---
title: "Trusted Language Extensions for Postgres"
description: "Cloud Postgres providers often restrict extension installation until extensions are vetted, leaving some useful functionality unavailable on hosted databases. A Trusted Language Extension (TLE) is a Postgres extension written in a trusted language, allowing installation through pg_tle without placing code on the server filesystem. The source explains that conventional extensions may include SQL and functions implemented in languages such as C, while trusted languages follow PostgreSQL's security rules and cannot access raw process memory or system functions. AWS developed pg_tle, and collaboration with Supabase makes it available on Supabase and Amazon RDS for PostgreSQL 14.5 and higher; the dbdev registry can install packages such as langchain-embedding_search through SQL migrations. TLEs are presented as a way to distribute and iterate on trusted extensions without waiting for each cloud provider to preinstall them."
---

# Trusted Language Extensions for Postgres

[Supabase](https://yomu.fyi/company/supabase) · michel,daltjoh-aws · Apr 14, 2023

**Type:** Explainer

## Summary

Cloud Postgres providers often restrict extension installation until extensions are vetted, leaving some useful functionality unavailable on hosted databases. A Trusted Language Extension (TLE) is a Postgres extension written in a trusted language, allowing installation through pg\_tle without placing code on the server filesystem. The source explains that conventional extensions may include SQL and functions implemented in languages such as C, while trusted languages follow PostgreSQL's security rules and cannot access raw process memory or system functions. AWS developed pg\_tle, and collaboration with Supabase makes it available on Supabase and Amazon RDS for PostgreSQL 14.5 and higher; the dbdev registry can install packages such as langchain-embedding\_search through SQL migrations. TLEs are presented as a way to distribute and iterate on trusted extensions without waiting for each cloud provider to preinstall them.

## Context

Cloud Postgres providers restrict extensions that require filesystem access or can interact with Postgres internals, and new extensions are rarely adopted quickly because they must be rigorously vetted. The source says this limits developers' ability to create, install, evaluate, and iterate on useful extensions.

## Approach / What changed

The RDS team created pg\_tle, which enables Postgres extensions written in trusted languages to be installed from a database client with pgtle.install\_extension() rather than from the server filesystem. Supabase and AWS provide pg\_tle, and the dbdev package registry can install TLE packages in database migrations using SQL.

## Takeaways

- TLEs must be written in trusted languages such as SQL, pl/pgsql, plv8, pl/perl, or pl/tcl; extensions written in C cannot use this model.
- pg\_tle is available on new Supabase projects and on Amazon RDS for PostgreSQL 14.5 and higher.
- The dbdev registry supports installing extensions such as langchain-embedding\_search from SQL migrations, using the dbdev.install function.

**Tags:** [AWS](https://yomu.fyi/topic/aws), [Developer Experience](https://yomu.fyi/topic/developer-experience), [Open Source](https://yomu.fyi/topic/open-source)

- Source: [Supabase](https://supabase.com/blog/pg-tle)
- Source URL: https://supabase.com/blog/pg-tle
- Ingested by Yomu: 2026-08-29T01:17:29.894Z

[Read original post](https://supabase.com/blog/pg-tle)