What Is Supabase? Free Plan, Pricing, Paused Projects, RLS and pgvector
In Supabase you create a project and set up your tables; each project gets its own Postgres database, plus user sign-in, file storage, Edge Functions and vector search with pgvector. The moment you create a table, an automatic API is ready; n8n, a chatbot or a dashboard writes and reads data through that API. The free plan has 2 active projects and a 500 MB database, but a project that stays inactive for 7 days is paused. Pro starts at $25 a month. The interface is in English; there is no data region in Turkey.
- What it does
- A backend that gives you database, auth and storage out of the box
- Pausing
- Free projects pause after 7 days of inactivity
- Security
- RLS must be turned on manually for each table
- Open source
- Apache-2.0; runs on your own server
- Turkey
- No region; European regions available
- Free plan
- 2 active projects, 500 MB, 50,000 MAU
- Price
- Pro from $25/month · Team $599/month
What is Supabase used for?
An app or automation needs somewhere to keep its data: incoming leads, customer records, a chatbot's conversation history, dashboard numbers. Supabase gives you that without setting up a server. Each project is a separate Postgres database (Postgres: a widely used, open-source SQL database). When you create a table, the API to access it is ready automatically.
Postgres tables, SQL Editor and table editor; automatic API.
User sign-in with email or social accounts; works together with Row Level Security.
Stores documents and images.
Small server-side functions; this is where the secret key is used.
Who it suits: businesses and agencies building chatbot memory, a lead or CRM table, a customer portal or a RAG knowledge base (where a bot searches your own documents when answering). The dashboard works without code; a secure setup requires basic SQL and an understanding of permissions.
How do you get started with Supabase?
- Sign up: Create an account at supabase.com; an organization is created.
- Create a project: Choose a project name, database password and region. The region determines where the primary data lives and can't be changed in place later; changing it requires migrating to a new project.
- Create the table: In the Table Editor, or in the SQL Editor with the sample SQL below.
- Turn on RLS: Row Level Security must be on for every table; details in the "Security" section.
- Connect: Enter the project URL and the right key (publishable for an app, secret for a server such as n8n) in the tool you're connecting. The keys are in the Connect dialog.
If you want to manage tables from an AI assistant (Claude Code, Cursor), you can connect Supabase's MCP server.
Supabase MCP: guide to connecting an assistant to your project
How do you use Supabase? Ready-made example: a lead table
Example: n8n writes leads from your website or WhatsApp bot into a table, and a dashboard reads from that table. Run the SQL below in the SQL Editor. The table stays locked by RLS; n8n writes to it server-side with the secret key.
› create table public.leads (
id bigint generated always as identity primary key,
created_at timestamptz not null default now(),
name text not null,
phone text,
email text,
source text, -- 'site', 'whatsapp', 'instagram'
status text not null default 'new'
);
-- 1) Turn on RLS: no data comes back with the publishable key until a policy is written
alter table public.leads enable row level security;
-- 2) Revoke the client roles' privileges (adding a policy does not remove them)
revoke all on public.leads from anon, authenticated;
-- n8n writes to this table server-side with the secret key;
-- the secret key bypasses RLS and never goes in a browser or app.This SQL is an example. The order "enable RLS, then set permissions" comes from the Supabase RLS documentation. If team members who sign in to the dashboard need to read the data, a SELECT policy is written separately.
pgvector is a Postgres extension that stores vectors and runs similarity searches; in Supabase it is called vector. You split your documents into chunks and store each chunk's embedding (a numeric representation of the text); when a question comes in, the bot finds the most similar chunks and adds them to its answer. The Supabase documentation recommends this for RAG.
- In the dashboard, go to Database › Extensions.
- Search for "vector" and enable the extension.
- Create a table with an embedding column (the column dimension depends on the embedding model you use).
What is RLS? Keys and the "RLS disabled" warning
Row Level Security (RLS) is an access rule that runs inside the database: "who can see this row, who can change it". The Supabase documentation is clear: in an exposed schema (one served through the API), a table with RLS turned off can be read and written by any role that has privileges. The documentation's instruction is to turn on RLS for every table in an exposed schema.
| Key | Where it's used | What it does |
|---|---|---|
| Publishable (sb_publishable_…) | Browser, mobile app, public code | Reaches only the data RLS allows |
| Secret (sb_secret_…) | A place you control, such as a server, Edge Function or n8n | Bypasses RLS and reaches all of the project's data |
| Legacy anon / service_role | Older projects | The older forms of the publishable and secret keys, respectively; being removed by the end of 2026 |
!Supabase's wording for the secret key: "It bypasses Row Level Security, so it must never leave your control." Never put the secret or service_role key in your site's code, a mobile app or a public repository.
If an article or AI assistant tells you to "copy the long key starting with eyJ", it was written for the legacy key system. In new projects, use the sb_publishable_ and sb_secret_ keys.
Is Supabase free? Limits, Pro pricing and pausing
- Up to 2 active projects
- 500 MB database, 1 GB file storage
- 50,000 monthly active users
- 5 GB egress + 5 GB cached egress
- 500,000 Edge Function invocations
- Automatic backups
- Branching
- Paused after 7 days of inactivity
- First project included, extra projects from $10/month
- $10 compute credit (one Micro project)
- 100,000 MAU, 8 GB disk, 250 GB egress, 100 GB file storage
- Daily backups (7 days), email support
- Never paused
- SOC 2 and ISO 27001 reports
- SSO for the dashboard
- 14-day backups, 28-day logs
Enterprise has custom pricing. Prices are in US dollars only. Supabase says it has started adding taxes such as VAT to invoices in countries where required; there is nothing specific to Turkey.
Supabase pauses Free projects that show low activity for 7 days. A warning email arrives about a week before. You can bring a paused project back within 1 year with Resume project in the dashboard; data and settings come back. Projects on a paid plan are not paused.
According to the documentation, a few database requests a day over the last week are usually enough, but no exact threshold is given. A live setup built for a client shouldn't depend on a Free project; move to Pro.
| Extra cost item | Official price (October 22, 2026) |
|---|---|
| Compute (server power) | Hourly; Micro $0.01344 (~$10/month), Small ~$15, Medium ~$60. Partial hours count as full hours. |
| Monthly active user overage | $0.00325 per MAU |
| Disk overage | $0.125 per GB |
| Egress (outbound data) overage | $0.09 per GB; cached $0.03 |
| File storage overage | $0.0213 per GB |
| Custom domain | $10 a month |
| PITR (point-in-time recovery) | $100 a month per 7 days of retention |
| Branching (development branch) | $0.01344 per branch per hour |
!On Pro, the Spend Cap is on by default: an item that goes over stops until the next billing period, and no charge is added. But compute hours are not covered by the cap; extra projects or larger compute raise the bill regardless of the cap.
Official pricing page last checked on .
Is Supabase open source? Can I self-host it?
Yes. The main repository is Apache-2.0 licensed, and Supabase recommends Docker as the official way to self-host. This route is for those who want to keep data entirely on their own infrastructure.
- A self-hosted install runs a single project; the dashboard does not support multiple projects or organizations.
- Platform features such as branching, managed backups and PITR, and the Management API are not available.
- Server setup, security updates, backups, monitoring and high availability are on you.
- Self-hosted Supabase does not send telemetry.
!The Supabase CLI's local development environment is not self-hosting; the documentation says not to expose it to outside traffic.
Where is my data stored? Regions, GDPR and KVKK
| Data region in TurkeyNo | Turkey is not on the list. In Europe there are Frankfurt, Zurich, Stockholm, Ireland, London and Paris regions. |
|---|---|
| Turkish interfaceUnclear | No official language list; the dashboard and docs are in English. |
| DPA (data processing agreement)Yes | Includes the EU Standard Contractual Clauses (SCCs). |
| SOC 2 Type 2Yes | Annual audit; report access on the Team plan. |
| KVKK-specific wordingNo | The documentation does not mention KVKK (Turkey's Personal Data Protection Law). |
A project is set up in a single primary region; the database, auth and storage live there. The general "Europe" group also covers London and Zurich, which are not in the EU; if data must stay inside the EU, choose a specific EU region. Supabase says that choosing a region alone does not make you GDPR compliant, and that backups, logs and subprocessors must also be taken into account. The privacy policy says personal data may be transferred to countries including the US and Singapore.
In Turkey, keeping customer data on a server outside the country counts as a cross-border transfer under Article 9 of KVKK (Turkey's Personal Data Protection Law). Since the 2024 amendment, if there is no adequacy decision, one of the appropriate safeguards is required; one of these is the standard contract published by the KVKK Board, which must be reported to the Authority within five business days of signing. Supabase's DPA includes the EU SCCs; there is no wording about the KVKK standard contract.
Source: Law No. 6698, Article 9 (mevzuat.gov.tr) and the Supabase DPA. This is not legal advice; if you will process personal data, consult an expert.
Common issues and fixes
| What happens | What to do |
|---|---|
| My project was paused | Select the project in the dashboard and click Resume project. It can be restored within 1 year of being paused. To keep it from happening again, move to Pro. |
| "RLS disabled in public" warning | There is a table with RLS turned off in an exposed schema; it may be open to anyone with privileges. Turn it on with alter table … enable row level security, then write the policies you need. |
| I turned on RLS and no data comes back in my app | Expected: once RLS is on, no data comes back with the publishable key until a policy is written. Add a SELECT policy for reads. |
| Error 42501 | According to the documentation, the role has no privilege (grant) on the table; privileges are checked before policies run. Check the grants first. |
| My bill is higher than expected | Compute hours fall outside the spend cap; extra projects and a larger compute size raise the bill. Check your organization's Usage page. |
| I picked the wrong region | It can't be changed in place; you need to create a project in the new region and migrate from a backup. |
Frequently asked questions
What is Supabase and what is it used for?
A ready-made backend built on a Postgres database. It gives you tables, user sign-in, file storage, Edge Functions and vector search with pgvector in a single project; once you create a table, the API is ready.
Is Supabase free?
Yes, there is a Free plan: up to 2 active projects, a 500 MB database per project, 1 GB file storage, 50,000 monthly active users. There are no automatic backups, and a project that stays inactive for 7 days is paused.
How much does Supabase cost?
Pro starts at $25 a month; the first project and $10 of compute credit are included, and extra projects start at $10 a month. Team is $599 a month. Prices are in US dollars only.
Why was my Supabase project paused?
Free projects are paused after showing low activity for 7 days. You can restore them within 1 year with Resume project in the dashboard; projects on paid plans are not paused.
What is Supabase RLS?
Row Level Security is a row-level access rule. A table with RLS turned off can be read and written by any role that has privileges; Supabase tells you to turn on RLS for every table in an exposed schema.
What are the anon key and the service_role key?
The anon key (now called publishable) is used in public code and reaches only what RLS allows. The service_role key (now called secret) bypasses RLS; use it only on a server.
Can you build RAG with Supabase?
Yes. The pgvector extension stores embeddings and runs similarity searches; the Supabase documentation recommends it for RAG.
Where is Supabase data stored?
In the region you choose when creating the project. There is no region in Turkey; in Europe there are regions such as Frankfurt, Zurich and Stockholm.
Can I self-host Supabase?
Yes, it is Apache-2.0 licensed and officially installed with Docker. Platform features such as branching and managed backups are not included, and maintenance is on you.
Related guides
Sources
- Supabase pricing
- Project Pausing
- Compute usage
- Spend cap
- Row Level Security
- API keys
- pgvector
- Regions
- GDPR
- DPA
- Self-Hosting
- Law No. 6698 on Personal Data Protection (KVKK), Art. 9
Not clear in the official sources: The exact activity threshold that prevents pausing · the lowest-latency region from Turkey · how VAT applies in Turkey · the KVKK standard contract · a Turkish interface. Each is covered in its section with what you can do.