> ## Documentation Index
> Fetch the complete documentation index at: https://docs.concatflow.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Private databases

> Connect a database that never accepts inbound connections. A small agent runs next to it and calls out to Concatflow.

Your database sits in a closed network. Nothing can reach it from the internet, and that is how it should stay.

Concatflow connects to it anyway. You run a small agent on a machine that can see the database. The agent opens one outbound connection to Concatflow on port 443. Queries travel down that connection, and results travel back.

You open no inbound port. You add no IP allowlist. You set up no VPN.

![The agent runs in your network next to the database and opens outbound connections to Concatflow on port 443. Nothing connects inbound.](https://mintcdn.com/concatflow/MlfIt7B55oW6GUfJ/private-databases/images/architecture-light.svg?fit=max\&auto=format\&n=MlfIt7B55oW6GUfJ\&q=85\&s=1034fafd11f2aaf12522bd38eba93238)

## What stays with you

* **The database password.** It lives in the agent's environment on your machine. Concatflow never sees it, stores it or carries it.
* **Write access.** The agent checks the account before it serves anything. If the account can write, it refuses to start.
* **The off switch.** Stop the container and nothing reaches the database. Revoke the agent in the dashboard and Concatflow disconnects it at once.

## When to use it

Use an agent when the database is not reachable from the internet. That covers a private VPC, an on-premises server, or a database behind a firewall that only lets traffic out.

If the database already accepts connections from the internet, a direct connection is simpler. You pick one or the other when you create the dataset, and you cannot switch later.

## Supported databases

| Database | Minimum version | Status |
| - | - | - |
| PostgreSQL | Any supported release | Supported |
| MariaDB | 10.6 | Supported |
| MySQL | 8.0 | See the [note on MySQL 8](https://docs.concatflow.com/private-databases/troubleshooting.md#mysql-8-authentication-fails) |

> **[Quickstart](https://docs.concatflow.com/private-databases/quickstart.md)**
>
> Connect a database through an agent in about ten minutes.

> **[Security model](https://docs.concatflow.com/private-databases/reference/security.md)**
>
> What the agent can do, and what it cannot.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.