Databases and file shares inside your own network have no cloud API to reach them. The connector solves that: an agent you run, which reaches out to TigerGate for work. Nothing listens. The agent polls outbound over HTTPS, so no inbound port is opened and no public address is needed. Egress to the platform on 443 is the only firewall change.

​
Where it runs is your decision

Both options use the same binary and the same configuration file.
A host or a container in the datacentre, beside the data.Database traffic stays on the LAN. You operate one more thing in the datacentre — patching, logging, monitoring.Choose it when the datacentre is where your operations already are.
Classification happens inside the connector process either way. Rows are read into memory there and only verdicts leave. Running in a cloud account means running in your account — it does not mean the data enters TigerGate.

​
What TigerGate learns about a site

Deliberately little, and worth being able to state to an auditor:
  • That the site exists, its name, and when it last checked in
  • How many targets it reports, and of what kind
  • The verdicts of the scans it ran
It never learns how to log in to any target. Credentials live only in your environment, which is why the connector’s configuration file cannot carry them even if you write them into it. A compromised platform therefore cannot use the connector fleet to harvest database passwords.

​
Set one up

1

Register the site

Register the site through the API, naming it after the NETWORK rather than a database — findings are attributed to the site, and one connector in Frankfurt and one in Virginia have to be tellable apart.
curl -X POST https://api.tigergate.dev/api/dspm-console/connectors \
  -H "Authorization: Bearer $TIGERGATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"site_name": "frankfurt-dc"}'
The response carries connector_id and a tgconn_ secret. The secret is returned once — it is hashed on save and cannot be recovered. If you lose it, register a new site and revoke the old one.
2

Describe the targets

List each database or share in connector.json: an id, a kind, a host, a port and the tiers it may be scanned at. A target registered for metadata only will refuse a content job even if the platform asks for one, so depth is enforced at the edge you control rather than only in our cloud.This file carries no passwords and is safe to commit.
3

Supply the credentials

One environment variable per target, named after the target id — uppercased, with non-alphanumerics as underscores:
# target id "prod-payments"
DSPM_TARGET_PROD_PAYMENTS_PASSWORD=…

# MongoDB and Kafka may carry a connection string instead
DSPM_TARGET_ANALYTICS_URI=mongodb://user:pw@host:27017

# authenticates without a password — IAM auth, Kerberos, a trusted socket
DSPM_TARGET_LOCAL_SOCKET_PASSWORD=-
The connector refuses to start when a target has no credential, and names the target. The single hyphen is how no password on purpose stays distinguishable from forgot to set it.
4

Probe before you schedule

dspm-connector --config connector.json --check
It connects to every target once and exits. Discovering that a target is unreachable during the first real scan means the console shows an error where you expected an inventory, and the firewall rule that caused it is harder to find later.
5

Run it

Deployment files for both options — a Compose file, a systemd unit, and Terraform for the cloud-hosted shape — ship in the connector bundle.

​
Supported targets

KindNotes
PostgreSQL, MySQL, MariaDBTABLESAMPLE on PostgreSQL; MySQL has no equivalent, so it samples with LIMIT.
SQL Server, Oracle, SAP HANARead-only user with SELECT on the schemas in scope.
MongoDB$sample, secondary-preferred reads, nested documents flattened.
Trino, Presto, HiveHive is reached through Trino rather than HiveServer2.
Apache KafkaSamples from the end of every partition, so the current schema is what gets seen.
SMB / CIFS sharesNTLM authentication. Recycle-bin and snapshot trees are skipped.
NFS v3Connector only. NFSv3’s AUTH_UNIX means the client asserts its own identity, which is a property of the protocol — exposing an export to our cloud would mean exposing it to the internet.
NFS v4 with Kerberos is not supported. It is a different security model rather than a variation on v3, and treating it as one would misrepresent what the connector authenticates as.

​
When a connector goes quiet

A connector that stopped is otherwise indistinguishable from a site with nothing to scan — and the second makes its stores look clean. The fleet view therefore shows when each site last checked in rather than a simple online marker, and a site that has never checked in is called out as never, not as offline.