🩺 Vitals
- 🟢 Last active: 2026-08-05
- 📦 Latest release: v1.26.07 (2026-07-09)
- 🐞 Open issues: 1190
- 🌟 Stars: 107.6k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: supabase.com
- Source: github.com/supabase/supabase
- License: Apache-2.0
- Deployment: Docker | Kubernetes | SaaS
- Data Model: PostgreSQL (Relational) + Realtime
- Jurisdiction: USA 🇺🇸 (Supabase, Inc.)
- Compliance (SaaS): SOC 2 Type II | HIPAA | GDPR
- Compliance (Self-Hosted): HIPAA Ready | GDPR Ready
- Complexity: Medium (3/5) - Multi-service stack (PostgreSQL, GoTrue, PostgREST, Realtime, Storage); PostgreSQL knowledge required
- Maintenance: Low (2/5) - Managed Cloud recommended; self-hosting requires orchestrating five independent services
- Enterprise Ready: Moderate (3/5) - Row Level Security and API tokens included; SSO and HIPAA BAA require a paid plan
1. The Executive Summary
What is it? Supabase is an open-source backend-as-a-service platform built on PostgreSQL, providing authentication, file storage, real-time subscriptions, and auto-generated REST and GraphQL APIs from a unified stack. Developed by Supabase, Inc. (USA, Delaware C-Corp) and VC-backed, it is positioned as the self-hostable alternative to Firebase, replacing NoSQL document storage with a standard relational database. The Apache-2.0 core is fully functional for self-hosted deployments; SSO, HIPAA BAA, and access to the SOC 2 Type II compliance report are paywalled behind paid commercial plans.
The Strategic Verdict:
- 🔴 For Regulated Industries Requiring HIPAA from Day One: Caution. HIPAA compliance on self-hosted is not out-of-the-box. Supabase explicitly states that the necessary controls must be configured by the operator, who must also sign their own BAA. On managed Cloud, HIPAA and the SOC 2 report require a paid plan.
- 🟢 For Engineering Teams Escaping Firebase Lock-In: Strong Buy. Standard PostgreSQL at the data layer eliminates NoSQL migration risk: data exits via SQL dump, not proprietary JSON tooling. Row Level Security enforces access controls at the database engine, surviving API layer changes without re-engineering.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Firebase (SaaS) | Supabase (Self-Hosted) |
|---|---|---|
| Vendor Lock-in | High (NoSQL / proprietary API) | Low (standard SQL) |
| Scaling Costs | Spiky (reads / writes / egress) | Predictable (compute) |
| Data Portability | Difficult (JSON export) | Full (SQL dump) |
| SSO / HIPAA BAA | Enterprise tier | Paid plan required |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Deploys via Docker Compose orchestrating five services: PostgreSQL, GoTrue (auth), PostgREST (REST API), Realtime, and the Storage API. The managed Cloud tier abstracts this complexity; self-hosting requires deliberate service-level monitoring for each component independently.
- Scalability: PostgreSQL scales vertically with predictable compute costs. Read replicas are available on paid Cloud plans for horizontal read scaling. The PostgREST API layer is stateless and scales horizontally behind a load balancer.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics (USA 🇺🇸): Supabase, Inc. is a Delaware C-Corp subject to the CLOUD Act. The managed Cloud tier processes authentication tokens, user records, and file assets on US-managed infrastructure. EU operators under GDPR or NIS2 mandates should verify whether Supabase's EU region selection satisfies cross-border transfer requirements. CLOUD Act exposure persists regardless of data region when the corporate entity is US-domiciled. Self-hosting eliminates this exposure entirely.
- The Compliance Shift: Supabase Cloud holds SOC 2 Type II, HIPAA, and GDPR certifications. Critically, Supabase explicitly states that its SOC 2 compliance does not transfer to self-hosted environments. Operators bear the full shared responsibility model. HIPAA on self-hosted requires the operator to configure their own infrastructure controls and sign their own BAA; it is not achievable without deliberate architecture work. Row Level Security misconfiguration is the leading cause of data exposure in Supabase deployments. This layer requires rigorous review before any production launch.
- License Risk (Apache-2.0: Permissive with Open-Core Tension): The core platform is Apache-2.0 licensed. Permissive, patent-granting, and forkable with no network copyleft clause. SSO, HIPAA BAA access, and the SOC 2 compliance report are paywalled behind the commercial tier. Supabase is VC-backed with a single-company contributor model; the open-source boundary may shift as the product matures. The Apache-2.0 licence protects existing deployments from retroactive restriction, but teams should monitor the feature split across releases.
4. Market Landscape
🏢 Proprietary Incumbents
- Firebase: Google's managed backend platform. NoSQL document storage (Firestore) and a proprietary real-time sync model create deep application lock-in. Data portability is limited to JSON export, and there is no self-hosting path for any component.
🤝 Open Source Ecosystem
- Appwrite: A self-contained BaaS alternative packaged as a single Docker container, easier to self-host than Supabase's multi-service stack, with a broader language SDK surface.
- PocketBase: A single-binary BaaS with embedded SQLite. Significantly lower operational overhead than Supabase, suited to smaller workloads and teams without dedicated DevOps bandwidth.