Databases & Vector

Real Postgres, nothing to operate

PostgreSQL 15 or 16 you can reach with psql or your ORM, sized across six compute tiers, with row-level security that already knows who your users are.

Start building

databases

$volcano cloud databases create app --region aws-us-east-1 --pg-version 16✓ app active · postgresql 16 · volcano-db-xs$volcano cloud databases migration up --all -d app001_schema.sql  002_policies.sql   ok$volcano cloud databases get app --show-connection-stringpostgresql://…@database.volcano.dev:5432/app?sslmode=require# the same string works from psql, your ORM, or the SDK

Overview

Starting a database is easy. Keeping one is not.

The work isn't provisioning. It's sizing the instance, putting a pooler in front of it, keeping the connection string out of the browser, and writing an authorization layer because Postgres has no idea who your users are.

Volcano hands you ordinary PostgreSQL 15 or 16 on compute that scales with load inside the tier you pick. It stays an ordinary Postgres endpoint you can point psql or an ORM at, and Volcano establishes who is asking before your first statement runs — so auth.uid() works inside your policies and the database itself decides which rows a request can see.

Access

Two ways in, one set of rules

Query from the browser with the SDK, or open a connection on port 5432 with psql, your ORM or any Postgres driver — it is a normal Postgres endpoint over TLS, not an HTTP API pretending to be one. Whichever way a query arrives, Volcano establishes who is asking before your first statement, so your policies decide what comes back.

psql, Prisma, Sequelize, TypeORM or any driver
The SDK queries from the browser, with no API tier
One string, three access levels: admin, a given user, anonymous

select count(*) from notes

# one query, three callers, one policyadmin · migrations       → 1284signed-in user 8f1c…     →   12anonymous visitor        →    0the policy is the only thing deciding

Scale

Size each database for its job

Six tiers from volcano-db-xs to volcano-db-2xl, with compute that moves with load inside the tier you choose. Staging, a load test and production can each be sized for what they actually do instead of sharing one instance.

Six tiers, volcano-db-xs through volcano-db-2xl
Compute moves with load inside the tier
A database per environment, branch or tenant

The Volcano dashboard listing databases with their region, Postgres version and tier

Retrieval

Vectors beside the rows they describe

Run CREATE EXTENSION vector and embeddings become a column. A similarity search can filter by tenant and permission in the same statement, which a separate vector store cannot do for you.

pgvector installs with one statement
Ranking and authorization in one query
Nothing to sync after a write

one query, filtered and ranked

$create extension if not exists vector;$alter table chunks add column embedding vector(1536);# retrieval and authorization in a single statementselect id, content from chunks where tenant_id = auth.uid() order by embedding <=> $1 limit 8;

Capabilities

What every database comes with

PostgreSQL 15 or 16

Pick the major version when you create the database. 16 is the default.

Autoscaling compute

Six tiers from volcano-db-xs to volcano-db-2xl. Compute moves with load inside the tier.

Migrations in plain SQL

Files under volcano/migrations, applied in order by volcano cloud databases migration up.

Row-level security

auth.uid(), auth.email(), auth.role() and auth.is_authenticated() are installed and ready to reference in policies.

Direct connections

Port 5432 over TLS for psql, your ORM, or anything that speaks the Postgres wire protocol.

Extensions

CREATE EXTENSION works, including vector, uuid-ossp and pg_trgm.

Code

Create it, protect it, query it

SQL

create table if not exists notes (
  id          uuid primary key default gen_random_uuid(),
  user_id     uuid not null,
  title       text not null,
  archived    boolean not null default false,
  updated_at  timestamptz not null default now()
);

create index if not exists notes_user_updated on notes (user_id, updated_at desc);

alter table notes enable row level security;

-- The owner reads and writes their own rows. Nothing else does, including
-- code that forgets to add "where user_id = ...".
create policy notes_owner_read on notes
  for select to authenticated using (user_id = auth.uid());

create policy notes_owner_write on notes
  for insert to authenticated with check (user_id = auth.uid());

create policy notes_owner_update on notes
  for update to authenticated
  using (user_id = auth.uid()) with check (user_id = auth.uid());

Use cases

What people build on it

no api tier

# what you would have writtenGET  /api/notes        → handler → auth check → sqlPOST /api/notes        → handler → auth check → sql# what you write instead$volcano.from('notes').select('*')✓ policy enforced in Postgres, not in a handler

Platform

Works with the rest of Volcano

Authentication

Identity in your policies
auth.uid() and auth.role() come from the session Volcano issued, so policies are written against real users.

Realtime

Streams from your tables
Subscribe to INSERT, UPDATE and DELETE on any table. The read policy filters the stream per subscriber.

Functions and agents

Query from a function
Functions get DATABASE_URL and the caller's identity, so they query as that user or as an admin.

Next.js frontends

Server component queries
The same client works in a server component, a route handler, or the browser.

Frequently asked questions

Read the docs

Is this real PostgreSQL?

Yes — PostgreSQL 15 or 16, chosen when you create the database, with 16 as the default. It listens on 5432 over TLS, so psql, pg_dump, Prisma, Sequelize, TypeORM and any driver that speaks the Postgres wire protocol connect to it normally. Extensions install with CREATE EXTENSION.

How can the browser query the database safely?

Because Postgres enforces the rules, not your code. Volcano establishes the caller's identity on the connection before the first statement runs, so auth.uid() returns the signed-in user and your policies filter every query — including one written by a client trying to read more than it should.

Can I point my ORM at it?

Yes. It is an ordinary Postgres endpoint on 5432 over TLS, so Prisma, Sequelize, TypeORM and any driver connect with the string from volcano cloud databases get --show-connection-string. Volcano's own migrations are plain .sql files, and you can run your tool's migrations against the same connection instead.

How do migrations work?

As .sql files under volcano/migrations, applied in alphabetical order by volcano cloud databases migration up. There is no tracking table, so write migrations that are safe to run twice.

Can I use pgvector?

Yes. Run CREATE EXTENSION IF NOT EXISTS vector in a migration and embeddings become a normal column you can index and join against.

Can I run a database per branch or environment?

Yes. Creating one is a single command and deleting it is another, so a database for staging, for a load test or for a branch you are about to throw away is a reasonable thing to do. How many each plan includes is on the pricing page.

Ready to create your first database?

Build, deploy, and scale on Volcano's global platform — free to start, with no infrastructure to manage.

Start building free

Checkout more features

← Next.js Frontends

File Storage →