A database on Invantive Cloud which lives inside your own network — a Microsoft SQL Server, a PostgreSQL, an on-premises application — is reached by Invantive Cloud over the internet. The firewall in front of it therefore has to admit the addresses Invantive Cloud connects from. This applies only to a database of your own. A cloud platform such as Exact Online is reached over its own public API and needs nothing opened. ## Which Addresses The addresses to admit are those of the Invantive Cloud data centre. They are published on the [forums](https://forums.invantive.com), and that publication is the authority: this page deliberately does not repeat the list, because an address list copied into a manual goes out of date silently and a firewall built on a stale list fails in a way which is hard to trace. Two things about the list are worth knowing before it is applied. - Invantive Cloud runs from a data centre under European jurisdiction. Addresses belonging to the earlier data centre under United States jurisdiction have been phased out and should be removed from a firewall rather than left in place: a rule admitting an address which is no longer ours admits whoever holds it now. - The list is short. A rule set holding a dozen or more Invantive addresses is out of date. ## Narrowing the Opening Admitting an address is not the same as exposing a database. Keep the opening as small as the work allows: - admit the addresses only towards the port of that one database, not towards the whole host; - require encryption on the connection, and a credential which exists for this purpose only; - give that credential the rights the queries actually need, which for a reporting database is reading and nothing else. The credential itself is held in Invantive Cloud with the data container; see [[Invantive Cloud/Menu/Data Containers|Data Containers]]. ## Checking A connection which fails after the firewall was opened is most often a rule which admits the address towards the wrong port, or a second firewall further along the path. The database screen in Invantive Cloud reports what the connection attempt returned, which distinguishes a refused connection from one which was accepted and then rejected the credential.