> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zwiron.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a Connection

> Save encrypted credentials for databases, warehouses, and files — reuse connections across Zwiron pipelines.

A **Connection** in Zwiron is a saved set of credentials and configuration for a data source or destination. You create connections once and reuse them across multiple pipelines.

***

## Before you start

Connections work in both execution modes:

* **Hosted mode** — no agent needed. Your connection is tested and used directly by Zwiron's infrastructure. Your source/destination must be reachable over the internet. If the database uses an IP allowlist, add [Zwiron's static egress IPs](/concepts/network-access).
* **Agent mode** — an [installed agent](/getting-started/install-agent) handles the connection from inside your network. Required for private databases, VPCs, and on-premises systems.

***

## Creating a connection

1. Click **Connections** in the left sidebar
2. Click **New Connection**
3. Choose your connector type from the list
4. **Select an execution mode:**
   * Choose **Hosted** if your endpoint is publicly reachable
   * Choose an **Agent** if you need in-network connectivity (you'll see your connected agents listed here)
5. Fill in the connection details (host, port, database, username, password). If you paste a **connection string** and the password has special characters (`@`, `%`, `:`, `/`, etc.), [percent-encode them](/connectors/databases/mysql#passwords-with-special-characters) — or use the separate password field instead.
6. Click **Test Connection** — Zwiron verifies connectivity through the selected mode
7. If the test passes, click **Save**
8. **Profile** the connection (table sizes / row estimates) before creating trial jobs — the trial **1 GB** sample cap uses these sizes to block oversized syncs up front. See [Billing → Free trial](/platform/billing#free-trial).

***

## What gets stored

Credentials are stored encrypted regardless of execution mode:

* **Agent mode** — credentials are encrypted with the agent's RSA key. Atlas stores the ciphertext; the agent keeps a local encrypted copy and decrypts only for syncs. Zwiron cannot read plaintext without the agent's private key.
* **Hosted mode** — credentials are encrypted at rest in Zwiron's infrastructure and used only inside isolated execution environments. They are never logged or accessible by Zwiron staff.

In both cases: your database password is encrypted before storage, and deleting a connection removes the credentials permanently.

***

## Connection types

**Live today** — five enterprise connectors:

| Connector                                     | Source | Destination | CDC                |
| --------------------------------------------- | ------ | ----------- | ------------------ |
| [PostgreSQL](/connectors/databases/postgres)  | ✅      | ✅           | ✅                  |
| [MySQL](/connectors/databases/mysql)          | ✅      | ✅           | ✅                  |
| [MongoDB](/connectors/nosql/mongodb)          | ✅      | ✅           | ✅ (Change Streams) |
| [Snowflake](/connectors/warehouses/snowflake) | ✅      | ✅           | —                  |
| [BigQuery](/connectors/warehouses/bigquery)   | ✅      | ✅           | —                  |

**On demand** — additional connectors can be enabled on request. See [More connectors on demand](/connectors/coming-soon). Do not assume they are available on your account until support enables them.

***

## Setting database permissions

Zwiron needs read access on sources and write access on destinations. We recommend creating a dedicated database user for Zwiron with the minimum required permissions.

See the connector-specific guide for exact permission requirements — for example:

* [PostgreSQL permissions](/connectors/databases/postgres#permissions)
* [MySQL permissions](/connectors/databases/mysql#permissions)
* [Snowflake permissions](/connectors/warehouses/snowflake#permissions)

***

## Testing a connection

Click **Test Connection** at any time — from the create flow or from the connection detail page — to verify your agent can reach the database. The test checks:

* Network reachability (can the agent reach the host/port)
* Authentication (username/password are correct)
* Database access (the configured database exists and is accessible)

***

## Next step

Once your source and destination connections are saved, [create your first pipeline](/getting-started/first-pipeline).