Connector guide
Connect MySQL safely
A TLS-only, read-only connection for curated databases
1. Create a dedicated reader
Create a separate user restricted to Maya's network origin and grant SELECT only on explicitly approved databases or views.
2. Restrict network and authentication
- Require TLS and validate the server hostname.
- Restrict inbound access to Maya egress addresses or private connectivity.
- Never reuse an application or administrator account.
3. Expose only approved data
- Prefer curated views over production base tables.
- Do not grant FILE, PROCESS, SUPER, CREATE, or any write privilege.
- Exclude secrets and sensitive personal data.
4. Verify before connecting
- Inspect SHOW GRANTS for SELECT-only access.
- Confirm unapproved databases are inaccessible.
- Rotate the secret after the connectivity test.
5. Rotate and revoke
Rotate secrets or keys on a defined schedule and immediately after suspected exposure. Disconnect the integration in Maya before disabling the external identity, and retain only non-sensitive audit metadata.