🩺 Vitals
- 🟢 Last active: 2026-10-11
- 📦 Latest release: v1.26.08 (2026-08-07)
- 🐞 Open issues: 1150
- 🌟 Stars: 111.3k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: supabase.com
- Source: github.com/supabase/supabase
- License: Apache-2.0
- Deployment: Docker | Kubernetes | SaaS
- Data Model: PostgreSQL (Relational) + Realtime
- Jurisdiction: USA 🇺🇸 (Supabase, Inc.)
- Compliance (SaaS): SOC 2 Type 2 (Audited) | HIPAA (Self-Assessed) | GDPR (Self-Assessed)
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: High (4/5) - Multi-service stack (PostgreSQL, GoTrue, PostgREST, Realtime, Storage, Envoy API gateway, Studio) well beyond the app+DB+cache baseline
- Maintenance: Moderate (3/5) - Self-hosting means orchestrating a multi-service stack (roughly a dozen containers) with their own updates and Postgres migrations; managed Cloud recommended
- User Management: Minimal (1/5) - Self-hosted Studio uses one shared dashboard credential (HTTP basic auth); multi-user admin accounts, RBAC, SSO and audit are hosted-platform-only (row-level security governs app data, not operator access)
1. The Executive Summary
What is it? Supabase is an open-source backend-as-a-service platform built on PostgreSQL, providing authentication, file storage, real-time subscriptions, and auto-generated REST and GraphQL APIs from a unified stack. Developed by Supabase, Inc. (USA, Delaware corporation), it is positioned as the self-hostable alternative to Firebase, replacing NoSQL document storage with a standard relational database. The Apache-2.0 core is fully functional for self-hosted deployments; on Supabase Cloud, dashboard SSO, the HIPAA BAA and access to the SOC 2 Type II report need a paid plan.
The Strategic Verdict:
- 🔴 For Regulated Industries Requiring HIPAA from Day One: Caution. Supabase states that its HIPAA controls are not supported out of the box in self-hosted Supabase, and its HIPAA guide leaves self-hosted HIPAA out of scope. On managed Cloud, HIPAA and the SOC 2 report require a paid plan.
- 🟢 For Engineering Teams Escaping Firebase Lock-In: Strong Buy. Standard PostgreSQL at the data layer eliminates NoSQL migration risk: data exits via SQL dump, not proprietary JSON tooling. Row Level Security enforces access controls at the database engine, surviving API layer changes without re-engineering.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Firebase (SaaS) | Supabase (Self-Hosted) |
|---|---|---|
| Vendor Lock-in | High (NoSQL / proprietary API) | Low (standard SQL) |
| Scaling Costs | Spiky (reads / writes / egress) | Predictable (compute) |
| Data Portability | Difficult (JSON export) | Full (SQL dump) |
| SSO / HIPAA BAA | SAML SSO for app users through the Identity Platform upgrade, metered per monthly active user; BAA through Google Cloud's BAA for the products it covers | SAML SSO for app users in the self-hosted Auth service; no vendor BAA, since you host the data |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Deploys via Docker Compose orchestrating roughly a dozen services, including PostgreSQL, GoTrue (auth), PostgREST (REST API), Realtime, the Storage API, an Envoy API gateway (Kong is an optional override), and Studio. The managed Cloud tier abstracts this complexity; self-hosting requires deliberate service-level monitoring for each component independently.
- Scalability: PostgreSQL scales vertically with predictable compute costs. Read replicas are available on paid Cloud plans for horizontal read scaling. The PostgREST API layer is stateless and scales horizontally behind a load balancer.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics (USA 🇺🇸): Supabase, Inc. is a Delaware corporation subject to the CLOUD Act. Supabase Cloud deploys each project into the region the customer picks when creating it, and Supabase's docs state that all data stays in the chosen region. EU operators under GDPR or NIS2 mandates should verify whether Supabase's EU region selection satisfies cross-border transfer requirements. CLOUD Act exposure persists regardless of data region when the corporate entity is US-domiciled. When you self-host, Supabase, Inc. holds no data to compel: the deployment runs on the operator's own servers or cloud and sends Supabase no telemetry, so the operator's hosting decides which law reaches the data.
- The Compliance Shift: Supabase Cloud holds an audited SOC 2 Type 2 report, offers a HIPAA Business Associate Agreement on its Team and Enterprise plans, and publishes a GDPR data processing agreement. Supabase states that its SOC 2 compliance does not transfer to environments outside the Supabase product or Supabase's control, and a self-hosted deployment runs under the operator's control: Supabase's self-hosting docs make the operator responsible for security hardening, updates, backups and monitoring. For self-hosted Supabase, the vendor states that its HIPAA controls are not supported out of the box and that HIPAA reaches beyond the product, to BAAs with providers, operating controls and policies. Its HIPAA guide leaves self-hosted HIPAA out of scope, so the operator puts those controls, agreements and policies in place on its auditor's advice. The self-hosted build keeps Postgres row-level security, but Studio sits behind one shared login and platform audit logs are a hosted Team and Enterprise feature, so the operator must add individual admin accounts and an audit trail before regulated data goes in. Supabase's docs warn that a table in a schema the API exposes, left without Row Level Security, can be read and written by any role with a grant on it, so this layer needs rigorous review before any production launch.
- License Risk (Apache-2.0: Permissive with Open-Core Tension): The core platform is Apache-2.0 licensed. Permissive, patent-granting, and forkable with no network copyleft clause. On Supabase Cloud, dashboard SSO, the HIPAA BAA and the SOC 2 report need a paid plan. Supabase has a single-company contributor model; the open-source boundary may shift as the product matures. The Apache-2.0 license protects existing deployments from retroactive restriction, but teams should monitor the feature split across releases.
4. Market Landscape
🏢 Proprietary Incumbents
- Firebase: Google's managed backend platform. NoSQL document storage (Firestore) and a proprietary real-time sync model create deep application lock-in. Data portability is limited to JSON export, and there is no self-hosting path for any component.
🤝 Open Source Ecosystem
- Appwrite: A BaaS alternative that, like Supabase, self-hosts as a multi-service Docker Compose stack, with a broader language SDK surface.
- PocketBase: A single-binary BaaS with embedded SQLite. Significantly lower operational overhead than Supabase, suited to smaller workloads and teams without dedicated DevOps bandwidth.