Connecting to the Warehouse

You connect to the warehouse with read-only credentials managed from the institution settings. A credential is a username and password that any BI tool or SQL client uses to query your institution's warehouse directly. This page covers creating a credential, the connection details you need, and revoking access.

Creating a Credential

Staff create credentials from the institution settings. When you create one:

1. Give it a name — a human label so you can tell credentials apart (for example, "Tableau – Admissions").
2. The platform generates a username and a strong password.
3. The credential is granted read-only access to your warehouse's reporting schema.

Warning: The password is shown once, at creation time, and is never displayed again. Copy it somewhere safe immediately. If you lose it, regenerate the password rather than creating a new credential.

You can issue more than one credential — for example, a separate one per BI tool or per team — so you can track and revoke access independently.

Connection Details

Alongside the password, the platform gives you the details your client needs to connect:

Detail	What it is
Host	The address of your institution's warehouse cluster
Port	The port to connect on
Database	Your institution's warehouse database
Username	The generated credential username
Password	The generated password (shown only at creation)

The warehouse runs on Amazon Redshift, so choose the Redshift (or PostgreSQL-compatible) connector in your BI tool and enter these details. Connection details are also available on demand later — only the password is one-time.

What a Credential Can Access

• Read-only. Credentials can run SELECT queries but cannot insert, update, or delete anything.
• Scoped to the reporting schema. Access is confined to the curated dwh schema. Internal and staging data is never exposed.
• Your data only. Each institution's warehouse is isolated; a credential can never reach another institution's data.

See Querying the Warehouse for the tables available in the dwh schema and example queries.

Revoking a Credential

Staff can revoke any credential from the institution settings. Revoking immediately cuts off access — the underlying warehouse user is removed, not just flagged — so any tool using that credential stops working straight away.

Revoke a credential when a tool is decommissioned, when someone leaves, or if you suspect a password has been exposed.

Security Notes

• Passwords are stored encrypted and shown in plaintext only at the moment of creation.
• All access is read-only and limited to the curated reporting schema — never raw operational data.
• Revocation removes access at the database level, so it takes effect immediately.