What is Supabase? Postgres backend explained
The backend under a large share of AI-built apps, Lovable's included. Here is what it is and where its defaults stop.
In short
Supabase is an open-source backend platform built on PostgreSQL that gives an app a Postgres database with an instant API, user sign-in, file storage, realtime updates and server-side functions in one project. Lovable Cloud, Lovable's built-in backend, is built on Supabase's open-source foundation.
What is inside a Supabase project?
A Supabase project is one Postgres database with a set of open-source services around it. Supabase does not hide Postgres behind its own layer, so you can use the database with full privileges. Each service handles one job, and all of them read and write the same database.
- PostgREST turns the database into a REST API the browser can call; pg_graphql adds GraphQL.
- Auth (GoTrue) manages users and issues tokens that work with row-level security.
- Realtime streams database changes and messages over WebSockets.
- Storage keeps files in S3-compatible storage, with their details in Postgres.
- Edge Functions run server-side TypeScript on Deno.
What does a Supabase project need before real users arrive?
Supabase exposes your database through an API the browser can call directly. That makes it fast to build on, and it is why one setting matters most: row-level security. Supabase's own documentation says to enable it on every table in an exposed schema, because once it is on, no data is reachable with the public key until you write policies.
The rest of production readiness is the usual list, applied to Supabase: keep the secret key on the server, make schema changes through versioned migrations, confirm backups and point-in-time recovery match what you can afford to lose, and watch the logs.
How do Supabase's publishable and secret keys differ?
The publishable key is built to be public and is safe in a browser, because it only reaches what row-level security allows. The secret key is for servers only and bypasses every policy. Supabase blocks secret keys sent from a browser, and older projects call them the anon and service_role keys.
Supabase is deprecating the legacy anon and service_role keys by the end of 2026, and creating new keys does not switch the old ones off; you deactivate them separately. Our entry on the anon key and the service role key covers the difference in more depth.
What mistakes do teams make with Supabase backups and changes?
The usual mistakes are changing the live database by hand and assuming backups cover everything. Supabase's documentation says to make all schema changes through migration files, because direct changes on the remote database break the migration history and make later pushes fail.
- Free projects are not part of the daily backup scheme; Supabase recommends exporting your data regularly with the CLI.
- Pro keeps 7 days of daily backups, Team 14 and Enterprise up to 30.
- Backups do not include stored files, only the database's record of them.
- The project is unavailable while a restore runs, and downtime grows with database size.
Supabase or Lovable Cloud?
Lovable Cloud is the managed route inside Lovable. A Supabase project of your own gives you direct control of settings, billing and access. Either way, the database underneath is PostgreSQL, which keeps your data portable. If you want help checking a live project, start with the production readiness check.
Common questions
Is Supabase secure?
The platform gives you the tools; the app decides whether they are used. The most common gap is a table exposed without row-level security policies. Supabase's documentation says to enable it on every table in an exposed schema, and the secret key must stay on the server.
Is Supabase open source?
Yes. Supabase says everything it uses is open source: Postgres, PostgREST, its Auth server, Realtime, Storage and Edge Functions each carry an open-source licence. Its cloud service is compatible with the self-hosted version, and it relies on standards such as pg_dump and CSV files for moving data in and out.
Is the Supabase anon key safe to put in my app?
Yes, by design. The anon key, now called the publishable key, only reaches what row-level security allows, so it is safe in browser code. The service_role or secret key is the dangerous one: it bypasses every policy and must only ever be used on a server.
Does Supabase back up my database?
On paid plans, yes. Pro, Team and Enterprise projects get daily backups, kept for 7, 14 and up to 30 days. Point-in-time recovery is a paid add-on. Free projects should export data themselves with the CLI. Backups do not include stored files, only the database.
Go deeper
How to migrate off Lovable Cloud to your own SupabaseLovable Cloud vs your own Supabase, what the export includes and leaves behind, and a cutover plan that keeps production running.
Related terms
Read next
Sources
- Supabase documentation: Row Level Security
- Supabase documentation: API keys
- Lovable documentation: Lovable Cloud
- Supabase documentation: Architecture
- Supabase documentation: Database backups
- Supabase documentation: Database migrations
Sources checked October 24, 2026
More on this: Production architecture & security · All glossary terms
Built something in Lovable you want people to rely on?
We are the engineers who take it the rest of the way — secured, tested, released and supported.
