> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zwiron.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connections

> How Zwiron connections store, test, and reuse encrypted credentials for sources and destinations.

A **Connection** is a saved, encrypted set of credentials and configuration for a data source or destination. You create a connection once and can use it across as many pipelines as you want.

***

## How connections work

Connections behave differently depending on the [execution mode](/concepts/execution-modes) selected:

<Tabs>
  <Tab title="Agent mode">
    1. You enter credentials in the Zwiron dashboard
    2. Credentials are encrypted with the agent's public RSA key
    3. Atlas stores the ciphertext; the agent also keeps a local encrypted copy
    4. When a job runs, the agent decrypts credentials locally and runs the sync — plaintext is not sent back to Zwiron

    Zwiron cannot read Agent-mode passwords without the agent's private key.
  </Tab>

  <Tab title="Hosted mode">
    1. You enter credentials in the Zwiron dashboard
    2. Credentials are encrypted at rest in Zwiron's infrastructure
    3. When a job runs, credentials are decrypted inside an isolated execution environment
    4. They are never logged, shared, or accessible to Zwiron staff

    No agent is required. Your source and destination must be reachable over the internet.
  </Tab>
</Tabs>

***

## Source vs. destination connections

A connection can be used as a source, a destination, or both — depending on the connector type.

| Role            | Description                  |
| --------------- | ---------------------------- |
| **Source**      | Where Zwiron reads data from |
| **Destination** | Where Zwiron writes data to  |

For example, a Postgres connection can be used as a source (reading tables) or a destination (writing tables). A Snowflake connection is typically used as a destination.

***

## Testing a connection

Click **Test Connection** to verify connectivity. The test:

1. Routes through your agent (Agent mode) or Zwiron's hosted engine (Hosted mode)
2. Checks network reachability — can the engine reach host:port?
3. Checks authentication — are the username and password valid?
4. Checks database access — can the user access the specified database?

If the test fails, you'll see a specific error message explaining what failed.

***

## Connection status

| Status        | Meaning                                                          |
| ------------- | ---------------------------------------------------------------- |
| **Connected** | Last test passed, agent is online                                |
| **Offline**   | Agent is offline — agent must be running for connections to work |
| **Error**     | Last connection test or sync attempt failed                      |
| **Unknown**   | Connection hasn't been tested yet                                |

***

## Reusing connections across jobs

One connection can be the source or destination for multiple jobs. If your database credentials change, you only need to update the connection once — all jobs using it will automatically use the new credentials on the next run.

***

## Permissions

Zwiron needs the minimum permissions required for each operation:

* **Source connections** — read-only access to the tables you want to sync
* **Destination connections** — write access (INSERT, UPDATE, CREATE TABLE) to the target schema
* **CDC sources** — additional replication permissions (see the connector-specific guide for exact SQL)

We recommend creating a dedicated database user for Zwiron rather than using an admin account.

***

## Deleting a connection

Deleting a connection removes the stored credentials from the agent and removes the connection from all pipelines. Any jobs using that connection will stop running.

<Warning>Deleting a connection cannot be undone. Make sure no active jobs depend on it before deleting.</Warning>