Setup guide · Hosted PostgreSQL

Connect Neon, RDS, Cloud SQL or any hosted Postgres to Dataki

Dataki connects to PostgreSQL directly, with a host, a port, a database, a user and a password. It connects from one fixed IP address, over TLS whenever the server offers it. Every hosted Postgres works this way; what differs is where each host keeps the details and how it decides who may connect.

  1. Your Postgres host
  2. Direct connection over TLS
  3. Dataki
Setup
About 5 minutes.
Connects from
34.89.253.13, one fixed address to allow.
Encryption
TLS whenever the server offers it, which most hosts require. The server certificate is not verified, and client certificates are not supported.
What it reads
Tables and views in the public schema.
Open Dataki Go to the steps

01Before you start

  • A database reachable from the internet, or one you can open to a single address.
  • A role that can create other roles. On most hosts that is the owner role you were given.

02Set it up

3 steps, about 5 minutes

  1. 01

    Create a read-only user

    Connect as the role that owns your tables and run this, with your database's name and a long password. The last two lines make the user read tables you create later, and refuse any write even if a grant slips through.

    Run as the table owner 
    CREATE ROLE dataki_reader WITH LOGIN PASSWORD 'choose-a-long-password';
GRANT CONNECT ON DATABASE your_database TO dataki_reader;
GRANT USAGE ON SCHEMA public TO dataki_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO dataki_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO dataki_reader;
ALTER ROLE dataki_reader SET default_transaction_read_only = on;
  2. 02

    Let Dataki in

    If your host filters connections by address, allow 34.89.253.13. It is the only address Dataki connects from. Where each host keeps its details and its firewall:

    • Neon

      Connection details

      Project dashboard › Connect. Turn off Connection pooling for the direct host.

      Letting Dataki in

      Open to every address, unless you use IP Allow on the Scale plan.

    • Amazon RDS and Aurora

      Connection details

      Connectivity & security tab: endpoint and port. On Aurora, use the reader endpoint.

      Letting Dataki in

      Public access on, then a security-group inbound rule for TCP 5432 from 34.89.253.13/32.

    • Google Cloud SQL

      Connection details

      Instance Overview for the public IP; Users and Databases in the menu.

      Letting Dataki in

      Connections › Networking › Authorized networks: add 34.89.253.13/32.

    • Azure Database for PostgreSQL

      Connection details

      The host is <server>.postgres.database.azure.com.

      Letting Dataki in

      Settings › Networking: a firewall rule with 34.89.253.13 as start and end IP.

    • Render

      Connection details

      The database's Connect menu, external URL.

      Letting Dataki in

      Open to every address by default. Restrict it under networking with 34.89.253.13/32.

    • Railway

      Connection details

      Variables › DATABASE_PUBLIC_URL, for the proxy host and port. Not PGHOST, which is internal.

      Letting Dataki in

      Turn on public networking. Railway has no IP allowlist.

    • Heroku Postgres

      Connection details

      The database's Credentials tab. On Standard plans and up, create a credential for Dataki there instead of CREATE ROLE, then run the GRANT lines for it.

      Letting Dataki in

      Common Runtime databases accept any address.

    • DigitalOcean

      Connection details

      Connection Details, public network. The port is 25060.

      Letting Dataki in

      Network Access › Trusted sources: add 34.89.253.13.

    • Tiger Cloud (Timescale)

      Connection details

      The service's Connect panel: user tsdbadmin, database tsdb, and a port of its own.

      Letting Dataki in

      IP Allow Lists, on paid plans.

    • Crunchy Bridge

      Connection details

      The cluster's Connection tab.

      Letting Dataki in

      Networking: delete the open default rule, then add 34.89.253.13/32.

    • PlanetScale Postgres

      Connection details

      Connect, or Settings › Roles. The user name has the form role.branchid.

      Letting Dataki in

      Settings › IP restrictions.

    • On Supabase, Dataki's Supabase connection finds the database for you: sign in with Supabase, pick the project, and add the database password. See Supabase.
  3. 03

    Add the connection in Dataki

    Open app.dataki.ai/connect and, under Database Connections, choose Connect PostgreSQL. Fill in Host, Port, Database Name, Username and Password, then Test connection and Save Connection.

    Use the host name your provider shows, not an IP address: Neon and Render route connections by name.

03Check it

Make sure it is right

Two checks, run while logged in as dataki_reader.

Which tables will Dataki see?

This is the list Dataki gives the model, so a table missing here cannot be asked about.

As dataki_reader 
SELECT table_name, table_type
FROM information_schema.tables
WHERE table_schema = 'public' AND table_type IN ('BASE TABLE', 'VIEW')
ORDER BY table_name;

Is the user really read-only?

This must fail, with "cannot execute CREATE TABLE in a read-only transaction" or "permission denied".

As dataki_reader 
CREATE TABLE dataki_write_check (id int);

04Worth knowing

What you will run into

Only the public schema
Dataki lists the tables and views in public. To bring in a table from another schema, create a view over it in public, which is also a good way to leave out columns nobody should ask about.
Use the direct connection when you can
Transaction poolers, such as Neon's -pooler host or PgBouncer on port 6432, handle Dataki's queries, but hosts recommend a direct connection for analytics.
Servers Dataki cannot reach
Anything that demands a client certificate: Cloud SQL's Trusted client certificate required mode, Heroku Private and Shield databases. And anything on a private network only, such as Azure servers created with private access, or Railway without public networking.
Sleeping databases and rotated passwords
Serverless hosts like Neon suspend an idle database, and the first question after a pause wakes it, which takes a moment. Heroku changes credentials on maintenance and failover; update the connection in Dataki when it does.

Checked against

Last checked 15 September 2026.

Related guides

Free while we are in beta

Connect Hosted PostgreSQL. Ask it something.

Once the data is where Dataki can read it, the first answer is a question away, and anything worth keeping becomes a dashboard with a link that stays live.

Open Dataki Stuck? Ask us
One data source
Free tier. Connect a second on any paid plan.
Read-only
Every query runs read-only. Dataki cannot change your data.
No card
There is nothing to cancel if you stop.