Supabase

Overview

Supabase is an open-source Postgres development platform: every hosted project gets a dedicated PostgreSQL database plus Auth, object Storage, Realtime, Deno Edge Functions, auto-generated REST/GraphQL-style APIs, and pgvector for embeddings. Teams use it as a Firebase-class backend when they want SQL, joins, constraints, and a portable data layer rather than a proprietary document store.

The company (YC S20; co-founded by Paul Copplestone and Ant Wilson) positions itself as infrastructure for builders and AI coding agents. In its June 2026 Series F post, Supabase reported a $500M raise at a $10B pre-money valuation (about $10.5B post-money per TechCrunch/CNBC), nearly 10 million developers on the platform, and that more than 60% of new databases are launched via AI tools. The monorepo on GitHub sits around 100k+ stars. The stack is self-hostable via Docker and the CLI; cloud remains the default for most product teams.

Primary job: ship a production backend—database + auth + files + realtime—without assembling Postgres, PostgREST, Auth, and storage yourself. Secondary job: stay on standard Postgres so you can dump, migrate, query with normal SQL tools, and avoid pure lock-in on the data model.

Official links: supabase.com · pricing · docs · status · security.

Key features

• Managed PostgreSQL per project — Dedicated Postgres with connection pooling (Supavisor), extensions (pgvector, PostGIS, pg_cron, pg_graphql, and many others), Studio UI, and standard SQL tooling. You are not limited to a proprietary query API.
• Auth — Email/password, magic links, social OAuth (Google, GitHub, Apple, and more), phone MFA as a paid add-on path, anonymous sign-ins, custom SMTP, JWTs, auth hooks, leaked-password protection on paid tiers. Authorization is primarily Postgres RLS bound to auth claims—not a separate Firebase-style rules language.
• Auto APIs — PostgREST-style REST from your schema; GraphQL options via pg_graphql. Client libraries for JavaScript/TypeScript, Flutter/Dart, Python, Swift, Kotlin, and more.
• Storage — S3-compatible object storage with buckets, policy-based access, signed URLs, Basic CDN on Free / Smart CDN on paid, and optional image transformations (metered after a small origin quota).
• Realtime — Postgres Changes (listen to INSERT/UPDATE/DELETE), plus broadcast and presence channels for collaborative UIs. Concurrent connections and message volume are plan-limited with overages on Pro/Team.
• Edge Functions — Deno-based serverless functions for webhooks, light APIs, and secrets that should not live in the client. Invocations are included then metered ($2 per additional 1M on Pro/Team list rates).
• AI / vectors — pgvector in the same database as transactional data so RAG and semantic search can join business tables without a second system of record.
• Developer workflow — Local stack via Supabase CLI + Docker, migrations, seeding, database branching (usage-priced per branch-hour), Studio for tables/policies/logs, Management API for platform use cases.
• Compliance packaging — SOC 2 Type 2 and ISO 27001 packaged for Team+ (reports on the dashboard for eligible orgs); HIPAA BAA available as a paid add-on path on Team/Enterprise under a shared-responsibility model; encryption at rest (AES-256) and TLS in transit.
• Self-hosting — Full open-source stack (Auth, Realtime, Storage, Studio, Postgres) runnable with Docker. Cloud ops convenience, multi-project Studio UX, and some managed features still differ from self-host burden.

Pricing

Supabase uses organization-based billing. You pick a plan for the org (Free, Pro, Team, Enterprise). Each project runs on its own compute size; compute is billed separately. Pro and Team include $10/month compute credits (covers one Micro instance). Unlimited API requests are listed on all tiers. Always re-check supabase.com/pricing—usage rates and quotas change; pricing is described as still in beta on the official page.

Plan	From	Highlights (published list prices)
Free	$0/mo	2 active projects; 500 MB DB (shared CPU, 500 MB RAM); 1 GB file storage; 50K MAU; 5 GB egress; 500K Edge Function invocations; 200 Realtime peak connections; community support. Projects pause after ~1 week of inactivity. No automatic daily backups.
Pro	$25/org/mo	100K MAU then ~$0.00325/MAU; 8 GB disk included then ~$0.125/GB; 250 GB egress then ~$0.09/GB; 100 GB storage then ~$0.0213/GB; 2M function invocations then ~$2/M; daily backups 7 days; 7-day logs; email support; spend caps on by default.
Team	$599/mo	Pro-class usage packaging plus SOC2/ISO packaging, longer retention (e.g. 14-day backups, 28-day logs), SSO/dashboard controls, priority support/SLAs, HIPAA as paid add-on, AWS PrivateLink, richer access roles (read-only / project-scoped).
Enterprise	Custom	Uptime SLAs, designated support, BYO cloud options, custom security questionnaires, 24×7 premium support paths, volume discounts.

Compute (per project, illustrative list prices): Micro ~$10/mo (shared 2-core ARM, 1 GB RAM; ~60 direct / ~200 pooler connections) through Large ~$110 (dedicated 8 GB), XL ~$210, up to 16XL ~$3,730/mo and custom. A Pro org with two Micro projects is roughly $25 + $10 + $10 − $10 credits ≈ $35/mo before overages—not $25 all-in forever.

Common add-ons (list prices): Point-in-time recovery (~$100/mo per 7 days retention), custom domains (~$10/domain/project/mo), advanced phone MFA (~$75 first project then ~$10), SAML/SSO MAUs after a small included block, log drains (~$60/drain + event/egress meters), image transformations after free origin quota, database branching ~$0.01344 per branch-hour.

Limits & gotchas

• Free-tier pause — After roughly one week without activity, free projects pause. Community workarounds (cron pings, GitHub Actions) exist; they do not make Free a production SLA. No auto daily backups on Free means pause + human error can cost data.
• RLS is the security model — Tables without correct policies can be world-readable via the anon key. HN and Reddit repeatedly call RLS a footgun for “vibe-coded” apps that generate open tables. Production requires deliberate policies, tests, and least-privilege service roles. Official docs include hardening and production checklists for a reason.
• Connection & compute ceilings — Small instances have limited direct and pooler connections (e.g. Micro: tens of direct connections). Exhausted pools look like “Supabase is slow” when the issue is sizing or connection churn from serverless frontends. Use the pooler and right-size compute.
• Org billing surprise — Multiple environments = multiple projects = stacked compute. Disk, egress, MAU, Realtime messages, and function invocations all have overage rates once caps are lifted.
• Compliance costs real money — SOC 2 report access and HIPAA packaging sit on Team-class pricing (and add-ons), not Free/Pro marketing slides. Budget ~$599/mo floor when enterprise buyers demand attestations; BAA is not automatic on Pro.
• Edge Functions ≠ full cloud event mesh — Deno edge workers suit auth hooks, webhooks, and light glue code. Community threads question heavy concurrent API workloads; long jobs, complex VPC integrations, or multi-minute batch work may belong on a general cloud runtime or queues.
• Offline mobile is not Firebase-class history — Clients have improved, but teams that need battle-tested offline-first sync often still compare carefully with Firebase on Flutter/React Native paths.
• Self-hosting is ops — Docker Compose gets you the stack; you own upgrades, backups, HA, email/SMS providers, and observability. Many teams self-host for data residency, then discover multi-project cloud DX and managed features lag.
• Regional incidents happen — Hosted status history includes multi-hour regional events (e.g. official February 2026 incident write-up). Design for retries, caches, and multi-region strategy if uptime is revenue-critical; Enterprise SLA is the contractual path.

Community sentiment

Developer communities (r/Supabase, r/webdev, r/FlutterDev, HN, G2, and comparison write-ups) converge on a stable narrative:

• Loved for: Real Postgres, Studio UX, local CLI parity, Auth+Storage+Realtime in one bill, open-source escape hatch, strong Next.js/Flutter docs, and “Firebase without NoSQL ceiling” for SaaS schemas. G2 feedback (roughly mid-4s across tens of reviews on seller pages) typically praises fast setup and ease of use for backend + database work.
• Friction: Free-tier pause stories, surprise bills when spend caps are disabled or multi-project compute stacks up, SOC2/HIPAA sticker shock at Team ($599) for small startups, and security threads arguing that client-direct DB access via RLS is harder to get right than a traditional API layer—especially when AI tools generate schemas without policies.
• Reliability talk: Many production users report solid day-to-day DX; intermittent threads about downtime, cold-ish free instances, or slow queries under undersized compute appear regularly. Paid always-on compute and proper indexes address a large share of “slow by default” posts.
• Vs alternatives: vs Firebase — SQL/portability win for Supabase, offline/mobile/Google ecosystem for Firebase. vs Neon — Neon for pure serverless Postgres/branching economics; Supabase when you want the full BaaS bundle. vs Appwrite/PocketBase — lighter self-host or different feature tradeoffs; Supabase wins on hosted maturity and Postgres ecosystem depth for many SaaS teams.

Who should use it

• Indie hackers and startups shipping multi-tenant SaaS, marketplaces, or internal tools that need relational data, auth, and file uploads quickly.
• Teams standardizing on SQL who want one database for transactions, reporting joins, full-text, and embeddings.
• AI-assisted builders generating apps with Next.js/Vite/Flutter stacks where templates already assume Supabase clients (still: review RLS before launch).
• Companies that may self-host later or must keep an exit path via pg_dump and standard Postgres tooling.
• Compliance-ready product orgs willing to pay Team/Enterprise for SOC2/ISO packaging and HIPAA BAA paths.

Not ideal as-is: purely offline-first mobile products that need Firebase-grade sync history; orgs that want zero SQL/ops literacy; workloads that only need a tiny always-free DB with no pause semantics; or pure MySQL/Vitess shops already deep in PlanetScale-style workflows.

Alternatives

• Firebase — Best when mobile offline, FCM, Crashlytics, and Google ecosystem matter more than relational SQL.
• Neon — Serverless Postgres with scale-to-zero and deep branching; pair with separate auth/storage if you do not need Supabase’s BaaS layer.
• PlanetScale — MySQL/Vitess-oriented scale and branching culture; pick when horizontal MySQL story beats Postgres BaaS.
• Appwrite — Open-source BaaS with a different feature mix; often considered for self-host-first teams.
• Convex — Reactive backend with its own data model; strong DX for realtime app state, different from Postgres RLS.
• PocketBase — Single-binary SQLite BaaS for small apps and demos; not a Supabase scale/feature peer.
• Nhost — Postgres + GraphQL-oriented BaaS alternative in the same open-source BaaS neighborhood.
• Raw PostgreSQL (RDS, Cloud SQL, self-managed) — Maximum control; you rebuild auth, storage, realtime, and dashboards yourself.

Verdict

Supabase is the default modern choice for SQL-first app backends that want Auth, Storage, Realtime, and Edge Functions without leaving Postgres. Pricing is transparent if you model org plan + per-project compute + egress; Free is excellent for learning and poor for production SLAs. The main failure mode is not “missing features”—it is underestimating RLS, connection sizing, and multi-project cost.

Bottom line: Choose Supabase when relational data and an open Postgres platform matter. Choose Firebase for mobile/Google depth, Neon for database-only serverless Postgres, or a traditional cloud stack when you need custom multi-region ops beyond Team/Enterprise packaging. Verify current numbers on the official pricing page before you commit a production budget.