# Supabase

Build in a weekend. Scale to millions.

Source: https://wheredoirunthis.com/products/supabase · JSON: https://wheredoirunthis.com/api/products/supabase · Read on 2026-10-15

## At a glance

- Type: BaaS
- Kind: Open core
- Isolation: Not disclosed
- Free tier: Yes
- Starting price: $25/mo
- GPU: No
- Regions: 17
- Coverage: 24 of 61 assessed capabilities supported
- Agent readiness: read 10 of 11 signals, drive 11 of 11 signals

## Links

- Homepage: https://supabase.com/
- Docs: https://supabase.com/docs
- Pricing: https://supabase.com/pricing
- Repository: https://github.com/supabase/supabase

## Pricing

- Model: plan tier (features + MAU quotas) + usage-metered compute (per-project instance) + storage overages
- Unit: monthly active users (MAU) + compute instance (hourly, per project) + storage GB + egress GB
- Free tier: Yes

| Tier | Price | Includes | Notes |
| --- | --- | --- | --- |
| Free | $0/mo | 2 active projects · 500 MB DB · 5 GB egress · 1 GB storage · 50k MAU · community support. Projects auto-pause after 1 week idle.; 500 MB Postgres DB; 50,000 MAU; 2 active projects max |  [source](https://supabase.com/pricing.md) |
| Pro | from $25/mo (+ compute per project) | 100k MAU · 8 GB disk · 250 GB egress · 100 GB storage · email support · 7-day backups · $10 compute credits included; 100k MAU included; $10/mo compute credits (covers 1 Micro instance). Additional projects cost full compute. 8 GB disk per project base. |  [source](https://supabase.com/pricing.md) |
| Team | $599/mo | SOC2 + ISO 27001 · project-scoped/read-only access · SSO for Dashboard · priority email + SLAs · 14-day backups · 28-day log retention. HIPAA add-on available.; Adds compliance (SOC2/ISO27001), SSO, fine-grained access control, longer retention. HIPAA is a separate paid add-on. | Team is primarily a compliance + access-control upgrade; compute still billed separately per project. [source](https://supabase.com/pricing.md) |
| Enterprise | custom | Technical Account Management; uptime SLAs; AWS PrivateLink; 24/7/365 support; private Slack; custom security questionnaires. | Contact sales — not estimable from public surface. [source](https://supabase.com/pricing.md) |

- Overages: Compute: Micro $10/mo → 16XL $3,730/mo (hourly, per project). Storage: $0.125/GB disk (GP) or $0.195/GB (HP). Egress: $0.09/GB (data) + $0.03/GB (cached). MAU: $0.00325/MAU beyond plan limit.
- Card required: Not documented
- Source: https://supabase.com/pricing.md

## Website design

Desktop public website · assessed 2026-10-15

Complete assessment.

Light, restrained developer-facing site: black sans-serif typography, green accents, generous whitespace and subtly rounded outlined panels. Landing uses technical line art, pricing emphasizes a four-plan grid, and docs shifts to search plus framework-link tiles.

- Styles: Editorial minimalism, Technical illustration
- Landing page: captured
- Pricing: captured
- Docs: captured

## Runtime

- **GPU & accelerators**: No [source](https://supabase.com/pricing.md)
- **BYOC (Bring your own cloud)**: No managed BYOC offer verified; self-hosting is available separately — "Fresh Enterprise pricing lists PrivateLink, support and uptime SLAs, not BYO Cloud. Docker deployment into your infrastructure is self-hosting, not evidence of managed BYOC." [source](https://supabase.com/docs/guides/self-hosting.md) (confidence: medium)
- **Secrets management**: Project secrets, CLI supabase secrets set/list/unset and Edge Function environment variables [source](https://supabase.com/docs/guides/functions/secrets.md)
- **Storage options**: Postgres disk: Pro includes 8 GB then $0.125/GB (GP); GP up to 64 TB, HP up to 60 TB. First-party S3-compatible Storage: 1 GB Free / 100 GB Pro then $0.0213/GB. [source](https://supabase.com/pricing.md)
- **Supported workloads**: web-apps, mobile-apps, ai-apps, rag-pipelines, realtime-apps, saas, serverless-functions, auth-backend, file-storage [source](https://supabase.com/index.md)
- **Persistence**: Durable dedicated Postgres per project; backups 7 days on Pro, 14 days on Team; optional PITR. [source](https://supabase.com/pricing.md)
- **Data jurisdiction**: 17 specific AWS regions; one primary region per project. Choose a specific region for jurisdictional requirements. [source](https://supabase.com/docs/guides/platform/regions.md)
- **Resource limits & quotas**: Free: 2 active projects (auto-pause after 1 week idle), 50k MAU, 500 MB DB, 5 GB egress, 1 GB storage. Pro: 100k MAU ($0.00325/MAU after), 8 GB disk, 250 GB egress. Compute: Micro (shared, 1 GB RAM) → 16XL (64-core, 256 GB, $3,730/mo). Direct DB connections: 60 (Micro) → 500 (12XL+). [source](https://supabase.com/pricing.md)
- **SDK languages**: javascript, typescript, python, dart, swift, kotlin, csharp — "First-party SDKs: JS/TS (@supabase/supabase-js), Python (supabase-py), Dart/Flutter, Swift, Kotlin, C#. SDK references at /llms/js.txt, /llms/dart.txt, /llms/swift.txt, /llms/kotlin.txt, /llms/python.txt, /llms/csharp.txt." (source: llms.txt + docs) (confidence: high)
- **Network & egress controls**: No outbound policy verified — "Network restrictions protect inbound database access. The fetched docs do not establish configurable outbound policy for Edge Functions." [source](https://supabase.com/docs/guides/platform/network-restrictions.md) (confidence: medium)
- **Snapshots & forks**: Database branches, not compute snapshots — "Separate Supabase environments with their own credentials and deployed Edge Functions; data-less by default, optional seed data or Include data from Dashboard. No running-process or memory snapshot guarantee." [source](https://supabase.com/docs/guides/deployment/branching.md) (confidence: high)
- **Deployment methods**: dashboard, cli, git-push, api, mcp [source](https://supabase.com/docs/guides/deployment/branching.md)
- **Isolation**: Not disclosed — "Data-layer substrate, not a user-code sandbox guarantee. Docs say each project has a dedicated Postgres instance and disclose shared versus dedicated compute, but the fetched pages do not establish a named VM/container isolation boundary. Edge Functions separately use Deno." [source](https://supabase.com/docs/guides/platform/compute-and-disk.md) (confidence: medium)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Supported | "npx skills add supabase/agent-skills" [source](https://supabase.com/docs/guides/ai-tools/ai-skills.md) |
| AI app builder | Not applicable | "Supabase is the Postgres development platform: an open source backend for building web and mobile applications; not a prompt-to-full-app builder." [source](https://supabase.com/index.md) |
| Autonomous QA agent | Not supported | "Advisors and agent prompts inspect backend health and security; no autonomous end-to-end running-app QA agent established." [source](https://supabase.com/docs/guides/observability.md) |
| Built-in coding agent | Partially supported | "Generate, run and debug queries, chart your data, create functions, policies and more." [source](https://supabase.com/assistant) |
| BYOK for LLMs | Partially supported | "Available on self-hosted: Requires OpenAI API Key" [source](https://supabase.com/features/ai-assistant) |
| Credential-injection proxy | Not supported | "Function secrets are available as environment variables; no outside-workload on-the-wire credential replacement verified." [source](https://supabase.com/docs/guides/functions/secrets.md) |
| LLM gateway | Not supported | "Inspected AI tools and functions docs describe external provider integrations, not a managed multi-provider LLM gateway." [source](https://supabase.com/docs/guides/ai-tools.md) |
| MCP client | Not supported | "No first-party MCP client is documented on the inspected AI tools surface; this is the server agents connect to." [source](https://supabase.com/docs/guides/ai-tools.md) |
| MCP-server hosting | Supported | "Host your own MCP server on Supabase Edge Functions" [source](https://supabase.com/docs/guides/ai-tools/byo-mcp.md) |
| MCP server | Supported | "https://mcp.supabase.com/mcp" [source](https://supabase.com/docs/guides/ai-tools/mcp.md) |
| Model inference API (first-party) | Not supported | "Vector and AI integrations are documented; no first-party hosted model catalogue/inference billing established." [source](https://supabase.com/docs/guides/ai.md) |
| Preinstalled coding agent | Not applicable | "Agents connect to Supabase; Supabase does not provision an agent workstation." [source](https://supabase.com/index.md) |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Supported | "CRUD API at https://<project_ref>.supabase.co/rest/v1/, provisioned behind an API gateway with key-auth enabled." [source](https://supabase.com/docs/guides/api.md) |
| Custom domains | Partially supported | "Custom Domain: $10 per domain per month per project add on." [source](https://supabase.com/pricing.md) |
| Direct public IPv6 | Supported | "The direct connection string connects to your Postgres instance directly. Direct connections use IPv6 by default." [source](https://supabase.com/docs/guides/database/connecting-to-postgres.md) |
| Edge KV store | Not applicable | "Postgres database and vector storage, not a colocated edge-runtime KV primitive." [source](https://supabase.com/index.md) |
| Egress controls | Not supported | "The inspected network restrictions documentation controls access to database endpoints; no configurable outbound firewall was established." [source](https://supabase.com/docs/guides/platform/network-restrictions.md) |
| Email send / receive | Partially supported | "Send emails via Resend" [source](https://supabase.com/docs/guides/functions.md) |
| Public preview URLs | Not applicable | "Branches provide backend instances and API credentials, not frontend deploy preview URLs." [source](https://supabase.com/docs/guides/deployment/branching.md) |
| Private networking | Partially supported | "AWS PrivateLink included on Team and Enterprise." [source](https://supabase.com/pricing.md) |
| Built-in reverse proxy | Supported | "Request enters an edge gateway (relay)" [source](https://supabase.com/docs/guides/functions.md) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Supported | "Supabase Auth makes it easy to implement authentication and authorization in your app." [source](https://supabase.com/docs/guides/auth.md) |
| BYOC | Not supported | "Current Enterprise tier lists AWS PrivateLink, uptime SLAs and support; no managed BYO Cloud offer verified." [source](https://supabase.com/pricing.md) |
| Deploy into customers' VPCs | Not applicable | "No nested customer-VPC software delivery platform in the backend SKU." [source](https://supabase.com/index.md) |
| Secrets management | Supported | "supabase secrets set" [source](https://supabase.com/docs/guides/functions/secrets.md) |
| Self-host / OSS core | Supported | "The fastest and recommended way to self-host Supabase is to use Docker." [source](https://supabase.com/docs/guides/self-hosting.md) |
| Sharing | Not supported | "Inspected access-control docs cover organization and project roles; no share-running-resource-by-link primitive established." [source](https://supabase.com/docs/guides/platform/access-control.md) |
| SSO / SAML | Partially supported | "SSO for Supabase Dashboard on Team; Single Sign-On (SAML 2.0) on Pro includes 50 then $0.015 per MAU." [source](https://supabase.com/pricing.md) |
| Teams | Supported | "Team members: Unlimited on Free, Pro, Team and Enterprise." [source](https://supabase.com/pricing.md) |
| Workload identity | Not supported | "Function secrets/API keys are documented; no per-workload OIDC/SPIFFE federation verified in inspected material." [source](https://supabase.com/docs/guides/functions/secrets.md) |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "Supabase CLI" [source](https://supabase.com/docs/guides/local-development.md) |
| E2B-compatible API | Not applicable | "PostgREST and Management API are not an E2B sandbox API." [source](https://supabase.com/index.md) |
| Filesystem API | Not applicable | "Storage provides objects and buckets, not a POSIX-like compute filesystem API." [source](https://supabase.com/index.md) |
| Git deploy | Supported | "You can deploy directly from GitHub on any plan — connect your repository and changes pushed to main are automatically deployed to your project." [source](https://supabase.com/docs/guides/deployment/branching.md) |
| HTTP data API | Supported | "Supabase auto-generates an API directly from your database schema allowing you to connect to your database through a restful interface, directly from the browser." [source](https://supabase.com/docs/guides/api.md) |
| OpenAPI spec | Supported | "OpenAPI 3.0 description of the Management API for managing organizations, projects, branches, and configuration" [source](https://supabase.com/openapi.json) |
| Private container registry | Not applicable | "Edge Functions deploy source; this data/backend service does not provide a hosted private image registry." [source](https://supabase.com/docs/guides/functions.md) |
| Public API | Supported | "Management API; OpenAPI Docs" [source](https://supabase.com/docs/reference/api/introduction) |
| SDK | Supported | "Supabase Reference (JavaScript), Dart, Swift, Kotlin, Python, C#." [source](https://supabase.com/llms.txt) |
| SSH access | Not applicable | "Managed Postgres connection methods, not a general-purpose SSH workload machine." [source](https://supabase.com/docs/guides/database/connecting-to-postgres.md) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not applicable | "No customer VM boot configuration in the managed backend SKU." [source](https://supabase.com/index.md) |
| Desktop / computer-use sandbox | Not applicable | "No desktop workload in the data/backend SKU." [source](https://supabase.com/index.md) |
| GPU compute | Not applicable | "Supabase is a managed data/backend platform; no GPU instance rental is offered in the compute table." [source](https://supabase.com/pricing.md) |
| Live-state (memory) snapshots | Not applicable | "No running process/memory restoration primitive in the database SKU." [source](https://supabase.com/index.md) |
| Multi-region | Supported | "Each Supabase project is deployed to one primary region. You can choose an exact AWS region for your project." [source](https://supabase.com/docs/guides/platform/regions.md) |
| Object storage | Supported | "Store and serve files with Supabase Storage." [source](https://supabase.com/docs/guides/storage.md) |
| Persistent disk | Supported | "8 GB disk size per project (then $0.125 per GB)." [source](https://supabase.com/pricing.md) |
| Sandbox templates / custom images | Not applicable | "Database/backend platform, not reusable compute image templates." [source](https://supabase.com/index.md) |
| Scale to zero | Partially supported | "Free projects are paused after 1 week of inactivity. Projects on paid plans are not paused for inactivity." [source](https://supabase.com/pricing.md) |
| Selectable isolation runtime | Not applicable | "Managed backend does not expose a choice of workload isolation runtimes." [source](https://supabase.com/index.md) |
| Snapshots / forking | Not applicable | "Database branches are separate backend environments; not running compute-instance snapshots." [source](https://supabase.com/docs/guides/deployment/branching.md) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Partially supported | "Each branch is a separate environment with its own Supabase instance and API credentials." [source](https://supabase.com/docs/guides/deployment/branching.md) |
| Ephemeral instant DB (no-signup) | Not supported | "Setup uses supabase login and a user account; no anonymous hosted no-signup disposable database path established." [source](https://supabase.com/index.md) |
| First-party database | Supported | "Every Supabase project is a dedicated Postgres database." [source](https://supabase.com/index.md) |
| Vector search | Supported | "pgvector" [source](https://supabase.com/docs/guides/ai/vector-columns.md) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not applicable | "No hosted CI runner compute in the data/backend SKU." [source](https://supabase.com/index.md) |
| Built-in observability | Supported | "Query logs, inspect database statistics, review advisor findings, Reports, Metrics API." [source](https://supabase.com/docs/guides/observability.md) |
| Preview environments | Partially supported | "Preview branches are ephemeral and automatically deleted when a PR is merged or closed." [source](https://supabase.com/docs/guides/deployment/branching.md) |
| Scheduled tasks | Supported | "Supabase Cron" [source](https://supabase.com/docs/guides/cron.md) |
| Project template marketplace | Supported | "Kickstart your next project with production ready templates" [source](https://supabase.com/index.md) |
| Durable workflows | Not supported | "Queues provides message queuing; no durable general execution/checkpoint-resume workflow engine established in inspected docs." [source](https://supabase.com/docs/guides/queues.md) |

## Agent readiness

### Read: 10 of 11 signals present

10/11 signals (9 full, 1 partial)

- Llms txt: pass — "https://supabase.com/llms.txt — substantive docs, SDK, pricing and machine-interface index."
- Llms full txt: pass — "https://supabase.com/llms-full.txt — HTTP 200, 7,316,761 bytes; bounded pointer retained."
- Robots AI policy: pass — "https://supabase.com/robots.txt — explicit Allow / for GPTBot, ClaudeBot, Google-Extended and PerplexityBot."
- JSON LD: partial — "https://supabase.com/ — Organization and WebSite JSON-LD verified; no Product/SoftwareApplication offers found."
- Sitemap: pass — "https://supabase.com/sitemap.xml → /sitemap_www.xml; non-trivial 163919-byte URL set retained."
- Meta quality: pass — "https://supabase.com/ — descriptive title, description and OG tags in fetched raw HTML."
- Markdown negotiation: pass — "https://supabase.com/ — Accept: text/markdown returned text/markdown, 5210 bytes; .md docs and pricing also work."
- Content efficiency: fail — "https://supabase.com/ — readable text / HTML bytes measured at 8605/1338049 (<1%)."
- Docs discoverable: pass — "https://supabase.com/ — Docs link first-class in fetched header and inspected desktop nav."
- Pricing machine readable: pass — "https://supabase.com/pricing.md — structured Free, Pro, Team, Enterprise tiers and rates."
- Anti bot: pass — "Landing, pricing, docs and machine documents fetched successfully; no challenge observed on these public pages."

### Drive: 11 of 11 signals present

11/11 signals (9 full, 2 partial)

- Public API: pass — "https://supabase.com/docs/reference/api/introduction — documented Management API plus auto-generated REST data API."
- Openapi spec: pass — "https://supabase.com/openapi.json — HTTP 200, OpenAPI 3.0.0, 115 paths; linked by docs intro and llms.txt."
- MCP server: pass — "https://supabase.com/docs/guides/ai-tools/mcp.md — remote https://mcp.supabase.com/mcp with OAuth setup."
- SDK packages: pass — "https://supabase.com/llms.txt — multiple official SDK references (JS, Dart, Swift, Kotlin, Python, C#)."
- Auth docs: pass — "https://supabase.com/docs/guides/getting-started/api-keys.md — publishable/secret versus anon/service_role; Management API scopes documented."
- Agent self serve creds: partial — "https://supabase.com/index.md — supabase login opens a browser; API key retrieval exists via CLI/Management API, but initial user login/PAT issuance is a human step."
- Webhooks: partial — "https://supabase.com/docs/guides/database/webhooks.md — database INSERT/UPDATE/DELETE events produce HTTP calls; general event signing not established in inspected page."
- CLI tool: pass — "https://supabase.com/docs/guides/local-development.md — official Supabase CLI installation and development flow."
- Error model: pass — "https://supabase.com/docs/guides/auth/debugging/error-codes.md — documented Auth error codes and response handling."
- Rate limit docs: pass — "https://supabase.com/docs/guides/auth/rate-limits.md — explicit endpoint limits and 429 behavior; headers coverage not independently verified."
- Agent config: pass — "https://supabase.com/.well-known/agent-skills plus https://supabase.com/docs/guides/ai-tools/ai-skills.md and plugins.md — multiple installable/configuration surfaces."

## Coding harnesses

- Claude Code (Anthropic) — "Claude Code listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)
- Codex CLI (OpenAI) — "Codex listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)
- Cursor (Anysphere) — "Cursor listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)
- Antigravity (Google) — "Antigravity listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)
- Devin (Cognition) — "Devin Desktop listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)
- Droid (Factory) — "Factory listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)
- Gemini CLI (Google) — "Gemini CLI listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)
- GitHub Copilot (GitHub) — "GitHub Copilot listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)
- Goose (Block) — "Goose listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)
- Kiro CLI (Amazon Web Services) — "Kiro listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)
- OpenCode (opencode) — "OpenCode listed under Pick your agent." [source](https://supabase.com/docs/guides/ai-tools.md)

## Compliance & regions

- SOC 2 Type II: certified (scope: hosted) — "Supabase is SOC 2 Type 2 compliant. Enterprise and Team customers can access our SOC 2 Type 2 report on the dashboard." [source](https://supabase.com/security)
- ISO/IEC 27001: certified (scope: hosted) — "Supabase is ISO 27001 certified." [source](https://supabase.com/security)
- HIPAA: enterprise-only (scope: hosted) — "You can store Protected Health Information (PHI) on our hosted platform once you enter into a Business Associate Agreement (BAA) with us and fulfill your HIPAA obligations under our shared responsibility model." [source](https://supabase.com/security)
- GDPR: self-attested (scope: hosted) — "Supabase is GDPR compliant." [source](https://supabase.com/docs/guides/security/gdpr-compliance.md)
- Regions: us-west-1 (West US (North California)), us-west-2 (West US (Oregon)), us-east-1 (East US (North Virginia)), us-east-2 (East US (Ohio)), ca-central-1 (Canada (Central)), eu-west-1 (West EU (Ireland)), eu-west-2 (West Europe (London)), eu-west-3 (West EU (Paris)), eu-central-1 (Central EU (Frankfurt)), eu-central-2 (Central Europe (Zurich)), eu-north-1 (North EU (Stockholm)), ap-south-1 (South Asia (Mumbai)), ap-southeast-1 (Southeast Asia (Singapore)), ap-northeast-1 (Northeast Asia (Tokyo)), ap-northeast-2 (Northeast Asia (Seoul)), ap-southeast-2 (Oceania (Sydney)), sa-east-1 (South America (São Paulo))
- Regions note: 17 specific AWS regions; general areas may choose a region within a broad geography and are not a jurisdiction guarantee. Each project has one primary region.

## Open source

- Repository: https://github.com/supabase/supabase
- License: Apache-2.0
- Stars: 111562
- Forks: 16841
- Self-host methods: docker, compose, kubernetes, helm
- Self-host dependencies: postgres, object-storage

## Company & presence

- Headquarters: Fully remote; Singapore contracting address
- Team size: 350+ team members in 60+ countries
- Privacy policy: https://supabase.com/privacy
- Terms of service: https://supabase.com/terms
- GitHub: https://github.com/supabase/supabase
- X/Twitter: https://x.com/supabase
- Discord: https://discord.supabase.com/
- YouTube: https://www.youtube.com/@Supabase
- Blog: https://supabase.com/blog
- Changelog: https://supabase.com/changelog

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.