Install one small package next to your database. It opens an outbound-only, mutually authenticated tunnel to Kimo, so you get live dashboards and Ask Kimo on production data without copying it anywhere, unless you choose to.
Only query results cross the tunnel. Kimo pushes each query down to your database through the bridge and gets aggregates back. Raw tables, credentials and your policy never leave your network.
Run the package on any host that can reach your database. It enrolls with a one-time token, generates its own key, and dials out. Your network team has nothing to open.
docker run -d --name kimo-bridge \ --restart unless-stopped --read-only --cap-drop ALL \ -e KIMO_BRIDGE_TOKEN=<your-enrollment-token> \ -v kimo-bridge-data:/var/lib/kimo-bridge \ ghcr.io/getkimo/bridge:1.4.2
Four steps, all on your side of the firewall. Kimo never needs a VPN, a public IP or your database password.
A dedicated database user with SELECT on the schemas you want to expose and a statement timeout. It is the control that holds even if everything else failed.
ALTER ROLE kimo_bridge SET statement_timeout = '30s';
Docker, Helm or a static binary on any host that can reach the database. It enrolls once, then authenticates with its own short-lived certificate.
enrolled · cert ttl=24h tunnel up · region=eu tls=1.3 · inbound=none
List tables and columns in kimo-bridge.yaml, add row filters and a minimum group size. Pick Bridge, Cloud or Hybrid mode per source.
default: deny min_group_size: 5 mode: bridge
Dashboards, alerts and Ask Kimo compile to SQL, push down through the tunnel and get aggregates back. Every query lands in the audit log.
pushdown → finance.mrr Σ 4 rows · 0.6 KB audit ✓ · 164 ms
There is no single right answer: residency, freshness and speed pull in different directions. Most teams run a mix.
| Dimension | Bridge Live pushdown | Cloud Synced to Kimo | Hybrid Rollups synced, detail live |
|---|---|---|---|
| Query latency | Your database’s speed, plus a few ms of tunnel overhead | Fastest: Kimo’s columnar engine, sub-second on large tables | Fast for aggregates; drill-downs at database speed |
| Freshness | Real time: every uncached query is live | Your sync cadence, from 5 minutes to daily | Rollups on sync cadence, details live |
| What Kimo stores | No raw rows. Optional result cache with a TTL you set, or off | Allowed tables, encrypted, in your workspace region | Pre-aggregated rollups only |
| Compliance & residency | Data never leaves your network or jurisdiction | Region-pinned (EU or US), covered by our DPA | Row-level detail stays on your servers |
| Load on your database | Every uncached query; point it at a replica | One incremental read per sync | Light: rollup syncs plus occasional drill-downs |
| Cost profile | No Kimo storage; compute runs on your side | Storage included per plan, scales with volume | Small storage footprint |
| Best for | Finance ledgers, product DBs with PII, regulated data | Events, marketing data, long history, heavy exploration | Board metrics with sensitive underlying detail |
Deciding? The Cloud, hybrid or bridge article walks through the trade-offs with real workloads.
Controls are layered: the bridge policy, the database role and your database’s own row security. One misconfiguration does not become a breach.
The bridge dials out to Kimo on TCP 443 and keeps the connection open. Queries ride back on it. No VPN, no public IP, no inbound firewall rule.
Both ends present certificates over TLS 1.3. The bridge’s certificate lives 24 hours, renews itself, and is bound to a key generated on your host.
The bridge connects as a dedicated read-only database user with a statement timeout, and its SQL parser rejects anything that is not a read.
Deny-by-default. Columns missing from kimo-bridge.yaml do not exist as far as Kimo knows. Kimo can ask for less than your policy allows, never more.
Predicates appended to every query on your side, plus a minimum group size that suppresses small aggregates before results leave.
Who asked, the exact SQL, the decision, rows and bytes returned. Hash-chained on your server and mirrored to Kimo’s activity log.
Revoke in the console or pause on the host. The tunnel drops within seconds, in-flight queries are cancelled, Kimo-side caches are purged.
The only listener is a local health and metrics endpoint bound to 127.0.0.1. Nothing to scan, nothing to expose, nothing to pentest from outside.
sources:- id: finance_pgtype: postgresdsn_file: /run/secrets/finance_dsnmode: bridgecache_ttl: 0spolicy:default: denytables:analytics.invoices:columns: [account_id, amount_cents,currency, paid_at]row_filters:- "region IN ('EU', 'UK')"min_group_size: 5limits: { timeout: 30s, rate: 10/s }
Ask Kimo in plain English. The heavy lifting happens next to your data; only the answer travels.
Question compiled to SQL against the governed finance model
Signed request pushed down the open outbound connection
Tables and columns allowed, EU row filter applied, groups ≥ 5
Executed as kimo_bridge (read-only); 1.2M rows scanned in place
4 aggregate rows returned, 0.6 KB. No raw rows leave
Entry appended and hash-chained on your server, mirrored to Kimo
“What was net revenue retention by plan last quarter?”
SELECT a.plan,
sum(i.amount_cents) FILTER (WHERE q = 'Q3')
/ sum(i.amount_cents) FILTER (WHERE q = 'Q2') AS nrr
FROM analytics.invoices i
JOIN analytics.accounts a ON a.id = i.account_id
GROUP BY a.planRelational databases, OLAP engines, warehouses on private endpoints, streams, search clusters and files on disk. One bridge can serve several sources.
The same package powers every Kimo product. Here is how teams use it.
Board-pack metrics such as ARR, burn multiple and net revenue retention are computed live against the ledger in your Frankfurt data center. Kimo receives the aggregates for the deck; the invoices never move.
Join signups, activation and paid conversion from your Postgres replica to GA4, ad spend and Search Console, without exporting a single user row. Funnels stay live; personal data stays home.
In sovereign deployments the Kimo control plane runs inside your enclave and bridges connect to it over the local network: still outbound-only, mutually authenticated and deny-by-default. Updates arrive as signed offline bundles; nothing phones home.
Something missing? The security model guide covers each control in depth, or ask us directly.
No. The bridge makes one outbound TLS connection to Kimo’s regional endpoint on TCP 443 and keeps it open. Kimo’s queries travel back over that connection. The only port the bridge listens on is a local health and metrics port you bind to 127.0.0.1.
Fifteen minutes from a clean host to your first live chart. Start with one read replica and one table; widen when your security team is happy.
