Google Cloud SQL for PostgreSQL + CHION

Cloud SQL Postgres text-to-SQL
that runs through a read-only role

Google documents conversational analytics for Cloud SQL for PostgreSQL through its Gemini data agents, so a Cloud SQL estate already has a native path and does not have to move to AlloyDB for natural-language SQL. That option wins when the answer should stay inside Google's own tooling. Chion does Cloud SQL Postgres text-to-SQL through a read-only role you create. Ask "average order value by category last month?" and Chion generates a SELECT, passes it through the application validators, runs it against the instance or a read replica, and leaves the executed query on screen beneath the chart.

Direct IP with sslmode=require, or the Cloud SQL Auth Proxy
Point it at a read replica and leave the primary alone

Read-only enforced in code, capped at 1,000 rows, with the query text on screen to trace.

Start your 7-day trial Read the connection guide

Chion queries the Google Cloud SQL for PostgreSQL instance you already run, or a read replica beside it, as an AI analyst for Cloud SQL. Direct IP with sslmode=require is the short path, and the Cloud SQL Auth Proxy works too when your policy requires IAM-brokered access. Chion holds the password in an AES-256-GCM vault, stops each result at 1,000 rows, and inherits whatever row-level security the role you granted carries, which is the floor conversation-driven analytics needs before anyone trusts a follow-up. A saved query compiles through the skills generator into a skill you run in Claude Code or Codex, and that compiled library is what an AI workforce that writes SQL actually stands on.

Run AI on the Cloud SQL you already have

What changes when your PostgreSQL lives on Google Cloud SQL.

Direct IP + SSL vs the Auth Proxy

Connect read-only over SSL with the Auth Proxy optional. Public IP with sslmode=require is the simplest path. The Cloud SQL Auth Proxy adds IAM-managed connections; both work with Chion. Pick the proxy if your security policy requires IAM-brokered access.

Chion vs. Cloud SQL's built-in Gemini text-to-SQL

Google documents conversational analytics for Cloud SQL for PostgreSQL through its Gemini data agents, linked below, so a Cloud SQL estate does not have to migrate to AlloyDB for natural-language SQL. That path wins when the rest of your stack already sits on Google Cloud and you want the answer inside Google's own tooling. Chion's difference is what leaves with you: the read-only SELECT is on screen, and a saved query compiles into a skill you run in Claude Code or Codex.

Authorized networks, not open access

Under Connections → Networking, add an authorized network scoped to the Chion IP range rather than opening the instance to the internet. The same least-privilege posture runs through Chion's security model.

Run questions on a read replica with zero load on your primary

Create a read replica and point Chion at it to offload analytics from the primary. Chion only ever issues SELECTs, so a replica is a perfect fit for read-heavy question workloads.

Private Service Connect and Private IP

PSC and private-only instances require VPC-originating connections. Expose a public endpoint or run a TCP proxy on a VM that Chion can reach over the public internet.

Cloud SQL IAM database authentication (roadmap)

Chion authenticates today with a dedicated read-only role and password. IAM database authentication is on the enterprise roadmap. See how Chion compiles a code-validated SQL pipeline end to end.

Example question & SQL

See what Chion generates from a plain-English question.

You ask

"Average order value by product category last month"

Chion generates

SELECT
  p.category,
  AVG(oi.unit_price * oi.quantity) AS avg_order_value
FROM order_items oi
JOIN products p ON p.id = oi.product_id
JOIN orders o ON o.id = oi.order_id
WHERE o.created_at >= date_trunc('month', now()) - interval '1 month'
  AND o.created_at < date_trunc('month', now())
GROUP BY p.category
ORDER BY avg_order_value DESC;

Create a read-only Postgres role

Run this once before you connect. Chion enforces read-only at the SQL validator, but a least-privilege role is the canonical pattern.

CREATE ROLE chion_read LOGIN PASSWORD '<strong-password>';
GRANT CONNECT ON DATABASE <dbname> TO chion_read;
GRANT USAGE ON SCHEMA public TO chion_read;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO chion_read;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO chion_read;

Replace <dbname> with your database name. The ALTER DEFAULT PRIVILEGES line ensures new tables are auto-readable.

Connection string format

Reference for parsing. Chion accepts the six fields directly, no string concatenation needed.

postgresql://chion_read:<password>@<public-ip>:5432/<dbname>?sslmode=require

Read-only by code. Code-validated by Chion's 13-step SQL pipeline.

Finding your Google Cloud SQL for PostgreSQL credentials

GCP Console → SQL → [your instance] → Overview page

Field	Where to Find	Default
Server (Host)	Overview → Connect to this instance → Public/Private IP	IP address (e.g., 34.x.x.x)
Port	Not prominently displayed; always default	5432
Database	Databases tab in left sidebar	postgres
Schema	Not in console; default is public	public
User	Users tab in left sidebar	postgres
Password	Users tab → three-dot menu → Change password	Set at creation or via Users tab

Quick steps

1.Log in at console.cloud.google.com
2.Navigate to SQL from the left sidebar
3.Click your PostgreSQL instance name
4.Overview page → under "Connect to this instance," copy the Public IP address
5.Click Databases in the left sidebar to see available databases
6.Click Users to see usernames; use the three-dot menu to change/reset a password
7.Port is always 5432

Google recommends using the Cloud SQL Auth Proxy for production connections. For Chion, direct IP + SSL works for initial setup.

Open Google Cloud SQL for PostgreSQL console

Google Cloud SQL for PostgreSQL troubleshooting

Common issues and how to fix them.

Connection refused: no authorized network

In the GCP Console, go to your Cloud SQL instance → Connections → Networking → add an authorized network with the Chion IP range. For initial testing, scope the rule to your laptop's egress IP, then narrow to the Chion IP range before going live. Avoid opening the instance to the internet.

Cannot find Public IP

On the instance Overview page, look for "Connect to this instance" → Public IP address. If only Private IP is shown, you need to enable a public IP under Connections → Networking.

Password reset

Go to Users tab → click the three-dot menu next to your user → Change password. The change is immediate.

Read replica routing

For read-heavy workloads, create a Cloud SQL read replica and point Chion at the replica's public IP. Chion only issues SELECT statements, so a read replica is sufficient and offloads load from the primary.

Official Google Cloud SQL for PostgreSQL documentation

Authoritative references from the provider. Opens in a new tab.

Cloud SQL for PostgreSQL overview
Official Google Cloud documentation index for Cloud SQL Postgres.
Configure public IP
How to enable a public IP and add authorized networks.
Cloud SQL read replicas
Replica creation and read-routing patterns.
Conversational analytics for Cloud SQL for PostgreSQL
Google's own natural-language path for Cloud SQL Postgres, checked 2026-08-31.
PostgreSQL CREATE ROLE
Reference for the read-only role used by Chion.

Your credentials are encrypted

The password for your Cloud SQL role is sealed in an AES-256-GCM envelope. Plaintext is decrypted into memory for a single request, held for at most 60 seconds or five reads, then purged. Chion holds nothing but read permissions, and any generated statement that is not a single read-only SELECT is rejected in code. Point it at a replica and the grants plus row-level security on that role still decide what comes back.

Read the full security model

Frequently asked questions

Common questions about using Chion with Google Cloud SQL for PostgreSQL.

Do I need the Cloud SQL Auth Proxy?

No. Chion connects via direct IP with SSL (sslmode=require). The Auth Proxy is optional and recommended by Google for production workloads, but direct IP works for Chion.

Does Chion support Cloud SQL Private IP?

Chion connects over the public internet. If your instance only has a private IP, enable a public IP or set up a Cloud NAT / VPN peering arrangement.

Which Cloud SQL tiers does Chion work with?

All tiers: shared-core, lightweight, standard, and high-memory. Chion's read-only queries are lightweight and work within any tier's connection limits.

Can I use IAM database authentication?

Not currently. Chion uses standard PostgreSQL password authentication via a dedicated read-only role. Cloud SQL IAM database authentication is on the enterprise roadmap.

Does Chion support Private Service Connect?

Not directly. PSC requires the connection to originate inside a Google VPC. To use PSC with Chion, expose a public endpoint or set up a TCP proxy on a VM that Chion can reach.

Can I point Chion at a Cloud SQL read replica?

Yes, and it is recommended for production. Read replicas accept SELECT queries and offload work from the primary. Chion issues only SELECTs, so a replica is a perfect fit.

Ready to connect your Google Cloud SQL for PostgreSQL database?

Open Chion, enter your credentials, and start asking questions in plain English.

Start your 7-day trial

Cloud SQL Postgres text-to-SQL that runs through a read-only role