Connect a database

Database connectors give Summand a live view of a warehouse. This guide walks through PostgreSQL end-to-end; MySQL and Snowflake follow the same shape with different SQL. For databases not in this list (Databricks, Redshift, BigQuery, Oracle), see the Fivetran connector.

Confirm network access

Summand connects from two fixed egress IP addresses, listed in Settings → Connectivity. Allowlist them on your database firewall before continuing.Summand reaches your database over its public endpoint. PrivateLink, VPC peering and SSH tunnels are not supported, so a VPC-only database with no public endpoint can’t be connected directly.

Create a read-only database user

Run the SQL appropriate for your engine. Postgres example:

CREATE USER summand_reader WITH PASSWORD '<strong-password>';
GRANT CONNECT ON DATABASE your_db TO summand_reader;
GRANT USAGE ON SCHEMA public TO summand_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO summand_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO summand_reader;

Snowflake equivalent:

CREATE ROLE summand_reader;
GRANT USAGE ON WAREHOUSE compute_wh TO ROLE summand_reader;
GRANT USAGE ON DATABASE your_db TO ROLE summand_reader;
GRANT USAGE ON SCHEMA your_db.public TO ROLE summand_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA your_db.public
  TO ROLE summand_reader;
GRANT SELECT ON FUTURE TABLES IN SCHEMA your_db.public
  TO ROLE summand_reader;
CREATE USER summand_user PASSWORD = '<strong-password>'
  DEFAULT_ROLE = summand_reader;
GRANT ROLE summand_reader TO USER summand_user;

Use a long random password — at least 32 characters. Summand stores it encrypted in AWS Secrets Manager.

Add the connector in Summand

Go to Connectors → Add connector → PostgreSQL (or MySQL / Snowflake). Provide:

Host
Port (5432 for Postgres, 3306 for MySQL, your account URL for Snowflake)
Database name
Username and password from the previous step

Click Test connection. Summand opens a connection, runs SELECT 1, and reports success or a clear error.

Pick tables

Once connected, Summand queries INFORMATION_SCHEMA and lists every table the user can read. Toggle on the tables you want as datasets — you can enable more later.Each enabled table becomes a dataset. The baseline column-stats component runs automatically; no other configuration is required.

Pick what to do next

From any dataset’s detail page:

Chat with Summand for ad-hoc questions.
Create a view to save a SQL transformation, including cross-table joins.
Set up an experiment to schedule the Predictors, Surprise finding, or other components on the dataset (or on a view of it).

Refresh on demand

Click Refresh on any dataset to re-read current data from the source, or put the dataset on a schedule from hourly to weekly. Each run writes a new snapshot of the dataset; earlier snapshots stay queryable for at least 30 days by default. Scheduled experiments use the new data on their next run.

Performance tips

Limit row count for huge tables. A 100M-row table takes a long time to refresh. If you only need a representative sample, create a database view that samples or filters, and point Summand at the view.
Pre-aggregate via Summand views. If multiple experiments target the same cohort, define the cohort once as a view and point experiments at the view rather than re-filtering in each component.
Refresh during off-peak hours. In the default full-refresh mode, a refresh reads the whole table. For warehouses with concurrent workloads, schedule refreshes around your peak, or switch the dataset to an incremental sync mode with a cursor column.

Security review checklist

If you need to walk security through the integration:

✓ Read-only credentials, scoped to the schemas you grant
✓ Credentials stored encrypted in AWS Secrets Manager (KMS-backed)
✓ TLS required for all database connections, and the server certificate and hostname are verified. If your server uses a private CA (for example Supabase or Aiven), paste its CA certificate into the connector’s TLS settings.
✓ Egress from two fixed IP addresses we publish
✓ No write paths exist in code — SELECT-only is a hard property of the connector, not a configuration
✓ Connector create, update and delete requests are recorded in Summand’s application logs

Get started

Core concepts

Data sources

Guides

Account & billing

Resources

Connect a database

Performance tips

Security review checklist

​Performance tips

​Security review checklist

Performance tips

Security review checklist