--- title: "Database integrations (PostgreSQL, MySQL, MongoDB)" description: "Connect your own PostgreSQL, MySQL, or MongoDB database and sync bank data straight into a table or collection." section: "Integrations" canonical: "https://banksync.io/docs/integrations/databases" --- BankSync can write your synced bank data directly into a database you own. Add a connection once, point a feed at a table (or collection), and every sync lands rows where your apps and dashboards already read from. [![Connecting a PostgreSQL destination: picking Postgres from the destination catalog, filling host, database and user in the connection form, the static egress IP allowlist callout, a successful test connection, choosing the schema and Transactions table, and selecting upsert write mode with a transaction\_id dedup key.](https://cdn.banksync.io/videos/database-destination-feed.poster.495db35915f23420.png)](https://cdn.banksync.io/videos/database-destination-feed.c44484a8fea0d18f.mp4) [Watch: Connecting a PostgreSQL destination: picking Postgres from the destination catalog, filling host, database and user in the connection form, the static egress IP allowlist callout, a successful test connection, choosing the schema and Transactions table, and selecting upsert write mode with a transaction\_id dedup key.](https://cdn.banksync.io/videos/database-destination-feed.c44484a8fea0d18f.mp4) > **Before you start:** You need: (1) a BankSync workspace with at least one connected bank, and (2) a reachable database with a user that can write to it. If you haven't connected a bank yet, start with Connecting your bank, then come back here. ## Supported databases BankSync connects to three database engines today: - **PostgreSQL** — Syncs to a Postgres table. Also works with Postgres-compatible services (Supabase, Neon, Timescale, CockroachDB). - **MySQL** — Syncs to a MySQL table. Also works with MySQL-compatible services (MariaDB, Aurora MySQL, PlanetScale). - **MongoDB** — Syncs to a MongoDB collection. Works with self-hosted MongoDB and Atlas. For Postgres the two container tiers are called **Schema** and **Table**. For MySQL they are **Database** and **Table**. For MongoDB they are **Database** and **Collection**. ## Step 1: Add the database connection **Add a connection** 1. **Open Add Connection** — From your BankSync workspace, go to the Integrations tab and click "Add Connection". 2. **Choose your engine** — In the Add Connection dialog, the database engines appear under the "Databases" group. Search for "Postgres", "MySQL", or "Mongo" if you don't see it, then click the one you want. 3. **Enter your connection details** — Fill in the connection fields (see the field list below). You can also click "Paste a connection string instead" to auto-fill the form from a URL like postgresql://user:password\@host:5432/database. 4. **Set the SSL mode** — Pick an SSL mode. The default is require, which encrypts the connection. Use verify-full to also authenticate the server's certificate (see the SSL modes section below). 5. **Test the connection** — Click "Test connection". A "Connection successful" message confirms BankSync can reach and authenticate against your database. 6. **Save it** — Click "Connect". The connection is saved and appears as a card on your Integrations tab, ready to pick in a feed's Destination tab. ![The Connect PostgreSQL database connection form, filled in: a Display name, Host db.acme.internal, Port 5432, Database analytics, User banksync\_writer, a masked Password, Schema public, SSL mode set to require, an empty CA certificate field, a Paste a connection string instead link, and Test connection and Connect buttons.](https://cdn.banksync.io/screenshots/integrations/database-form.739037ff31349486.png "The database connect form filled in for a PostgreSQL connection.") > **Use a least-privilege user:** 'The connect form recommends a least-privilege database user: INSERT (to write rows), plus CREATE if you want BankSync to create the table for you. There is no need to grant broad admin rights.' ### Connection fields by engine Required fields are marked with an asterisk in the form. Give the connection an optional **Display name** so it is easy to recognise later. #### PostgreSQL | Field | Required | Default | Notes | | -------------------- | -------- | --------- | ------------------------------------------------------------------------ | | Host | Yes | | Database hostname or IP | | Port | Yes | `5432` | | | Database | Yes | | | | User | Yes | | | | Password | Yes | | | | Schema | No | `public` | | | SSL mode | Yes | `require` | `disable`, `require`, or `verify-full` | | CA certificate (PEM) | No | | Only with `verify-full` when the server uses a private or self-signed CA | #### MySQL | Field | Required | Default | Notes | | -------------------- | -------- | --------- | -------------------------------------- | | Host | Yes | | | | Port | Yes | `3306` | | | Database | Yes | | | | User | Yes | | | | Password | Yes | | | | SSL mode | Yes | `require` | `disable`, `require`, or `verify-full` | | CA certificate (PEM) | No | | | #### MongoDB | Field | Required | Default | Notes | | -------------------- | ----------- | ------- | ----------------------------------------- | | Host | Yes | | | | Port | Yes | `27017` | | | Database | Yes | | | | User | No | | A Password is required once a User is set | | Password | Conditional | | Required when a User is provided | | Auth database | No | `admin` | | | SSL mode | Yes | | `disable`, `require`, or `verify-full` | | CA certificate (PEM) | No | | | ### SSL modes explained All three engines offer the same three SSL modes. Pick the strictest one your server supports: | SSL mode | What it does | When to use it | | ------------- | ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `disable` | No encryption. | Only for databases that do not accept TLS at all, ideally on a private network. | | `require` | Encrypts the connection but does not verify the server's identity. | The sensible default for most managed databases. | | `verify-full` | Encrypts and authenticates the server's certificate (hostname and chain). | When you need to be sure you are talking to your server. If it uses a private or self-signed CA, paste that CA into the "CA certificate (PEM)" field. | ## Network security: allowlist BankSync's IP If your database has a public endpoint, you can lock its firewall down so it only accepts connections from BankSync. BankSync always connects to your database from a small, fixed set of IP addresses, so you allowlist them once and leave them in place. Allowlist BankSync’s static egress IP addresses on your database firewall so it accepts connections from BankSync and nothing else. The current addresses are shown on this page in the BankSync app and at https\://banksync.io/docs/databases; if they are not yet listed, email support\@banksync.io for your account’s addresses. > **Where to add the allowlist rule:** Add the IP(s) above as an inbound/allow rule on whatever controls access to your database. The exact place depends on your host (see the table below). Pair this with an SSL mode of require or verify-full so the connection is both restricted by IP and encrypted. Allowlisting is optional — BankSync works without it — but it is the recommended way to minimise your database's exposure. | Where your database is hosted | Where to add BankSync's IP | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | Supabase | Project Settings → Database → Network Restrictions → add each IP as an allowed address (e.g. `203.0.113.10/32`). | | Amazon RDS / Aurora | The database's VPC security group → add an inbound rule for the database port from each IP (`/32`). | | Google Cloud SQL | Connections → Networking → Authorized networks → add each IP (`/32`). | | Azure Database | Networking → Firewall rules → add a rule for each IP. | | Neon | Project → Settings → IP Allow → add each IP. | | MongoDB Atlas | Network Access → IP Access List → add each IP. | | Self-hosted | Your host firewall (e.g. `ufw`, security group, or `pg_hba.conf` plus the OS firewall) → allow the database port from each IP. | ## Step 2: Point a feed at a table or collection A connection on its own does not move data. To start syncing, attach it to a feed. **Pick the database in a feed** 1. **Create or open a feed** — Follow Creating your first feed to pick the accounts and data type you want to sync, then open the feed's Destination tab. 2. **Choose the database in the Destination tab** — In the feed's Destination tab, select your database connection card. 3. **Pick the target container** — Use the two-level picker to choose where rows land. For Postgres pick a Schema then a Table; for MySQL a Database then a Table; for MongoDB a Database then a Collection. Type in the search box to filter. 4. **Or let BankSync create the table** — If you don't already have a target, use the "Set this up for me" panel. BankSync can create a new table (or collection) for the feed's data type and map every column automatically in one click. > **Choose how rows are written: Append vs Upsert:** 'Open the feed\\'s Mapping tab and switch to "Advanced". The question "How should we write rows?" lets database feeds pick Append or Upsert. Append inserts a new row each sync (simple, but re-syncs can create duplicates). Upsert matches rows on the key column(s) you choose under "Match rows on" and updates them in place, so re-syncing never duplicates. Upsert needs at least one key column, and a unique index on those columns is strongly recommended; when BankSync creates the table for you ("Set this up for me"), it creates that unique index too.' ## Confirm it worked You're set up correctly when all of the following are true: - The connect form showed "Connection successful" before you saved, and the connection appears as a card on your Integrations tab. - In the feed's Destination tab, the picker shows your chosen Schema/Database and Table/Collection filled in (not empty). - After the feed runs a sync, the rows appear in your database. Query the target table or collection directly to verify, for example a row count or the most recent rows. ## Connection health states Database connections do not use OAuth tokens, so they never "expire" on a timer, but they can break when something changes on your side. BankSync reports one of four health states on the connection: | State | What it means | Typical fix | | ------------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `ok` | BankSync can reach and authenticate against the database. | Nothing to do. | | `auth_failed` | The server rejected the credentials. | The password was rotated or the user was dropped; open the connection, click "Edit connection", update the credentials, and re-run "Test connection". | | `unreachable` | BankSync cannot reach the host at all. | The host or port changed, the instance is down, or a firewall / security group now blocks the connection. If you allowlist by IP, confirm BankSync's egress IPs (see "Network security: allowlist BankSync's IP" above) are still allowed. | | `tls_error` | The TLS handshake failed. | A certificate was renewed or replaced; re-check the SSL mode, and with `verify-full` update the CA certificate (PEM). | ## Troubleshooting > **If the connection test fails:** 'Connectivity: "Connection successful" never appears or you see an unreachable error. Make sure the database has a reachable endpoint and that any firewall or security group allows the connection. The connect form notes you must make sure your database accepts connections from BankSync. SSL errors: if the server uses a private or self-signed certificate, switch SSL mode to verify-full and paste the server\\'s CA certificate into the CA certificate (PEM) field. If you only need encryption and not server verification, require is enough. Authentication: double-check the User and Password, and for MongoDB confirm the Auth database (defaults to admin) is correct for that user. Empty table list: if the picker shows no schemas/databases, the connected user may lack permission to list them, or the host is unreachable.' ## Next steps Now that your database is connected, finish wiring up the feed and choose your write mode. [Create your first feed](/docs/bank-feeds/creating-first-feed) ## Related guides - [Creating your first feed](/docs/bank-feeds/creating-first-feed): pick accounts and a data type, then point the feed at your table. - [Configuring field mappings](/docs/bank-feeds/field-mappings): control which bank fields land in which columns, including Append vs Upsert. - [Managing your integrations](/docs/integrations/managing-integrations): rename, edit credentials, or disconnect the database connection later. - [Managing sync jobs](/docs/bank-feeds/managing-sync-jobs): check run history when rows stop arriving.