ClickHouse/clickhouse-docs-embeddings huggingface dataset:
Beta and Experimental Features

`0`| [query\_plan\_optimize\_join\_order\_algorithm](/docs/operations/settings/settings#query_plan_optimize_join_order_algorithm) `greedy`| [allow\_experimental\_database\_paimon\_rest\_catalog](/docs/operations/settings/settings#allow_experimental_database_paimon_rest_catalog) `0`| [webassembly\_udf\_max\_fuel](/docs/operations/settings/settings#webassembly_udf_max_fuel) `100000`| [webassembly\_udf\_max\_memory](/docs/operations/settings/settings#webassembly_udf_max_memory) `134217728`| [webassembly\_udf\_max\_input\_block\_size](/docs/operations/settings/settings#webassembly_udf_max_input_block_size) `0`| [webassembly\_udf\_max\_instances](/docs/operations/settings/settings#webassembly_udf_max_instances) `32` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
Payment thresholds

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/reference/03_billing/05_payment-thresholds.md)

## Payment thresholds[​](#threshholds "Direct link to Payment thresholds")

If you are a pay as you go customer and your amount due in a billing period for ClickHouse Cloud reaches $1,000 USD or the equivalent value, your payment method configured to your organization will be automatically charged.

Tip

If you wish to adjust the default payment threshold amount, [contact support](/cdn-cgi/l/email-protection#24575154544b56506447484d474f4c4b5157410a474b49).

A failed charge will result in the suspension of your services after a 14 day grace period.
If you receive multiple invoices within a billing period, all are due upon receipt and must be paid to keep your ClickHouse Cloud organization [compliant](/docs/manage/clickhouse-cloud-billing-compliance).

If your automatic payment has a failed charge then it may be due to an issue with your configured credit card or that you have not set up an e-mandate on your credit card or your credit card is not compliant with the Reserve Bank of India (RBI) framework for processing of e-mandates for recurring online transactions.
In case your credit cards are not RBI-complaint, you must add a new payment method that is RBI-compliant or continue making manual payments until you are able to set up the e-mandate on your card.

In the example below, the Billing UI in cloud console is shown:

As you can see from the above example - there was a threshold invoice sent during the Feb 28-March 31 billing period and then there is another invoice sent during the same billing period for the remaining usage over $1,000.

## Payment threshold notifications[​](#threshholds-notifications "Direct link to Payment threshold notifications")

If your organization reaches 90% of the payment threshold and is on-track to exceed the payment threshold mid-period, the billing contact email associated with the organization will receive an email notification.
You will also receive an email notification as well as an invoice when you exceed the payment threshold.

Note

Payment threshold notifications are currently only supported for orgs being billed in arrears (PAYG)

- [Payment thresholds](#threshholds)- [Payment threshold notifications](#threshholds-notifications)

Was this page helpful?
Accessing GCS data securely

### Rotate HMAC keys regularly[​](#rotate-hmac-keys "Direct link to Rotate HMAC keys regularly")

Implement a key rotation schedule:

- Generate new HMAC keys
- Update ClickHouse configurations with new keys
- Verify functionality with new keys
- Delete old HMAC keys

Tip

Google Cloud doesn't enforce HMAC key expiration, so you must implement your own rotation policy.

### Monitor access with Cloud Audit Logs[​](#monitor-access "Direct link to Monitor access with Cloud Audit Logs")

Enable and monitor Cloud Audit Logs for Cloud Storage:

1. Navigate to IAM & Admin → Audit Logs
2. Find Cloud Storage in the list
3. Enable `Admin Read`, `Data Read`, and `Data Write logs`
4. Use these logs to monitor access patterns and detect anomalies

- [Introduction](#introduction)- [Prerequisites](#prerequisites)- [Setup](#setup)
      - [Create a Google Cloud service account](#create-gcs-account)- [Grant bucket access to the service account](#grant-bucket-access-to-service-account)- [Generate HMAC keys for the service account](#generate-hmac-keys-for-service-account)- [Use HMAC keys with ClickHouse Cloud](#use-hmac-keys-with-clickhouse-cloud)- [HMAC authentication in ClickPipes for GCS](#hmac-authentication-clickpipes-for-gcs)- [Best practices](#best-practices)
            - [Use separate service accounts for different environments](#separate-service-accounts)- [Apply least-privilege access](#apply-least-privilege-access)- [Rotate HMAC keys regularly](#rotate-hmac-keys)- [Monitor access with Cloud Audit Logs](#monitor-access)

Was this page helpful?
a semantic layer](/docs/use-cases/AI_ML/AIChat/semantic-layer) Guide to using AGENTS.md to provide custom business logic and data-specific instructions to the ClickHouse Assistant chat agent|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | [Overview](/docs/cloud/reference/byoc/overview) Deploy ClickHouse on your own cloud infrastructure|  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | [PCI onboarding](/docs/cloud/security/compliance/pci-onboarding) Learn more about how to onboard to PCI compliant services|  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | [Query API endpoints](/docs/cloud/get-started/query-endpoints) Easily spin up REST API endpoints from your saved queries|  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | [SAML SSO removal](/docs/cloud/security/saml-removal) How to remove SAML SSO with ClickHouse Cloud|  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | | [SAML SSO setup](/docs/cloud/security/saml-setup) How to set up SAML SSO with ClickHouse Cloud|  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | | [Setting IP filters](/docs/cloud/security/setting-ip-filters) This page explains how to set IP filters in ClickHouse Cloud to control access to ClickHouse services.|  |  |  |  | | --- | --- | --- | --- | | [Standard onboarding](/docs/cloud/reference/byoc/onboarding/standard) Deploy ClickHouse on your own cloud infrastructure|  |  | | --- | --- | | [Usage limits](/docs/cloud/bestpractices/usage-limits) Describes the recommended usage limits in ClickHouse Cloud | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
Configuring SQL console role assignments

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/guides/security/01_cloud_access_management/03_manage-sql-console-role-assignments.md)

Note

This setting is deprecated and has been replaced with a new setting on the role creation screen in organizations that have migrated to custom roles. For more information, see [Manage cloud users](/docs/cloud/security/manage-cloud-users).

> This guide shows you how to configure SQL console role assignments, which
> determine console-wide access permissions and the features that a user can
> access within Cloud console.

Access service settings

### Access service settings[​](#access-service-settings "Direct link to Access service settings")

From the services page, click the menu in the top right corner of the service for which you want to adjust SQL console access settings.

Select `settings` from the popup menu.

Adjust SQL console access

### Adjust SQL console access[​](#adjust-sql-console-access "Direct link to Adjust SQL console access")

Under the "Security" section, find the "SQL console access" area:

Update the settings for Service Admin

### Update the settings for Service Admin[​](#update-settings-for-service-admin "Direct link to Update the settings for Service Admin")

Select the drop-down menu for Service Admin to change the access control settings for Service Admin roles:

You can choose from the following roles:

|  |  |  |  |
| --- | --- | --- | --- |
| Role|  |  |  | | --- | --- | --- | | `No access`| `Read only`| `Full access` | | | |

Update the settings for Service Read Only

### Update the settings for Service Read Only[​](#update-settings-for-service-read-only "Direct link to Update the settings for Service Read Only")

Select the drop-down menu for Service Read Only to change the access control settings for Service Read Only roles:

You can choose from the following roles:

|  |  |  |  |
| --- | --- | --- | --- |
| Role|  |  |  | | --- | --- | --- | | `No access`| `Read only`| `Full access` | | | |

Review users with access

### Review users with access[​](#review-users-with-access "Direct link to Review users with access")

An overview of users for the service can be viewed by selecting the user count:

A tab will open to the right of the page showing the total number of users and their roles:

- [Access service settings](#access-service-settings)- [Adjust SQL console access](#adjust-sql-console-access)- [Update the settings for Service Admin](#update-settings-for-service-admin)- [Update the settings for Service Read Only](#update-settings-for-service-read-only)- [Review users with access](#review-users-with-access)

Was this page helpful?
ClickHouse Cloud tiers

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/features/01_cloud_tiers.md)

There are several tiers available in ClickHouse Cloud.
Tiers are assigned at any organizational level. Services within an organization therefore belong to the same tier.
This page discusses which tiers are right for your specific use case.

**Summary of cloud tiers:**
ClickHouse Cloud tiers

## Basic[​](#basic "Direct link to Basic")

- Cost-effective option that supports single-replica deployments.
- Ideal for departmental use cases with smaller data volumes that don't have hard reliability guarantees.

Note

Services in the basic tier are meant to be fixed in size and don't allow scaling, both automatic and manual.
You can upgrade to the Scale or Enterprise tier to scale their services.

## Scale[​](#scale "Direct link to Scale")

Designed for workloads requiring enhanced SLAs (2+ replica deployments), scalability, and advanced security.

- Offers support for features such as:
  - [Private networking support](/docs/cloud/security/connectivity/private-networking).
  - [Compute-compute separation](/docs/cloud/reference/warehouses#what-is-compute-compute-separation).
  - [Flexible scaling](/docs/manage/scaling) options (scale up/down, in/out).
  - [Configurable backups](/docs/cloud/manage/backups/configurable-backups)

## Enterprise[​](#enterprise "Direct link to Enterprise")

Caters to large-scale, mission critical deployments that have stringent security and compliance needs.

- Everything in Scale, **plus**
- Flexible scaling: standard profiles (`1:4 vCPU:memory ratio`), as well as `HighMemory (1:8 ratio)` custom profiles.
- Provides the highest levels of performance and resilience guarantees.
- Supports enterprise-grade security:
  - Single Sign On (SSO)
  - Enhanced Encryption: For AWS and GCP services. Services are encrypted by our key by default and can be rotated to their key to enable Customer Managed Encryption Keys (CMEK).
- Allows Scheduled upgrades: you can select the day of the week/time window for upgrades, both database and cloud releases.
- Offers [HIPAA](/docs/cloud/security/compliance-overview#hipaa-since-2024) and PCI compliance.
- Exports Backups to the user's account.

Note

Single replica services across all three tiers are meant to be fixed in size (`8 GiB`, `12 GiB`)

## Upgrading to a different tier[​](#upgrading-to-a-different-tier "Direct link to Upgrading to a different tier")

You can always upgrade from Basic to Scale or from Scale to Enterprise. Downgrading tiers will require disabling premium features.

---

If you have any questions about service types, please see the [pricing page](https://clickhouse.com/pricing) or contact [[email protected]](/cdn-cgi/l/email-protection#02717772726d707642616e6b61696a6d7771672c616d6f).

- [Basic](#basic)- [Scale](#scale)- [Enterprise](#enterprise)- [Upgrading to a different tier](#upgrading-to-a-different-tier)

Was this page helpful?
Service uptime

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/reference/06_service-uptime.md)

## Uptime alerts[​](#uptime-alerts "Direct link to Uptime alerts")

You can now see regional uptimes on the [status page](https://status.clickhouse.com/) and subscribe to alerts on service disruptions.

## SLA[​](#sla "Direct link to SLA")

We also offer Service Level Agreements for select committed spend contracts. Please contact us at [[email protected]](/cdn-cgi/l/email-protection#2457454841576447484d474f4c4b5157410a474b49) to learn more about our SLA policy.

- [Uptime alerts](#uptime-alerts)- [SLA](#sla)

Was this page helpful?
Validate data correctness after migration

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/managed-postgres/migrations/data-validation.md)

Private preview

## Comparing counts of all tables[​](#data-validation-counts "Direct link to Comparing counts of all tables")

A simple way to validate the correctness of your data after migration is to compare the counts of all tables in the source and target databases. You can do this by running the following query on both databases:

```
SELECT table_name, 
       (xpath('/row/cnt/text()', xml_count))[1]::text::bigint AS row_count
FROM (
  SELECT table_name, 
         query_to_xml('SELECT count(*) AS cnt FROM ' || quote_ident(table_name), false, true, '') AS xml_count
  FROM information_schema.tables
  WHERE table_schema = 'public'
) t
ORDER BY table_name;
```

- [Comparing counts of all tables](#data-validation-counts)

Was this page helpful?
Cloud access management

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/guides/security/01_cloud_access_management/index.md)

This section contains detailed guides for managing access in ClickHouse Cloud

|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Page Description|  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | [Manage my account](/docs/cloud/security/manage-my-account) Describes how to manage your own user account, including passwords, MFA and account recovery|  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | [Manage cloud users](/docs/cloud/security/manage-cloud-users) An administrator's guide to managing user access in the ClickHouse Cloud console|  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | [Manage custom roles](/docs/cloud/guides/security/manage-custom-roles) An administrator's guide to creating and managing custom roles|  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | | [Manage SQL console role assignments](/docs/cloud/guides/sql-console/manage-sql-console-role-assignments) An administrator's guide to managing SQL console users|  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | | [Manage database users](/docs/cloud/security/manage-database-users) An administrator's guide to managing database users|  |  |  |  | | --- | --- | --- | --- | | [SAML SSO setup](/docs/cloud/security/saml-setup) An administrator's guide to configuring and troubleshooting SAML integrations|  |  | | --- | --- | | [Common access management queries](/docs/cloud/security/common-access-management-queries) Detailed examples of setting up and verifying database permissions | | | | | | | | | | | | | | | |

Was this page helpful?
Data encryption

### Backup and restore[​](#backup-and-restore "Direct link to Backup and restore")

Backups are encrypted using the same key as the associated service. When you restore an encrypted backup, it creates an encrypted instance that uses the same KMS key as the original instance. If needed, you can rotate the KMS key after restoration; see [Key Rotation](#key-rotation) for more details.

## Performance[​](#performance "Direct link to Performance")

Database encryption leverages ClickHouse's built-in [Virtual File System for Data Encryption feature](/docs/operations/storing-data#encrypted-virtual-file-system) to encrypt and protect your data. The algorithm in use for this feature is `AES_256_CTR`, which is expected to have a performance penalty of 5-15% depending on the workload:

- [Storage level encryption](#storage-encryption)- [Database level encryption](#database-encryption)
    - [Transparent Data Encryption (TDE)](#transparent-data-encryption-tde)- [Customer Managed Encryption Keys (CMEK)](#customer-managed-encryption-keys-cmek)- [Backup and restore](#backup-and-restore)- [Performance](#performance)

Was this page helpful?
Manage database users

Run the following queries to get a list of all grants in the database.

```
SELECT grants.user_name,
grants.role_name,
users.name AS role_member,
grants.access_type,
grants.database,
grants.table
FROM system.grants LEFT OUTER JOIN system.role_grants ON grants.role_name = role_grants.granted_role_name
LEFT OUTER JOIN system.users ON role_grants.user_name = users.name

UNION ALL

SELECT grants.user_name,
grants.role_name,
role_grants.role_name AS role_member,
grants.access_type,
grants.database,
grants.table
FROM system.role_grants LEFT OUTER JOIN system.grants ON role_grants.granted_role_name = grants.role_name
WHERE role_grants.user_name is null;
```

Associate grant list to Console users with access to SQL console

#### Associate grant list to Console users with access to SQL console[​](#associate-grant-list-to-console-users-with-access-to-sql-console "Direct link to Associate grant list to Console users with access to SQL console")

Associate this list with Console users that have access to SQL console.

a. Go to the Console.

b. Select the relevant service.

c. Select Settings on the left.

d. Scroll to the SQL console access section.

e. Click the link for the number of users with access to the database `There are # users with access to this service.` to see the user listing.

## Warehouse users[​](#warehouse-users "Direct link to Warehouse users")

Warehouse users are shared across services within the same warehouse. For more information, review [warehouse access controls](/docs/cloud/reference/warehouses#access-controls).

- [SQL console passwordless authentication](#sql-console-passwordless-authentication)- [SQL console users and roles](#sql-console-users-and-roles)- [Database authentication](#database-authentication)
      - [Database user ID and password](#database-user-id--password)- [Database user with secure shell (SSH) authentication](#database-ssh)- [Database permissions](#database-permissions)
        - [Initial settings](#initial-settings)- [Database access listings with SQL console users](#database-access-listings-with-sql-console-users)- [Warehouse users](#warehouse-users)

Was this page helpful?
Backport System

### GitHub API Cache[​](#github-api-cache "Direct link to GitHub API Cache")

`GitHubCache` (from `cache_utils.py`) persists the PyGithub object cache to S3, reducing API calls across hourly runs. The cache is downloaded at the start and uploaded at the end of each run.

### Error Handling[​](#error-handling "Direct link to Error Handling")

Errors during individual PR processing are caught and logged but do not stop the run. After all PRs are processed, if any errors occurred, a `BackportException` is raised. In CI, this triggers a notification via `CIBuddy` to the team chat.

- [Release Model](#release-model)- [Backport Policy](#backport-policy)- [Backport Tool](#backport-tool)
      - [Testing](#testing)- [Active Release Branches](#active-release-branches)- [Implementation](#implementation)
          - [Overview](#overview)- [Labels](#labels)- [Branch and PR Naming](#branch-and-pr-naming)- [Step-by-Step Process](#step-by-step-process)- [Stale Cherry-pick PR Handling](#stale-cherry-pick-pr-handling)- [Conflict Resolution](#conflict-resolution)- [CI for Backport PRs](#ci-for-backport-prs)- [Authentication](#authentication)- [GitHub API Cache](#github-api-cache)- [Error Handling](#error-handling)

Was this page helpful?
Full-text search with text indexes

## Related content[​](#related-content "Direct link to Related content")

- Presentation: <https://github.com/ClickHouse/clickhouse-presentations/blob/master/2025-tumuchdata-munich/ClickHouse_%20full-text%20search%20-%2011.11.2025%20Munich%20Database%20Meetup.pdf>
- Presentation: <https://presentations.clickhouse.com/2026-fosdem-inverted-index/Inverted_indexes_the_what_the_why_the_how.pdf>

**Outdated material**

- Blog: [Introducing Inverted Indices in ClickHouse](https://clickhouse.com/blog/clickhouse-search-with-inverted-indices)
- Blog: [Inside ClickHouse full-text search: fast, native, and columnar](https://clickhouse.com/blog/clickhouse-full-text-search)
- Video: [Full-Text Indices: Design and Experiments](https://www.youtube.com/watch?v=O_MnyUkrIq8)

- [Creating a Text Index](#creating-a-text-index)- [Using a Text Index](#using-a-text-index)
    - [Supported functions](#functions-support)- [Indexing Array(String) columns](#text-index-example-array)- [Indexing Map columns](#text-index-example-map)- [Indexing JSON columns](#text-index-example-json)- [Performance Tuning](#performance-tuning)
      - [Direct read](#direct-read)- [LIKE/ILIKE queries](#like-ilike-queries-perf)- [Caching](#caching)- [Limitations](#limitations)- [Text Indexes vs Bloom-Filter-Based Indexes](#text-index-vs-bloom-filter-indexes)- [Implementation Details](#implementation)- [Example: Hackernews dataset](#hacker-news-dataset)
              - [1. Using `hasToken`](#using-hasToken)- [2. Using `hasAnyTokens`](#using-hasAnyTokens)- [3. Using `hasAllTokens`](#using-hasAllTokens)- [4. Compound search: OR, AND, NOT, ...](#compound-search)- [Related content](#related-content)

Was this page helpful?