# Supported databases (/core/build/data-connections/supported-databases)



<CalloutContainer type="info">
  <CalloutDescription>
    **Target Audience:** Non technical users & Developers
  </CalloutDescription>
</CalloutContainer>

### TL;DR [#tldr]

Toucan.ai connects to external PostgreSQL, MySQL, Google BigQuery, ClickHouse, Snowflake, Oracle, and Azure SQL instances for read-only data extraction.

***

### When to use it [#when-to-use-it]

Use this page to identify supported data sources and the network requirements for establishing a secure connection to your infrastructure.

***

### Core Functionality [#core-functionality]

Database Connections enable Toucan.ai to read data from source systems. The platform performs the following actions:

* Discovers schemas and tables.
* Previews raw data.
* Analyzes metadata using AI.
* Powers charts, dashboards, and embedded analytics.

<CalloutContainer type="warning">
  <CalloutDescription>
    **Constraint**: Toucan.ai only performs read operations and does not write to the connected database.
  </CalloutDescription>
</CalloutContainer>

***

### Prerequisites [#prerequisites]

Before creating a database connection, ensure the following are available:

* Access to an active Toucan.ai organization.
* Valid credentials for the source database.
* Network visibility between Toucan.ai and the database.

***

### Supported Connectors [#supported-connectors]

The following database and warehouse connectors are currently available:

* **PostgreSQL**.
* **Google BigQuery**.
* **MySQL**.
* **ClickHouse**.
* **Snowflake**.
* **Oracle**.
* **Azure SQL**.

***

### Security & Network Configuration [#security--network-configuration]

* **Access Model**: Use a read-only database user to prevent unauthorized data modification.
* **Network Allow-Listing**: You must allow-list Toucan.ai static IP addresses in your firewall or security group settings.
* **Cloud Static IP (EU)**: `51.15.216.216`.

***

### Constraints [#constraints]

* **Write Operations**: Write access is not supported.
* **Firewalls**: Connection attempts will fail if network restrictions are not handled on the database side.
* **Authentication**: Every connector requires specific authentication formats (e.g., credentials vs. JSON keys).
* **Oracle specifics**: Service-name connection (`host`, `port`, `user`, `password`, `service_name`) via the Oracle 23 ODBC driver. An optional &#x2A;*schema (owner)** selects which schema's tables to expose — in Oracle [a schema is a database user and shares the same name as the user](https://docs.oracle.com/en/database/oracle/oracle-database/19/admqs/managing-schema-objects.html), so it defaults to the connecting user; set it to read tables owned by another schema (e.g. a read-only account). When TLS is required, add a **wallet ZIP** (max 500 KB; files at the archive root or in one folder). Non-TLS instances do not need a wallet. Individual file upload, oversized ZIPs, and nested archive layouts are not supported.
* **Azure SQL specifics**: Connect with `host`, `port`, `database`, `user`, and `password` via the ODBC Driver 18 for SQL Server. The connection always encrypts traffic; server certificate validation is on by default and satisfied without extra configuration by Azure SQL's managed TLS certificate, or can be turned off with the optional **Trust server certificate** setting for a self-signed on-prem instance.