Connections
A connection is how Halo reaches your data, read-only, with its credentials encrypted. Here's what one holds, which sources Halo supports, and who can manage them.
A connection is how Halo reaches a source of data. Once you've made one, discovery maps its tables, and datasets build on those tables. Reports never hold their own database logins, so changing a password happens in one place.
You'll find connections under Data in the sidebar.
What Halo can connect to
| Source | Status | Guide |
|---|---|---|
| PostgreSQL | Available | Connect PostgreSQL |
| CSV files and Excel workbooks | Available | Upload CSV and Excel files |
| Amazon Redshift | Available once Halo turns it on for your organization | Connect Amazon Redshift |
| Dremio | Available once Halo turns it on for your organization | Connect Dremio |
| SQL Server, BigQuery, MySQL | Planned after v1 |
Data Halo maintains for you isn't a connection. It comes through the Marketplace: see Marketplace data and the Marketplace.
What a connection holds
| Part | What it is |
|---|---|
| Name | What people see in Halo |
| Workspace | Where it lives. Who can use it follows the workspace's sharing |
| Connection settings | The address and login: for PostgreSQL, host, port, database, user, TLS mode and which schemas to include |
| Password | Encrypted, and never shown again |
| SSH tunnel and TLS certificates | Optional. Private keys are encrypted the same way. See SSH tunnels and TLS |
| Catalog | What discovery found: tables, columns, relationships and profiles |
An uploaded-files connection has no address or password. Halo stores its tables itself, encrypted, and it doesn't count toward your plan's limit on connections.
Read-only, always
Halo only ever reads from your databases.
It asks for a read-only login, and for PostgreSQL and Redshift the connection test warns if the login is a superuser or can change data.
Every PostgreSQL and Redshift query runs in a read-only transaction, so the database refuses a write even if the login could make one.
Every query has a time limit, set by your plan, and a limit on rows.
Values are never written into SQL. Filters and parameters are always sent separately from the statement.
Custom SQL in datasets follows the same rules, and only roles with the custom SQL permission can write it.
Credentials
Passwords are sealed with a data key that belongs to your organization, and that key is itself encrypted by a master key. Halo decrypts a password only in memory, only while using it. Allowlists, SSH tunnels and read-only logins has the detail for your IT team.
Who can do what
| Owner, Admin, Builder | Analyst | Viewer, External guest | |
|---|---|---|---|
| See connections and the catalog | Yes | Yes | No |
| Build datasets on them | Yes | Yes | No |
| Add and change connections, run discovery | Yes | No | No |
These are the built-in roles' defaults. Analysts also need edit access to a workspace to build in it, and custom roles pick their own permissions. See Roles and permissions.
Looking after a connection
Open a connection to see its tabs: Tables, Relationships, Discovery history, dbt on a database connection, see Use your dbt project, and, if you can edit it, Settings.
Test it. Choose Test connection on the connection's page. Halo connects and says whether it worked, with the server's version. The Settings tab shows the last test in full, with how long it took and any warnings. A failure shows the source's own error, and the connection's page keeps saying so until a test or a discovery run succeeds.
Halo also tests each connection about once an hour, which updates its status the same way. After three failures in a row, Halo's team is alerted.
Change its settings. On the Settings tab, edit what you need. A saved password shows as "Saved. Type to replace it", so leave it alone unless it's changed. Halo uses new settings the next time it queries or runs discovery.
Find it quickly. The command palette finds connections by name, and you can pin one to the sidebar.
Remove it. At the foot of the Settings tab, choose Delete connection and type its name to confirm. It takes manage access to the connection's workspace. It goes to the Trash for 30 days with its credentials, catalog and discovery history, and your database isn't touched. Datasets over it can't be queried while it's gone, and restoring it brings it all back.
Combining sources
A dataset normally reads from one connection, live. To join tables across connections, such as an uploaded file with a database table, use extracts: joins across sources run between extracts, inside Halo.
Plan limits
Your plan sets how many connections you can have. Owners and Admins can see the limit and your use of it under Settings, then Usage. See Usage and plan limits.