Network Access Controls

Fivetran never stores your customer data, but during a sync, data will flow temporarily through Fivetran servers. An Activations sync goes through the following steps to sync data from your source to your destination:

1. Identify changes in your activation source
2. Unload changes to cloud storage
3. Prepare data and loading into your activation destination
4. Report skipped records and feedback to your activation source

Fivetran will perform steps 2 and 3 using infrastructure in the region you've specified. For customers in need of finer-grained security, you may also provide your own blob storage where Fivetran will unload the changed records (the "diffs") for each sync. The diagram below showcases which steps in the Activations sync process occur in the region of your choice.

Secure Communication

All connections from the Fivetran Activations Service to your database are protected by TLS encryption - Fivetran will refuse to connect to a warehouse that does not support TLS.

Clouds and Regions

Fivetran never stores your data, but your selected region determines where data is processed during your Activations syncs.

Supported Clouds and Regions

¹Learn more in the Legacy Region IP Addresses section.

To view your organization's current region, navigate to the Settings > General page in your Fivetran account. Your region is listed under "Organization region".

Each workspace can have its own region, which defaults to the organization’s region. You can find the workspace region on the Settings > General page. Contact support to request to use another region by contacting Fivetran Support.

IP Addresses

Activations syncs data from your data sources to your destinations using a set of static IP addresses. To ensure that Activations can connect successfully to your sources or any self-hosted destinations, you must allowlist the following IP addresses in your firewall.

Legacy Region IP Addresses

Activations is migrating from our legacy IP addresses to the upcoming IP addresses listed in the following chart. If you currently use a legacy IP address, you must also grant access to the upcoming IP addresses in order to avoid disruption during migration.

All other regions use Fivetran's Standard IP addresses.

Connecting via SSH tunnel

Activations supports connecting to data warehouse source and destinations that are only accessible on private/internal networks via SSH tunneling. To do so, you'll need to provide an SSH host server that is visible on the public internet and can connect to the private warehouse, and you'll also need to be able to perform some basic admin actions on that server.

1. Create a new user account for Activations on the SSH host. This account is separate from the database user account and can have a different username.

2. When configuring a warehouse connection, enter the warehouse connection details, and then check the 'Use SSH Tunnel' option as shown below. Fill in the host and port of the SSH host machine along with the name of the user created in the previous step.

   

3. Once the connection is created, Fivetran will generate a key-pair for SSH authentication which is visible on the connect card.

   To install the key-pair, copy the public key in Activations to your clipboard and add it to the SSH authorized keys file on the SSH host for the user created in the first step. If, for example, this user is named census, the file should be located at /home/census/.ssh/authorized_keys. You may need to create this file if it doesn't exist.

   Note that the key-pair is unique for each Activations Warehouse connection. Even if you're reusing the same credentials, you'll need to add the new public keys.

   

4. If the SSH host restricts IP ranges that can connect to it, add the above Activations IPs to the allowlist.

With these steps complete, you should be able to complete a connection test, indicating that your tunneled connection is ready to be used in syncs.