We built 20+ projects on Supabase — here's what we learned

When we started ZORC, we tested everything: Firebase, PocketBase, Appwrite, Convex. Then we landed onSoup base— and have used it in every client project since.

This guide is not a "what is Supabase?" article. It is a practical review based on real projects we have delivered.

What is Supabase?

Supabase is an open source platform that gives you a full PostgreSQL database, authentication, real-time subscriptions, edge functions, storage and vector embeddings — all through a single dashboard and SDK.

Think Firebase, but with:

  • Real PostgreSQLinstead of NoSQL
  • Row Level Security (RLS)directly in the database
  • No vendor lock-in— you own the data and can self-host

Why we chose Supabase over Firebase

Firebase Soup base
Database Firestore (NoSQL) PostgreSQL (SQL)
Vendor lock-in High (Google) None (open source)
Pricing Unpredictable when scaling Transparent, fixed plans
RLS Firestore rules (own syntax) PostgreSQL policies (SQL)
Real time Good Good (Postgres Changes)
Edge Functions Cloud Functions Deno-based Edge Functions
AI/Vectors Manually pgvector built-in
GDPR Complicated (US data) EU hosting available

The decisive factor for us:GDPR. Many of our customers require EU storage. Supabase offers regions in Frankfurt and Stockholm — Firebase doesn't make it as easy.

How we set up a Supabase project on ZORC

1. Database design first

We always start with the data model. Supabase has a built-in SQL editor where we can create tables, relationships and RLS policies directly.

ZORC principle:We always write migration files, never manual changes in the dashboard in production.

2. Row Level Security from day one

RLS means that the database itself controls who can see and change the data. It's not an extra layer — it's security.

-- Users can only see their own orders
CREATE POLICY "Users see own orders" ON orders
  FOR SELECT USING (auth.uid() = user_id);

Why it matters:Without RLS, a misconfigured API is enough to expose all customer data. With RLS, the data is protected even if the API has a bug.

3. Real time for interactive features

Supabase Realtime allows you to subscribe to database changes via WebSocket. We use it for:

  • Live dashboards— data is updated without page loading
  • Collaborative tools— multiple users see changes instantly
  • Notifications— triggered by INSERT/UPDATE in the database

4. Edge Functions for business logic

Supabase Edge Functions run on Deno Deploy — global, close to the user. We use them for:

  • Stripe webhooks
  • E-mail sending via Resend
  • AI integrations (OpenAI, Anthropic)
  • Third Party Integrations

5. Storage with policies

Supabase Storage works like S3, but with the same RLS model. Perfect for user uploads with automatic access control.

Real ZORC projects built on Supabase

  • E-commerce platform— 50,000+ products, real-time inventory, Stripe payments
  • SaaS document management— RLS-protected documents per organization
  • Booking platform— real-time update of available times
  • AI tools— pgvector for semantic search in 100,000+ documents

5 mistakes we made (so you don't)

  1. Skipped RLS in the development phase.Resulted in a panic write before launch. Now: RLS from commit #1.
  2. Used client SDK for heavy queries.Move complex logic to Edge Functions instead.
  3. Ignored database indexes.A query went from 3 seconds to 15 ms with the right index.
  4. Stored images in the database.Use Supabase Storage, not base64 in columns.
  5. Manual migration in production.Always usesupabase db pushwith versioned migrations.

When Supabase is NOT the right choice

  • You need graph data→ Use Neo4j
  • Extremely high write frequency (100k+ writes/s)→ Consider ScyllaDB or DynamoDB
  • You never want to think about database→ Firebase may still be easier for prototyping

Get started

Do you want to build with Supabase but need help with architecture, security or scaling?Book a meeting with us— we are happy to share what we have learned in 20+ projects.