PostgreSQL

The PostgreSQL connector reads tables and views from any PostgreSQL 12+ database, including managed services such as RDS, Cloud SQL, Neon, and Supabase. MySQL and MariaDB follow the same flow.

Choose a runtime

The New PostgreSQL Database Connection dialog asks where queries should execute before it asks for anything else.

Cloud

Chartizer Cloud connects to your database directly. Fastest to set up. Your database must accept connections from Chartizer’s IP range.

Local agent

A small process on your machine or network. Database secrets and query execution stay on your infrastructure — only results travel to Chartizer.

Not sure which?

If the database is already reachable from the internet, use Cloud. If it sits behind a VPN, in a private VPC, or on localhost, use a local agent.

Connection details

Field	Required	Notes
Connection Name	yes	Display name in the catalogue, e.g. `Sales DB`
Host	yes	Hostname or IP. `localhost` only works with an agent
Port	yes	Defaults to `5432`
User	yes	Use a dedicated read-only role
Password	yes	Stored encrypted; never shown again after saving
Database Name	yes	A single database per source

Use a read-only role

Never connect Chartizer with postgres or any superuser. Create a role that can SELECT and nothing else — see below.

Create a read-only role
CREATE ROLE chartizer_reader LOGIN PASSWORD 'use-a-generated-secret';

GRANT CONNECT ON DATABASE analytics TO chartizer_reader;
GRANT USAGE ON SCHEMA public TO chartizer_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO chartizer_reader;

ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO chartizer_reader;

Network access

For the Cloud runtime, allow inbound connections from Chartizer’s egress addresses.

Add an inbound rule to the security group for port 5432 from the Chartizer egress range, and make sure the instance is publicly accessible or peered.

Add the Chartizer range under Connections → Networking → Authorised networks, or use a local agent inside your VPC instead.

Allow the range in pg_hba.conf and make sure listen_addresses includes the interface you expect:

pg_hba.conf

hostssl  analytics  chartizer_reader  0.0.0.0/0  scram-sha-256

TLS is required

Chartizer refuses plaintext connections. Managed providers enable TLS by default; self-hosted databases need ssl = on and a certificate the server presents on connect.

Verify before you connect

Test from a machine with similar network access

psql "postgresql://chartizer_reader@db.internal:5432/analytics?sslmode=require" \
  -c "select current_user, version();"

If that fails, Chartizer will fail the same way — fix it at the database first.

Troubleshooting

Connection timed out

The database is not reachable from Chartizer Cloud. Check the security group or firewall, confirm the host resolves publicly, and confirm the port is correct. If the database is private, switch to a local agent.

Authentication failed for user

The role or password is wrong, or pg_hba.conf has no matching rule for the connecting address. Test the exact credentials with psql from outside your network.

No tables listed after connecting

The role can connect but lacks USAGE on the schema or SELECT on its tables. Re-run the grants above, including ALTER DEFAULT PRIVILEGES.

Datasets fell into Auth error after a password rotation

Expected. Open the source and click Reconnect, then enter the new password. Datasets, mappings, and charts are preserved and resume on the next sync.