Connector guide

Connect PostgreSQL safely

Works with managed or self-hosted PostgreSQL

1. Create the read-only identity

Run the SQL below as the database owner after replacing the database, schema, and secret placeholders. Use an existing business schema when direct read access is appropriate, or create curated reporting views when sensitive columns or row-level boundaries require a narrower surface.

create role maya_reader login password '<generate-a-long-random-secret>'
  nosuperuser nocreatedb nocreaterole noreplication nobypassrls;
alter role maya_reader set default_transaction_read_only = on;
alter role maya_reader set statement_timeout = '15s';
alter role maya_reader set lock_timeout = '3s';
alter role maya_reader set idle_in_transaction_session_timeout = '15s';

grant connect on database your_database to maya_reader;
grant usage on schema your_approved_schema to maya_reader;
grant select on all tables in schema your_approved_schema to maya_reader;

-- Existing row-level security policies still apply.
-- Review future-table privileges separately.

The example grants current tables only. It deliberately does not alter default privileges for future tables. Existing PostgreSQL row-level security policies continue to apply and may legitimately hide rows from this service identity.

2. Gather your PostgreSQL connection details

Get these values from your database provider or administrator. Maya does not require Supabase; it connects through the standard PostgreSQL protocol.

• The database host, port (usually 5432), database name, and the dedicated reader username and password created above.
• A direct or pooled endpoint that Maya can reach. Use the endpoint recommended by your provider for long-lived, read-only sessions.
• TLS must remain enabled. If your provider uses a private certificate authority, download its PEM certificate for Maya’s private CA field. Leave that field empty when the certificate is already trusted by standard operating systems.

3. Restrict network access

• Require TLS with hostname verification.
• Allow inbound traffic only from Maya’s documented connector egress addresses when network restrictions are enabled.
• Keep a private database private. Use Maya’s Private PostgreSQL Agent or an approved private endpoint rather than opening it to the public internet.
• Keep production, staging, and development identities separate.

4. Enter the connection in Maya

Open Connections → PostgreSQL, then enter the connection name, host, port, database, dedicated reader, secret, optional CA certificate, approved schemas, and optional redacted columns. Secrets belong only in these protected fields—never in chat or a setup question.

5. Verify the boundary

• The role has no superuser, database creation, role creation, replication, or RLS-bypass capability.
• The role cannot create, update, delete, truncate, copy, lock, or change session policy.
• Only approved schemas are visible and existing RLS policies remain effective.
• Queries stop at Maya’s statement, row, and byte limits.
• Credentials, raw SQL, and returned values are excluded from general audit telemetry.

6. Rotate or revoke

Rotate the reader secret regularly and immediately after suspected exposure. To revoke access, disconnect PostgreSQL in Maya and then disable or drop the database role.

Return to Maya →