> For the complete documentation index, see [llms.txt](https://docs.toucanai.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.toucanai.cloud/build/data-connections/supported-databases.md).

# Supported databases

{% hint style="info" %}
**Target Audience:** Non technical users & Developers
{% endhint %}

### TL;DR

Toucan.ai connects to external PostgreSQL, MySQL, Google BigQuery, ClickHouse, Snowflake, and Oracle instances for read-only data extraction.

***

### When to use it

Use this page to identify supported data sources and the network requirements for establishing a secure connection to your infrastructure.

***

### Core Functionality

Database Connections enable Toucan.ai to read data from source systems. The platform performs the following actions:

* Discovers schemas and tables.
* Previews raw data.
* Analyzes metadata using AI.
* Powers charts, dashboards, and embedded analytics.

{% hint style="warning" %}
**Constraint**: Toucan.ai only performs read operations and does not write to the connected database.
{% endhint %}

***

### Prerequisites

Before creating a database connection, ensure the following are available:

* Access to an active Toucan.ai organization.
* Valid credentials for the source database.
* Network visibility between Toucan.ai and the database.

***

### Supported Connectors

The following database and warehouse connectors are currently available:

* **PostgreSQL**.
* **Google BigQuery**.
* **MySQL**.
* **ClickHouse**.
* **Snowflake**.
* **Oracle**.

***

### Security & Network Configuration

* **Access Model**: Use a read-only database user to prevent unauthorized data modification.
* **Network Allow-Listing**: You must allow-list Toucan.ai static IP addresses in your firewall or security group settings.
* **Cloud Static IP (EU)**: `51.15.216.216`.

***

### Constraints

* **Write Operations**: Write access is not supported.
* **Firewalls**: Connection attempts will fail if network restrictions are not handled on the database side.
* **Authentication**: Every connector requires specific authentication formats (e.g., credentials vs. JSON keys).
* **Oracle specifics**: Service-name connection (`host`, `port`, `user`, `password`, `service_name`) via the Oracle 23 ODBC driver. An optional **schema (owner)** selects which schema's tables to expose — in Oracle [a schema is a database user and shares the same name as the user](https://docs.oracle.com/en/database/oracle/oracle-database/19/admqs/managing-schema-objects.html), so it defaults to the connecting user; set it to read tables owned by another schema (e.g. a read-only account). When TLS is required, add a **wallet ZIP** (max 500 KB; files at the archive root or in one folder). Non-TLS instances do not need a wallet. Individual file upload, oversized ZIPs, and nested archive layouts are not supported.