Connect cloud apps to data behind the firewall
WizGate lets your SaaS platform securely read and write on-premise SQL databases and Sage 200 — with no open ports, no VPN, and explicit write consent. Install one lightweight Windows connector and you're live in minutes.
No credit card · Free Starter tier · SQL Server, PostgreSQL, MySQL & Sage 200
> SELECT TOP 3 OrderId, CustomerName, Total FROM Orders ORDER BY Total DESC
| OrderId | CustomerName | Total |
|---|---|---|
| 10001 | Acme Corp | $84,200 |
| 10058 | BrightTech Ltd | $61,500 |
| 10023 | NextGen Inc | $55,900 |
3 rows · 42 ms · routed through on-prem connector
Connects the systems your business already runs on
Trusted as the integration layer behind
Reaching on-premise data used to mean opening holes
Most business data still lives behind a firewall — in SQL Server, Sage, an ERP. The classic ways to reach it from the cloud are slow, risky, and a hard “no” from security teams. WizGate flips the connection around.
✕ The old way
- —Open inbound firewall ports and NAT rules
- —Stand up and maintain a site-to-site VPN
- —Expose the database server to the public internet
- —Ship customer credentials to a third-party cloud
- —Wait weeks on the customer's IT team for change approval
✓ The WizGate way
- One outbound-only connection — nothing to open
- Runs as a Windows service, installed in minutes
- Database never leaves the private network
- Credentials stay on-prem, encrypted at rest
- Write access is off by default until explicitly granted
Everything you need to bridge cloud and on-prem
A production gateway — not a tunnel hack. Security, ERP depth and developer ergonomics in one install.
No open ports, ever
The connector makes a single outbound SignalR connection. Your firewall stays closed — no NAT rules, no port forwarding, no VPN.
Native Sage 200 integration
Read across 200+ Sage operations and post customers, invoices, receipts, GL journals, credit notes and inventory — through the real Pastel Evolution SDK.
Multi-database drivers
SQL Server, PostgreSQL, MySQL/MariaDB, Oracle and SQLite from one API. Schema discovery and parameterised queries included.
Write consent controls
Writes are off by default. The on-prem operator grants time-boxed write windows per data source — a hard stop against runaway automation.
Encrypted end to end
TLS in transit, AES-256-GCM for connection secrets at rest, and per-job payload encryption. Credentials never leave the customer's network.
Incremental data sync
Built-in manifest and watermark-based delta sync stream only what changed — feed a warehouse or BI tool without hammering the source.
Developer-first API
A clean REST API with OpenAPI/Swagger, idempotency keys, run-and-wait jobs, and a typed C# client so integrators never hand-write JSON.
Audit & observability
Per-tenant job metrics, deep health checks, and an append-only audit trail of every key, login and data-source change.
Multi-tenant by design
Isolated tenants, scoped API keys, per-site subscriptions and rate limits — run one connector or a fleet across every customer.
Built for how you actually ship
The same gateway powers integration platforms, ERP automation, analytics and internal tooling.
Reach your customers' on-prem data
Ship a cloud product that needs live data from behind the customer's firewall? Drop in WizGate instead of building — and maintaining — a bespoke agent for every deployment.
- One connector per customer site
- Scoped, revocable API keys
- Idempotent read & write jobs
Automate the accounting back-office
Post transactions, sync customers and suppliers, and pull live financials from Sage 200 Evolution — from any cloud app, without a developer sitting at the Sage server.
- 17 gated write operations
- 200+ read operations
- Consent-gated posting
Feed BI without a data pipeline
Point your warehouse or dashboard at WizGate and pull incremental deltas from on-prem SQL. No nightly VPN batch job, no exposing the production database.
- Watermark delta sync
- Read-only key isolation
- Query cost & rate limits
Query production from anywhere
Give ops and support secure, audited read access to on-prem databases through a browser — no jump box, no shared VPN credentials, full audit trail.
- Web SQL Studio
- Mobile monitoring
- Every query logged
Up and running in minutes
No server setup. No VPN. No inbound firewall changes.
Install the connector
Run WizGate-Setup.exe on any Windows machine with access to your database or Sage server. Sign in once — the connector registers itself and opens a secure outbound channel to the cloud.
Add your data sources
From the tray app, add SQL Server, PostgreSQL, MySQL or Sage connections. They sync to the cloud over an encrypted channel; credentials never leave the machine.
Call the API — or use the Studio
Your cloud app calls WizGate with an API key; jobs are routed to the connector, run locally, and returned. Or open the browser Studio to query and export directly.
Security your customer's IT team will actually approve
WizGate was built firewall-first. Every default leans toward least privilege, so the answer from security review is “yes” instead of “let's schedule a meeting.”
Outbound-only by design
The connector initiates every connection. There is no inbound listener to attack and no port to scan.
Two-factor authentication
Accounts can require a time-based one-time code (TOTP) at sign-in, with a per-account lockout that stops code brute-forcing. Enrol in one screen; it's enforced on every login.
Governed, allowlisted queries
Every query is validated and injection-guarded, and can be locked to an explicit table and schema allowlist. Stored procedures and writes pass additional gates.
Least-privilege writes
Read-only keys can never write. Write operations require a separate read-write key and a live, time-boxed consent grant from the on-prem operator.
Secrets stay on-prem
Database credentials live inside the customer's network. Anything stored in the cloud is encrypted with AES-256-GCM and redacted from API responses.
Scoped, revocable keys
Every API key is tenant-scoped, optionally locked to a single site, and revocable instantly. Rate limits throttle a leaked key before it can do damage.
Append-only audit trail
Sign-ins, key mints, data-source changes and every job are recorded to an append-only log — so you can answer "who touched what, when" and export it on Enterprise.
Tenant isolation
Data, sites and keys are partitioned per tenant. One customer can never see, query, or dispatch against another's connector.
Integrate in an afternoon
One API key and a few lines of code. WizGate handles the connector handshake, encryption, retries and the ERP plumbing so you can ship the feature, not the infrastructure.
REST + OpenAPI
A documented HTTP API with an interactive Swagger explorer. Generate a client in any language.
Run-and-wait jobs
Dispatch a query or Sage post and get the result in one round trip, or fire-and-poll for long work.
Idempotency keys
Safe retries on writes — the same key never posts a transaction twice.
Typed C# client
Login, query, run jobs and call Sage helpers with first-class types instead of raw JSON.
# Post a customer invoice into Sage 200 — through the firewall curl https://api.wizgate.app/api/jobs/run-wait \ -H "Authorization: Bearer wgk_live_..." \ -H "Idempotency-Key: inv-10042" \ -d '{ "siteId": "acme-hq", "operation": "customertransaction.post", "parameters": { "payload": "{...}" } }' # → { "status": "Completed", "resultJson": {...} }
Priced per site, not per surprise
One site is one connector install. Start free, add sites as you grow, and only pay for write-enabled ERP access where you need it.
Starter
Evaluate and build — one site, read-only.
- 1 site · 2 data sources
- SQL Server, PostgreSQL, MySQL, SQLite
- Read-only queries
- Web SQL Studio
- OpenAPI + scoped API keys
- Community support
Business
Governed reads and writes for a live integration.
- Everything in Starter, plus:
- Sage 200 read + write operations
- Time-boxed write-consent controls
- Incremental delta sync
- Encrypted secrets at rest
- Audit log + job metrics
- Mobile monitoring app
- Email support
Enterprise
For multi-site, compliance-driven deployments.
- Everything in Business, plus:
- Full Sage write surface + idempotency SLA
- SSO / SAML + IP allowlisting
- High-availability connectors
- Extended audit retention + export
- 99.9% uptime SLA + priority support
- White-label / OEM option
Building on WizGate for your own product? Ask about the white-label OEM plan for platforms.
Frequently asked questions
Do I need to open firewall ports or set up a VPN?+
No. The WizGate connector makes a single outbound HTTPS/WebSocket connection to the cloud. There is nothing inbound to open, forward, or expose. Most deployments are live without any change request to the customer's network team.
Where do my database credentials live?+
On the machine where the connector runs, inside the customer's network. Connection strings that WizGate stores in the cloud are encrypted at rest with AES-256-GCM and are never returned in plain text from the API.
Can a leaked API key write to or delete my data?+
A read-only key can never write. Write operations additionally require a read-write key and a live, time-boxed write-consent grant that the on-prem operator turns on explicitly. Keys are scoped, rate-limited, and revocable instantly.
Which systems does WizGate connect to?+
SQL Server, PostgreSQL, MySQL/MariaDB, Oracle and SQLite today, plus deep Sage 200 Evolution support via the Pastel Evolution SDK (200+ read operations and 17 gated write operations). More ERP and database drivers are on the roadmap.
What happens if the connector goes offline?+
The cloud API returns a clear "connector offline" response instead of hanging, and jobs are never silently lost. The connector reconnects automatically when the machine comes back, and idempotency keys make retries safe.
Can I run this across many customer sites?+
Yes. WizGate is multi-tenant with per-site subscriptions. Install one connector per site, issue a scoped key per integration, and manage the whole fleet from the dashboard.
Bridge your cloud and on-prem data today
Install the connector, add a data source, and make your first secure query in minutes. No credit card required on the free tier.