Connect Heroku Postgres to Excel, Sheets and AI

Nothing about the hostname says Heroku

Every other managed Postgres card here can recognise its own service by the address. This one cannot, and the difference is worth understanding.

• Heroku Postgres answers on bare EC2 names in the shape ec2-12-34-56-78.compute-1.amazonaws.com. There is no heroku in the hostname to match on.
• So the provider identity is recorded when you save from this card, rather than inferred from where you connected. That is what drives the badge and the icon afterwards.
• The practical consequence: a plain PostgreSQL connection you made earlier to a Heroku database will not pick up Heroku branding retroactively. Cards like Neon and Koyeb do exactly that from their hostnames — Heroku is the case where it cannot work.
• If you want the branding on an older connection, remake it from this card. Nothing about the data path changes; it is a labelling difference.

Self-signed certificates, and what encrypted means here

Heroku fronts its databases with its own certificates, which shapes what the agent can sensibly check.

• Use SSL is on by default and the connection is encrypted. The agent requires TLS rather than merely offering it.
• The certificate chain is not verified. Heroku's certificates are self-signed, so full verification would reject a perfectly correct connection — requiring encryption without validating the chain is the setting that matches the service.
• Read that as protection against anyone reading the traffic, not as proof of what you reached. It is the same posture the Railway card takes, and for the same reason.
• Leave the checkbox alone before your first test. On a connection that has not been saved yet, that checkbox is the only thing turning encryption on.

Rotation is a thing you will meet

Heroku changes database credentials during maintenance, and the agent stores what you gave it.

• When Heroku rotates, DATABASE_URL changes and the stored credentials stop working. The card says so on the way in rather than leaving you to discover it.
• Fixing it is re-pasting the current DATABASE_URL over the old one. Everything downstream — saved queries, schedules, shares — keeps working, because they point at the connection rather than at the credentials.
• There is no automatic sync. Query Streams does not read your Heroku config vars, so the re-paste is a manual step and worth knowing about before it surprises you.
• The pasted string itself is never stored. It is read once to fill the form and then dropped, so the password lives in one place rather than two.

-- Ordinary Postgres, read-only, over TLS
SELECT   c.name,
         COUNT(o.id)   AS orders,
         SUM(o.amount) AS revenue
FROM     public.customers AS c
JOIN     public.orders    AS o ON o.customer_id = c.id
WHERE    o.placed_at >= now() - interval '30 days'
GROUP BY c.name
ORDER BY revenue DESC;