunchy Bridge, etc.

For a managed Supabase project, use the Supabase connection type instead — it has helpers for finding the connection string and dealing with poolers.

What Mycorr needs

A user (role) on your database with SELECT on the tables you want to import. Mycorr only reads: it browses information_schema, reads tables, and runs the SQL queries you write, which must be a SELECT (or WITH … SELECT) and run inside a read-only transaction.

We strongly recommend creating a dedicated read-only role rather than reusing an application or admin role:

-- Create the role
CREATE ROLE mycorr_reader WITH LOGIN PASSWORD '<strong-random-password>';

-- Allow connecting to the database
GRANT CONNECT ON DATABASE your_db TO mycorr_reader;

-- Allow seeing the schema(s) you want to expose
GRANT USAGE ON SCHEMA public TO mycorr_reader;

-- Allow reading existing tables
GRANT SELECT ON ALL TABLES IN SCHEMA public TO mycorr_reader;

-- Allow reading tables created in the future too
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO mycorr_reader;

Repeat the last three statements for every schema you want to import from.

Network access

Mycorr connects to your database over the public internet from its hosting environment. Two things follow:

• Public reachability required. The host you give Mycorr must resolve to a public IP. Private addresses (10.x, 172.16-31.x, 192.168.x, 169.254.x, loopback, *.local, localhost) are rejected up front — see the SSRF note in the Security model section.
• No static egress IPs are published. If your database firewall needs an allowlist, contact support. The practical setup today is a publicly reachable host, an encrypted connection and a read-only role.

Setting it up

1. Open Connections in the sidebar and click Add connection.
2. Pick PostgreSQL.
3. Fill in:
   • Name — anything human, e.g. "Prod analytics replica".
   • Host — db.example.com or an IP. Internal hostnames (e.g. localhost, *.local) are rejected.
   • Port — usually 5432.
   • Database — the database name (not the cluster name).
   • Username — the read-only role you created above.
   • Password — the password for that role.
4. Under Encryption, keep Encrypt & verify unless your server's certificate can't be verified (see Encryption).
5. (Optional) Under Advanced, paste a custom CA certificate (PEM) if your database uses a private or self-signed CA that isn't in the public trust store (common for RDS Proxy and internal PKI).
6. Test & save. Mycorr opens one short connection, runs a trivial query, and stores the encrypted credentials.

The host, port, database and username can't change after creation: they are the connection's identity. To point at a different database, add a new connection. On the Connections page you can change the name, set a New password (leave it blank to keep the current one), replace the CA certificate or Clear stored CA certificate.

Encryption

Connections to your database are always encrypted. Mycorr refuses an unencrypted connection.

A custom CA certificate is only used with Encrypt & verify. If your server uses a self-signed or private CA, pasting that CA is safer than switching to Encrypt only.

Finding the connection details

Where to look depends on your provider:

• AWS RDS / Aurora: RDS console → your instance → Connectivity & security → Endpoint is your host, Port is the port. Database / username were set at create time.
• Google Cloud SQL: Cloud SQL console → your instance → Connections → Public IP is the host. Enable "Public IP"; Mycorr doesn't publish egress IPs, so contact support if you need an allowlist.
• Heroku Postgres: heroku config:get DATABASE_URL → postgres://user:pass@host:port/database. Parse out each field.
• Neon / Crunchy Bridge / Render: each provider shows a connection string on the project dashboard. Parse the URL into its parts.
• Self-hosted: whatever you set in postgresql.conf / pg_hba.conf.

For Supabase, use the Supabase page — it has provider-specific guidance.

Importing data

Importing a table

1. Inside a model, open Import → Connections and expand the connection.
2. Browse schemas and tables, or use Search schemas or tables.
3. Drag a table onto the canvas.

If the table has a primary key, Mycorr uses it to track rows. If not, it asks you to pick one. See Row tracking.

Importing a SQL query

To import a join, a filter or an aggregate instead of a whole table, click SQL Query on the connection. Write the query, give the result a Table name, and set the Row limit (10,000 by default, at most 500,000).

The query must be a single SELECT or WITH … SELECT, and it runs in a read-only transaction.

Syncing

Imported tables are read-only in Mycorr. When the database changes, choose Sync Table (or Checkpoint, then sync) from the table's menu. A sync applies only what changed and keeps every unchanged row's identity. See Syncing.

Security model

• Read-only by IAM. The role you create only has SELECT. Even if Mycorr's code asked for more, your database would refuse it.
• Encrypted at rest. The password and (if provided) CA certificate are AES-256-GCM encrypted in Mycorr's database. Other members of your organization can't see them.
• Encrypted in flight. Always TLS, verified by default against the system trust store or your custom CA.
• Read-only queries. A SQL query import is checked to be a SELECT and runs in a read-only transaction. Schema and table names are validated against information_schema before they are used.
• No SSRF. Connections to private / metadata / loopback addresses (127.0.0.0/8, 10.0.0.0/8, 172.16-31.0.0/12, 192.168.0.0/16, 169.254.0.0/16, localhost, *.local) are blocked. Mycorr cannot be used as a proxy into a private network.

Revoking

Two ways:

• In Mycorr: on the Connections page, open the connection and delete it. Its tables keep their data but stop syncing.
• In Postgres: REVOKE the role's privileges, drop the role, or rotate the password. The next sync fails.

Either is sufficient. Both is fine.

Troubleshooting