Supabase hosting and consulting

Self-hosted Supabase on Google Cloud or AWS

This is for teams that like Supabase but can't stay on Supabase Cloud. The usual reasons are data that has to live in your own cloud account, a database that must stay off the internet, an audit, or the cost of running a large database.

We design, build and run self-hosted Supabase in your cloud account, and we already run it in production. We moved Hexis off hosted Supabase to its own Google Cloud (GCP) setup, defined in Pulumi, and wrote up how we did it.

The first call is free. After it, you get a fixed-price quote or hourly work at $100 to $150 an hour.

Fixed price: Supabase on Google Cloud in two weeks

For a new project, or one small enough to move in a day, we set up self-hosted Supabase in your own Google Cloud project in two weeks. It's a fixed price, from $8,000, and you get the exact figure in writing before we start.

PostgreSQL

Cloud SQL for PostgreSQL on a private network, with backups and point-in-time recovery switched on and a restore tested before handover.

Supabase

The Supabase services your app uses, with Studio reachable only through a VPN and Cloud Armor.

Infrastructure as code

Every resource defined in Pulumi in your repository, with dev and prod stacks and secrets kept out of Git.

Handover

A runbook for upgrades, restores and access changes, and a call to walk your team through it.

Moving an existing Supabase Cloud project with live users, or adding regions, gets its own fixed quote once we've seen it.

Supabase Cloud or self-hosted?

Supabase Cloud is a good product, and for most teams it's the right place to host Supabase. It handles backups, patches, scaling and monitoring, and for a small project it costs less than running your own. Self-hosting makes all of that your job, or ours. If you don't need it, we'll tell you on the first call. To compare the costs for your project, use our Supabase pricing calculator.

Stay on Supabase Cloud if

  • You're building an MVP or still looking for product-market fit.
  • Its regions and compliance options already meet your contracts.
  • Nobody wants to own database upgrades, restores and alerts.

Self-host when

  • The data has to live in your own cloud account, in a region you choose.
  • The database and admin tools must never be reachable from the internet.
  • You need Cloud SQL Enterprise Plus or several regions, or you already pay for a large database, so the open-source Supabase pieces add little on top.

How we set it up

This is the design we run on Google Cloud. On AWS the same pieces map to RDS or self-managed PostgreSQL, a load balancer, AWS WAF and a VPN. We've built on AWS too, for RYOT.

PostgreSQL on a private network

Cloud SQL for PostgreSQL 18 on Enterprise Plus, with no public IP, a standby in a second zone and point-in-time recovery.

Cloud SQL's limits, checked first

Cloud SQL has no superuser and no pg_graphql, pg_net or Supabase Vault. When Hexis needed pg_net for webhooks, it went on a PostgreSQL node we run on Compute Engine.

Studio across two zones

Supabase Studio and postgres-meta run in a managed instance group that replaces failed instances and rolls out updates without downtime. Our Pulumi template for this part is open source on GitHub.

VPN-only access

Cloud Armor and a VPN sit in front of the load balancer, so knowing the URL isn't enough to get in.

Everything in Pulumi

Every resource is TypeScript, built from Pulumi components, with dev and prod stacks and secrets from Infisical, never Git.

More regions when you need them

For Hexis we run PostgreSQL in three writable regions, synced with pglogical, with a scripted process for schema changes.

Moving off Supabase Cloud

Auth needs the most care in a migration. Supabase matches OAuth sign-ins to linked identities, not just email addresses, so identities have to move with the users. We learned that fixing Apple Sign In with Hide My Email.

  1. Inventory

    Schemas, RLS policies, extensions, Auth users and providers, Storage buckets, Edge Functions, webhooks and cron jobs.

  2. Rehearse

    We build the new environment with Pulumi and copy your data into it, so we know what moves and how long it takes.

  3. Cut over

    In a quiet window we pause writes, copy the last changes, point your app at the new stack and check that the data matches.

  4. Keep a way back

    Your Supabase Cloud project stays as it was until you're confident in the new setup.

What you get

SupabasePostgreSQLGoogle CloudCloud SQLPulumiCloud Armor

Architecture plan

A written design for the database, network, access, backups and running cost, agreed before we build.

Pulumi code in your repository

Every resource defined in TypeScript, with separate dev and prod stacks.

Private network and VPN

No public database endpoint. Studio and internal tools sit behind a VPN and Cloud Armor.

Backups you've restored

Automated backups and point-in-time recovery, plus a restore we've actually run.

Migration from Supabase Cloud

Data, Auth users and identities, Storage files and functions, moved in a rehearsed cut-over.

Runbooks and support

Written steps for upgrades, restores and access changes, and hourly support after launch.

What we've done for clients

Hexis

Rebuilding the platform behind elite sports nutrition

We moved Hexis off hosted Supabase to its own Google Cloud setup, defined entirely in Pulumi. The API runs in Europe, the US and Australia behind a global load balancer, PostgreSQL replicates across regions, and internal tools sit behind a VPN. Only the load balancer is public.

Read the Hexis case study

How a project starts

From a free call to the end of the second week.

01

A free 30-minute call

Tell us what you run on Supabase today and why you're looking at self-hosting. If Supabase Cloud would serve you better, we'll say so.

02

A fixed price, or hourly

After the call we send a fixed-price quote for a clear scope, or agree on hourly work at $100 to $150 an hour. A new self-hosted Supabase setup on Google Cloud is a two-week, fixed-price project from $8,000. A migration with live users gets its own fixed quote, and support after launch is hourly.

03

The first two weeks

  • We review your Supabase project: schema, extensions, Auth providers, Storage, functions and traffic.
  • We agree on the target design, region and access model, and write it down.
  • We stand up a dev environment in your cloud account with Pulumi and load a first test copy of your data.

Frequently asked questions

What do you give up by self-hosting Supabase?

Studio, Auth, the REST API, Realtime, Storage and Edge Functions all run self-hosted. You lose the platform around them: a self-hosted install is a single project, with no branching, no Management API, no managed backups and no support from Supabase. With the database on Cloud SQL, Google provides backups and point-in-time recovery instead.

How does a Supabase migration to self-hosted work?

We inventory what you use, rehearse the move on a copy of your data, then cut over in a planned window. Auth identities move with the users, so Apple and Google sign-ins still find the right account.

Is self-hosted Supabase HIPAA compliant?

Not on its own. Supabase's HIPAA controls don't come with a self-hosted install, and compliance depends on how the system is built and run. On Google Cloud the BAA is with Google, and it covers the services this design uses, such as Compute Engine, Cloud SQL and Cloud Armor. Supabase Cloud also offers a BAA on its higher plans. This is engineering, not legal advice, and our HIPAA and SOC 2 engineering page covers the wider work.

Does self-hosting help with SOC 2?

You don't need to self-host to get a SOC 2 report. If you do, the database joins your audit scope, so access, changes and backups need evidence. We built those controls into Hexis's platform and are leading its SOC 2 audit, which is in progress.

Can our Supabase data stay in the EU?

Yes. Everything runs in the region you choose, inside your own cloud project, backups included. Supabase Cloud also has European regions, and if one already meets your contracts, that's simpler.

Do you offer managed Supabase after launch?

Yes, billed hourly. Self-hosted Supabase comes with no support from Supabase, so someone has to own upgrades, restore tests, monitoring and fixes. We're a small studio, so we agree on response times up front instead of promising round-the-clock cover.

Related services

HIPAA & SOC 2 Engineering

The engineering side of HIPAA and SOC 2: access control, audit logging, encryption, infrastructure as code, vendor BAAs and evidence for your auditor.

Technical Consulting

Fractional CTO work from a working CTO: technical direction, hiring, investor questions and hands-on help, billed hourly.

Web App Development

SaaS products and MVPs in Next.js, React and Node.js, with the data model, infrastructure and deploys done properly from the start.

From our blog

Thinking about self-hosting Supabase?

Tell us what you run today. In 30 minutes we can usually tell you whether self-hosting is worth it, and whether the two-week setup fits.