ErasureDocs
Guides

Connect PostgreSQL

Add a Postgres system, health-check it, and build a Data Map for deletion.

Connect PostgreSQL

Source: app_docs/guide/connectors.md, app_docs/guide/data-maps.md, app_docs/api.md.

Goal

An enabled PostgreSQL System with a Data Map that can support Rights deletion.

When to use it

User / personal data lives in Postgres and must be deleted via parameterized SQL plans from a Data Map.

Prerequisites

  • Organization with Rights access
  • Network path from the worker to the database
  • Connection string (production: include TLS, e.g. ?sslmode=require, unless SQL_ALLOW_INSECURE=true on a private network as documented for product deployments)

Steps

Workflow

  1. Open Rights → Systems (UI: #/rights/connector).
  2. Add PostgreSQL with connection string (secrets encrypted at rest with CONNECTOR_SECRETS_KEY / AES-256-GCM).
  3. Save and run health check (POST …/connectors/:id/test).
  4. Open Data Map → Discover schema (information_schema, capped table set).
  5. Accept suggestions or add entities: table + identifier columns + DELETE or SKIP.
  6. Ignore tables that are not personal data.
  7. Validate until the map is ready (delete without identifiers is invalid).
  8. Optional: Execution preview — COUNT matching rows only; never deletes.

Connection shape (example form, not a live credential)

postgresql://erasure_ro:***@db.example.com:5432/users?sslmode=require

Permissions (documented guidance)

Least privilege: SELECT (discovery/preview) + DELETE on mapped tables only.

Execution model

Parameterized DELETE FROM … WHERE identifier columns match the subject.
Identifier allowlist (no arbitrary SQL). Discovery table cap applies on large catalogs.

Health statuses

StatusMeaning
HEALTHYRecent check succeeded
DEGRADEDSlow or partial issues
UNHEALTHYCheck failed
UNKNOWNNot checked yet
DISABLEDConnector off

API surface (operator session)

MethodPath
GET/api/platform/orgs/:orgId/rights/connectors
POST/api/platform/orgs/:orgId/rights/connectors
POST/api/platform/orgs/:orgId/rights/connectors/:id/test
GET/api/platform/orgs/:orgId/rights/connectors/:id/data-map
POST/api/platform/orgs/:orgId/rights/connectors/:id/data-map/entities
POST/api/platform/orgs/:orgId/rights/connectors/:id/preview

v1: one connector per type per organization.
Legacy alias path: /connectors/postgres for POSTGRES.

Troubleshoot

IssueCheck
Auth failuresCredentials, rotate secrets (Owner)
TLSProduction sslmode=require
NetworkWorker egress / firewall
Missing map entitiesDiscover + map DELETE entities
Discovery failsSQL only; permissions on information_schema; catalog cap

Next

Handle a deletion request · Data Maps · Troubleshooting

Publish your first consent form

Configure purposes, publish a version, create a key, and collect a receipt.

Connect MySQL

Add a MySQL system and Data Map for deletion plans.

On this page

Connect PostgreSQLGoalWhen to use itPrerequisitesStepsConnection shape (example form, not a live credential)Permissions (documented guidance)Execution modelHealth statusesAPI surface (operator session)TroubleshootNext