Connectors

A connector stores the credentials and settings for an external data source. Importing through one lands the data as a normal dataset — versioned Delta Lake storage, SQL, charts — and keeps the connection around so the dataset can refresh. There are 17 connector types: 8 databases and warehouses, 7 SaaS sources, plus Google Sheets and a generic REST API.

Choose a connector

• Databases & warehouses — PostgreSQL, MySQL, Microsoft SQL Server, Amazon Redshift, ClickHouse, Snowflake, Google BigQuery, DuckDB (file/URL). All support importing a table or a custom SQL query.
• SaaS sources — Adjust, AppsFlyer, Chargebee, Campaign Manager 360, Google Ads, HubSpot, Stripe. These import reports or objects from the vendor’s API.
• Everything else — Google Sheets (per-sheet import) and REST API (import a JSON endpoint’s response).

Capabilities differ per type — which ones can list sources, run SQL, sync incrementally, or serve live reads — and the full matrix is in the reference below. The add-connector form in the app is generated from each type’s declared config schema.

Connect and test

Create a connector with a name, a type, and the type’s config fields. Credentials are encrypted at rest, decrypted only at the moment the connector actually connects, and never readable back — viewing a connector shows its config with every secret field stripped.

Test Connection verifies the source is reachable before you import anything. Error messages are deliberately generic — raw driver errors can leak hostnames and versions, so the details go to the server log, not the message you see.

Two credential conveniences:

• Google Sheets managed account — instead of pasting a service-account key, a Sheets connector can use the managed default account (an org-level default, falling back to the platform’s). Share the spreadsheet with the service-account email shown in the form — the form shows the address, never a key. Rotating the managed key takes effect for every connector that uses it, immediately.
• OAuth connectors — SaaS types that authenticate with OAuth store only a connection reference; access tokens are resolved and refreshed at call time.

Import as a dataset

Browse what the source offers from the connector’s import view — tables for databases, sheets for Google Sheets, reports or objects for SaaS sources — with column listings per table where supported. Pick a source, name the dataset, and import.

SQL-capable connectors can import a custom SQL query instead of a named source, so the imported dataset can be a join or an aggregate rather than a raw table. The result is a dataset like any other: versioned, queryable, chartable.

Keep it fresh

A manual Sync re-syncs an imported dataset from its source. Connectors that support a watermark sync incrementally — only rows past the last high-water mark are fetched instead of re-reading everything; resetting the watermark from the dataset’s sync settings forces the next sync to start over. On top of manual sync, a connector-backed dataset can refresh on a schedule or run in live mode (re-sync on read, never cached) — both are dataset-level settings described in Datasets. Live mode is only offered on types where a round-trip is fast enough; see the table below.

SSH tunnels

The five self-hosted database types — PostgreSQL, MySQL, SQL Server, Redshift, ClickHouse — can reach a database on a private network through an SSH bastion. Enable Connect via SSH tunnel in the connector form and point the database host at its private address (resolvable from the bastion).

The keypair is platform-generated: the connector form provisions one and shows the public key and fingerprint only — the private key is encrypted at rest and never leaves the server. Add the public key to the bastion user’s ~/.ssh/authorized_keys.

The bastion’s host key is pinned on trust-on-first-use: Test Connection is the only path that captures it, and every later tunnel open verifies against the pin. Changing the bastion host or port drops the pin, and tunnels fail closed until a new Test Connection re-pins it.

Reference

Databases & warehouses

type	Source	Watermark sync	Live mode	SSH tunnel
postgresql	PostgreSQL	yes	yes	yes
mysql	MySQL	yes	yes	yes
mssql	Microsoft SQL Server	yes	yes	yes
redshift	Amazon Redshift	yes	yes	yes
clickhouse	ClickHouse	yes	yes	yes
snowflake	Snowflake	yes	no	no
bigquery	Google BigQuery	yes	no	no
duckdb	DuckDB (file/URL)	no	yes	no

SaaS sources

type	Source	Watermark sync
adjust	Adjust	yes
appsflyer	AppsFlyer	yes
chargebee	Chargebee	yes
cm360	Campaign Manager 360	no
google_ads	Google Ads	yes
hubspot	HubSpot	yes
stripe	Stripe	yes

Everything else

type	Source	Watermark sync	Live mode
google_sheets	Google Sheets	no	yes
rest_api	REST API	no	no

Connector credentials only ever flow one way — in.