Supabase Review: Why We Moved a Workload From MongoDB to Postgres

We migrated a real event and account-tracking workload from MongoDB to Supabase’s Postgres, specifically because the data needed relational stitching logic — linking sessions to accounts, recomputing scores across joined tables — that’s awkward to express in a document store. The migration itself went cleanly; the real gotcha showed up in how you connect to the database, not in the database engine underneath it.

TL;DR

Supabase is a hosted Postgres platform that bundles a relational database with authentication, file storage, auto-generated APIs, real-time subscriptions, and edge functions — marketed as an open-source alternative to Firebase, but built on standard SQL instead of a proprietary document model. The free tier is genuinely usable for development (500MB database, 50,000 monthly active users for auth), and the Pro plan starts at $25/month. It’s a strong fit for teams that want relational data modeling, row-level security, and portability (it’s open source and self-hostable) without giving up the convenience of a managed backend. The biggest caveat: the direct database connection is IPv6-only, which silently breaks on networks without IPv6 support — you need the separate IPv4 connection pooler for local development, a real first-time trap we hit ourselves.

Supabase at a glance

What Supabase does

Supabase was founded in January 2020 by Paul Copplestone and Ant Wilson, who met through the Entrepreneur First program in Singapore, and went through Y Combinator’s Summer 2020 batch. The company’s origin story is genuinely unusual: in May 2020, Copplestone changed the site’s headline from “real-time Postgres” to “the open-source Firebase alternative,” and the number of hosted databases went from 8 to 800 in three days. That positioning — the open-source, SQL-based answer to Firebase’s proprietary NoSQL model — has stuck ever since, and the company has scaled fast on the back of it: a $6M seed in 2020, a $30M Series A in 2021, an $80M Series B in 2022, an $80M Series C in 2024, and a $200M Series D in April 2025 at a $2 billion valuation, followed by a Series E just months later at a reported $5 billion valuation.

The core: managed Postgres

At its foundation, Supabase is a hosted, managed instance of PostgreSQL — a mature, decades-old relational database, not a proprietary system built from scratch. That means standard SQL, joins, foreign keys, constraints, transactions, and the full ecosystem of Postgres extensions are available, including pgvector (for storing and querying AI embeddings directly in the database) and PostGIS (for geospatial queries). Supabase auto-generates a REST API and a GraphQL-compatible API directly from your database schema, so a new table becomes queryable over HTTP without hand-writing CRUD endpoints.

Auth, storage, and real-time

Built-in authentication supports email/password, magic links, phone auth, and OAuth providers like Google and GitHub, with row-level security (RLS) policies enforced at the database level — meaning every access path, whether through the app, a script, or a direct SQL connection, goes through the same permission checks rather than relying on the client SDK to enforce rules. File storage handles user uploads with the same RLS model applied to buckets and objects. Realtime is a separate service that listens to Postgres’s write-ahead log and pushes changes to subscribed clients over WebSockets, useful for live-updating UIs without polling.

Edge functions and scheduled jobs

Edge Functions run on the Deno runtime at edge locations for custom server-side logic — webhooks, third-party API calls, anything that shouldn’t live in client code. Supabase also ships pg_cron, a Postgres extension for scheduling recurring database jobs directly inside the database itself, which removes the need for a separate cron/scheduler service for routine maintenance tasks like data cleanup.

Dashboard and developer tooling

Supabase’s dashboard includes a table editor for viewing and editing rows without writing SQL, a SQL editor for running queries directly, log explorers for API and database activity, and a schema visualizer for seeing how tables relate to each other. The official CLI supports local development against a Dockerized Postgres instance, schema migrations tracked as version-controlled files, and a straightforward path to push local schema changes to a hosted project — useful for teams that want a git-like workflow around database changes rather than editing a production schema by hand through the dashboard.

Pricing

The free tier is capped in a way worth knowing before you rely on it: free projects pause automatically after a week of inactivity, and an account is limited to two active free projects at a time — fine for prototyping, not for anything meant to stay live unattended. Pro at $25/month includes a $10 compute credit covering one small “Micro” instance, then usage-based overage kicks in for anything beyond the included disk, storage, and MAU allowances, so actual monthly cost on Pro is closer to “starts at $25” than “flat $25” once a project has real traffic. The jump to Team at $599/month is steep and is really about compliance and support (SOC 2, ISO 27001, priority SLAs, longer backup and log retention) rather than more database capacity — the underlying database and storage limits are the same as Pro. Because Supabase is open source, self-hosting is also an option for teams that want to avoid the hosted pricing model entirely, at the cost of managing the infrastructure themselves.

Pros

Real Postgres, not a proprietary abstraction. Relational joins, stored procedures (exposed as RPC functions), foreign key constraints, and the full Postgres extension ecosystem are all available — a document database makes this kind of relational logic awkward, which is exactly the problem that pushed us to migrate a workload onto it.

Row-level security is enforced at the database, not the app layer. Every access path — your app’s API calls, a cron job, a migration script, a direct psql connection — passes through the same RLS policies, which is a structural security advantage over systems where permission rules only apply through one specific SDK.

pgvector makes it a genuine option for AI features. Storing embeddings alongside relational data in the same database, instead of running a separate vector database, simplifies architecture for retrieval-augmented generation or semantic search use cases.

pg_cron removes the need for a separate scheduler. We use it for scheduled cleanup jobs without standing up a dedicated scheduling service — a small thing, but it removes one more piece of infrastructure to maintain.

Open source and self-hostable. Because Supabase’s core is open source, there’s a real exit path if hosted pricing or vendor terms stop working for a team — a meaningful difference from fully proprietary BaaS platforms.

Cons

The direct database host is IPv6-only. The primary connection string (db.<project-ref>.supabase.co) simply won’t resolve on networks without IPv6 support — a real, non-obvious blocker the first time you hit it from a local machine or an ad-hoc script. The fix is Supabase’s separate IPv4 session pooler, a different hostname and port, but nothing about the default setup flags that you’ll need it.

DDL requires a separate connection path from normal app access. The service-role key used for backend reads/writes through the REST API bypasses row-level security but can’t run schema migrations — DDL requires a direct Postgres connection through the pooler, not the REST layer, which means budgeting for two distinct access patterns rather than one.

Free tier projects pause after a week of inactivity. Fine for active development, but it means the free tier isn’t a viable option for anything you want to leave running unattended, like a small side project you check in on monthly.

Pro-tier costs aren’t fully predictable at the sticker price. $25/month covers a baseline, but disk, storage, and MAU overage all bill separately once you exceed the included amounts, so real cost depends on usage in a way the headline number doesn’t fully convey.

How Supabase compares

The standard comparison is Supabase versus Firebase, and the split is architectural before it’s about price. Firebase gives you a document database (Firestore), proprietary SDKs, and deep integration with the rest of Google Cloud; Supabase gives you a relational Postgres database, open-source tooling, and the option to self-host. For security specifically, Supabase’s row-level security is enforced at the database level for every access path, while Firebase’s Security Rules only protect access through the Firestore SDK — a Cloud Function using Firebase’s Admin SDK bypasses those rules entirely, which is a meaningful structural difference for anyone building anything security-sensitive.

On pricing, Supabase tends to be cheaper and more predictable at scale because it bills a flatter, tiered rate rather than metering every individual read and write, whereas Firebase’s pay-per-operation model can get expensive fast as read volume grows — comparisons of the two put the pricing crossover point at roughly 2.8 million reads a day, with Firebase costing multiple times more than Supabase by the time you’re at 10 million reads a day. Firebase remains the stronger choice for mobile-first, offline-first, or heavily real-time collaborative apps where its sync engine and SDK maturity are deeper; Supabase is the better starting point for most new web and SaaS projects that want a relational database with predictable pricing and no vendor lock-in.

Who it’s for

Teams whose data model is genuinely relational. If your application needs joins, foreign keys, and stitching logic across related tables, Supabase’s Postgres foundation is a more natural fit than forcing that structure into a document database.

AI application builders who want vector search without a separate database. pgvector support means embeddings and relational data can live in the same place, which simplifies a RAG or semantic-search architecture considerably.

Teams that want an open-source exit path. Because the core platform is open source and self-hostable, Supabase is a lower-lock-in choice than a fully proprietary BaaS for teams concerned about long-term vendor dependency.

Not the best fit for offline-first or heavily mobile-sync-dependent apps. Firebase’s real-time sync engine and offline support are more mature for that specific use case; Supabase’s Realtime service covers live updates well but isn’t built around the same offline-first model.

Frequently asked questions

Is Supabase really open source?

Yes — Supabase’s core components are open source, and the platform can be self-hosted rather than only used as a hosted service. This is a real structural difference from Firebase, which is fully proprietary and tied to Google Cloud.

Is Supabase free to use?

Yes, with real limits: the free tier includes a 500MB database, 1GB of file storage, and up to 50,000 monthly active users for auth, but free projects pause after a week of inactivity and accounts are capped at two active free projects.

Why does Supabase use Postgres instead of a NoSQL database like Firebase?

Postgres is a mature, standard relational database, which gives Supabase users real SQL, joins, constraints, and decades of tooling and extensions (including pgvector and PostGIS) instead of a proprietary document model. It’s a deliberate positioning choice — Supabase markets itself directly as the SQL-based, open-source alternative to Firebase’s NoSQL approach.

Can you connect directly to a Supabase database from any network?

Not always. The direct database host is IPv6-only and won’t resolve on networks without IPv6 support — a real first-time trap. Use the IPv4 session pooler connection string instead for local development or script-based access.

Does the Supabase service-role key bypass row-level security?

Yes, for reads and writes through the REST API — that’s intentional, so backend code can act with elevated privileges. But the service-role key can’t run schema changes (DDL); that requires a direct Postgres connection through the session pooler.

What is pgvector, and why does it matter?

pgvector is a Postgres extension, enabled by default on Supabase, that lets you store and query vector embeddings directly in your existing database. It means teams building AI features like semantic search or retrieval-augmented generation don’t need to stand up and sync a separate vector database.

How does Supabase pricing compare to Firebase at scale?

Supabase tends to be cheaper and more predictable as usage grows, because it bills on a flatter tiered model rather than per read/write operation. Comparisons put the cost crossover around 2.8 million reads a day, with Firebase costing several times more than Supabase by around 10 million reads a day.

What are Supabase Edge Functions built on?

They run on the Deno runtime at edge locations, letting you execute custom server-side JavaScript/TypeScript logic — webhooks, third-party API calls, anything that needs to run outside client code — without provisioning a separate server.

Is Supabase good for mobile app backends?

It works for mobile backends, but Firebase remains the more mature choice specifically for offline-first or heavily real-time collaborative mobile apps, where its sync engine and SDK depth are more established. Supabase’s Realtime service handles live updates well but isn’t built around the same offline-sync model.

Who founded Supabase and when?

Paul Copplestone and Ant Wilson founded Supabase in January 2020 after meeting through the Entrepreneur First program in Singapore, and the company went through Y Combinator’s Summer 2020 batch before raising successive funding rounds that took its valuation to a reported $5 billion by late 2025.

Verdict

Supabase is a strong choice when your data is genuinely relational, when you want row-level security enforced consistently across every access path, or when you’re building AI features that benefit from vector search living next to your relational data — and its Postgres foundation plus open-source licensing give it a real advantage in avoiding vendor lock-in. It’s a weaker fit if your priority is offline-first mobile sync, where Firebase’s more mature real-time engine still has an edge. Budget time for the IPv6 connection quirk before your first local setup, and treat the Pro plan’s $25 as a starting point instead of a ceiling once real traffic and storage enter the picture.

See Supabase’s full profile, pricing, and verified reviews on Spotsaas, listed under Database as a Service (DBaaS) Provider alongside its competitors.

Sources

• Supabase — Pricing (checked July 2026)
• Supabase — Documentation
• TechCrunch — Supabase raises $6M seed (2020)

Pricing verified July 2026 via Supabase’s published pricing page, cross-checked against third-party comparison coverage. Features and prices change; this reflects the product as of July 2026. Written by the Spotsaas team, based on our own migration and connection experience.