do not give direct access to the db