Heroku Postgres

To back up a Heroku Postgres database, Backup connects to it over the public internet like any other Postgres. Heroku runs stock PostgreSQL, so dumps and restores are unremarkable. The one Heroku-specific caveat matters a lot for a backup service: Heroku rotates database credentials, so the connection string you paste today can stop working later. Get that handled up front and the rest is routine.

Which connection string

Heroku exposes the primary connection as the DATABASE_URL config var. It looks like:

postgres://username:[email protected]:5432/database?sslmode=require

Host is an AWS hostname, port is the standard 5432, the connection is over IPv4, and the database is publicly reachable with valid credentials. The exception is Private and Shield-tier plans, which aren't reachable from outside their space and can't be backed up over the public internet.

Heroku requires SSL. Set SSL mode to require. Don't use verify-full: Heroku's standard databases present certificates a generic client can't chain to a public root, so hostname/CA verification fails. require encrypts the connection without demanding a verifiable certificate, which is what Heroku's own guidance recommends for third-party tools.

Find the connection details

From the CLI:

heroku config:get DATABASE_URL -a your-app

Or in the Heroku Dashboard: open the database from the Datastores tab and go to the Credentials tab.

To survive rotation, don't hand Backup the auto-managed DATABASE_URL credential. Create a stable, dedicated credential and use its URL:

heroku pg:credentials:create postgresql-example-1234 --name norcube_backup -a your-app
heroku pg:credentials:url postgresql-example-1234 --name norcube_backup -a your-app

Grant that role read-only access (Backup only ever reads):

GRANT USAGE ON SCHEMA public TO norcube_backup;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO norcube_backup;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO norcube_backup;

A dedicated credential persists until you destroy it, so it doesn't get rotated out from under Backup the way DATABASE_URL can. Paste its URL into Backup's credentials step with SSL mode require. If backups ever start failing on authentication, this is the first thing to re-check: pull a fresh URL and update the credentials.

Network access

Heroku Postgres is publicly reachable with valid credentials, so there's no IP allow list to configure for standard plans. Backup connects from a single static egress IP, 18.196.207.101, if you ever need to name it in your own network controls (see network access). Private and Shield-tier databases aren't reachable from outside Heroku's managed space and can't be backed up this way.

Restore tests

Every backup can be restore-tested: Backup replays the archive into a throwaway, vanilla PostgreSQL engine and confirms your data comes back. Heroku uses standard community extensions (postgis, pg_stat_statements, pgcrypto, and others), which install cleanly into a stock engine, so a restore test exercises your real schema and runs clean.

From there, it's the standard flow

Backup runs a full pg_dump on your schedule and writes the encrypted archive to storage you control. You can download any backup and restore it with standard Postgres tools, independent of Norcube. The full walkthrough is in connect a database.