Supabase Startup Diligence Research Report
The diligence thesis is a high-growth, developer-led Postgres platform with substantial open-source/community distribution and expanding enterprise packaging; the investment case depends on whether community adoption converts into durable paid ARR with healthy infrastructure margins and manageable reliability/privacy obligations.
Supabase Startup Diligence Research Report
Supabase is eligible for a private-unicorn diligence report: public evidence verifies active/private status and a company-announced $100M Series E at a $5B pre-money valuation. Product, developer-community and open-source traction are strong, while audited financials, cap table, revenue quality, customer concentration, legal schedules and enterprise contract economics remain the core diligence gaps.
Latest public $5B pre-money valuation follows a reported $2B Series D within months, while audited financials, ARR, burn and debt are not public.
Diligence request: Request audited financial statements, board packages, ARR bridge, burn, runway, debt, option pool and round documents.
Oriole/pluggable-storage and decoupled compute/storage ambitions are strategically valuable but carry integration and reliability risk.
Diligence request: Request R&D roadmap, incident history, architecture review, migration plans and performance benchmarks.
Customers retain responsibility for data, RLS, secrets, access management and production readiness; customer mistakes can become reputational or support incidents.
Diligence request: Review security-advisor adoption, default configurations, education, support tickets and incident root causes.
Customer logos and case studies are public, but revenue concentration, contract terms, churn and implementation satisfaction are not.
Diligence request: Request top-25 customer revenue schedule, contracts, renewals, churn cohorts and independent reference calls.
Pricing exposes Supabase to infrastructure cost, support and egress variability; realized margins are not public.
Diligence request: Request gross margin by product/tier, cloud COGS, egress exposure and pricing cohorts.
Large public repo traction and open issues imply community scale and support burden.
Diligence request: Review maintainer coverage, security response SLAs, contributor license controls and backlog aging.
Stars, community members and developer counts are strong top-of-funnel signals but not proof of paid conversion or retention.
Diligence request: Request funnel metrics: free-to-paid conversion, activation, NRR, churn, CAC and cohort retention.
Public headcount signals range from 280+ team members to 357 visible LinkedIn employees across many countries.
Diligence request: Request HRIS export, attrition, regretted loss, offer acceptance, compensation bands and country-by-country employer-of-record setup.
Funding and valuation are strongly evidenced; operating financials and capital structure remain private.
not publicly verifiable confidence: low
Public sources verify funding and pricing signals but not audited financials, management accounts, backlog or AR aging.
| metric | public signal | verification status | private request |
|---|---|---|---|
| ARR / revenue | Not disclosed in public sources reviewed | not_publicly_verifiable | Audited financials, ARR by month and revenue recognition memo |
| Pricing | Free, Pro $25+, Team $599+, Enterprise custom | verified | Actual ACV, discounting and overage revenue by cohort |
| Gross margin / COGS | Compute and egress pricing exposed publicly; realized COGS not disclosed | not_publicly_verifiable | Cloud spend, support cost, gross margin by product and customer |
| Backlog / AR aging | No public disclosure | not_publicly_verifiable | Backlog, deferred revenue and AR aging schedules |
not publicly verifiable confidence: low
Pricing mechanics and growth signals are visible; projections, business predictability and external financing assumptions are private.
not publicly verifiable confidence: low
Public eligibility suggests a privately held company; shareholder, option, warrant, debt and off-balance-sheet schedules are not public.
| stakeholder | public position | evidence | diligence caveat |
|---|---|---|---|
| Accel / Peak XV | Series E lead investors | Company Series E blog | Share class, liquidation preference, board rights and ownership percent private |
| Figma | Joined Series E | Company Series E blog | Strategic rights or commercial agreements unknown |
| Employees | Eligible for recurring secondary sale of 25% of vested stock per round per company blog | Company Series E blog | Plan documents, option pool and tender terms private |
| Public market investors | None observed | LinkedIn Privately Held; YC Active | Confirm no confidential IPO/acquisition process |
verified confidence: medium
Funding history is the strongest public financial evidence: $200M Series D snippet at $2B and company-announced $100M Series E at $5B pre-money.
| date | round | amount | valuation | lead or participants | verification |
|---|---|---|---|---|---|
| 2025-04-22 | Series D | $200M | $2B | Not fetched; Fortune/Yahoo snippet only | partially_verified |
| 2025-10-03 | Series E | $100M | $5B pre-money | Accel and Peak XV led; Figma joined; YC, Coatue, Felicis, Craft, Square Peg existing investors | verified |
| pre-2025 | Prior rounds | Not itemized publicly in this screen | not_publicly_verifiable | YC and other existing investors referenced | not_publicly_verifiable |
Product scope and pricing are public; margins, roadmap economics and production performance need company data.
verified confidence: medium
Supabase is publicly positioned as a Postgres development platform with database, auth, APIs, realtime, storage and edge functions; production-readiness guidance shows mature controls and customer responsibilities.
| product or module | audience | public features | evidence status |
|---|---|---|---|
| Postgres database platform | Developers / teams | Dedicated/isolated Postgres clusters and database setup | verified |
| Authentication and user management | App developers | Authentication, RLS guidance, MFA/production controls | verified |
| Realtime, APIs, Storage, Edge Functions | Web/mobile/AI apps | Realtime subscriptions/streams, instant APIs, storage and edge functions | verified |
| Enterprise platform features | Enterprise teams | SSO, SLAs, 24x7x365 support, compliance and custom security questionnaires | verified |
| tier | monthly price | included or highlighted features | diligence note |
|---|---|---|---|
| Free | $0 | 50k MAU, 500MB database, 5GB egress, community support | PLG acquisition; cost of free users must be measured |
| Pro | From $25 | 100k MAU, 8GB disk, 250GB egress, email support, 7-day backups/logs | Usage overages can drive ARPU and bill shock risk |
| Team | From $599 | SOC2/ISO, SSO, priority support, 14-day backups, 28-day logs, HIPAA add-on | Compliance monetization signal; attach rate not public |
| Enterprise | Custom | Designated support, uptime SLAs, BYO cloud, 24x7x365 support, private Slack | Enterprise contract terms and SLA credit exposure private |
| control area | public guidance | risk if weak | verification |
|---|---|---|---|
| Data access | Enable RLS and policies | Customer data exposure through misconfiguration | verified |
| Network/security | SSL enforcement, network restrictions, MFA | Unauthorized access or weak account controls | verified |
| Performance | Indexes, load testing, resources | Production outage or degraded application performance | verified |
| Shared responsibility | Customer responsible for data/schema/access/security controls | Support/reputation risk despite customer fault | verified |
Customer logos and cases are public; concentration, contracts, churn and supplier economics are not.
partially verified confidence: medium
Company-owned customer stories identify a broad set of logos and use cases, but top-15 customer revenue is not public.
| customer | use case or outcome | source quality | revenue verified |
|---|---|---|---|
| Udio | AI music platform scaling/support collaboration | Supabase/customer-story snippet | No |
| eXp Realty | 2,000+ non-technical employees build production software; replacing millions in SaaS contracts per snippet | Supabase/customer-story snippet | No |
| Kayhan Space | Satcat space-operator tooling; 8x developer-speed improvement per snippet | Supabase/customer-story snippet | No |
| Phoenix Energy | Full-stack migration from MongoDB ahead of deadline with zero downtime per snippet | Supabase/customer-story snippet | No |
| Other listed logos | Chatbase, Brevo, GovSignals, Rally, Deriv, Resend and others on customer index | Company marketing index | No |
partially verified confidence: medium
Public case studies and investor/customer ecosystem evidence indicate strategic relationships; contractual economics remain private.
| relationship | nature | public evidence | gap |
|---|---|---|---|
| Figma | Series E strategic/financial investor | Figma joined Series E | Commercial terms or product integration not disclosed |
| Open-source communities | Postgres, PostgREST, pgvector, Deno, Phoenix/imgproxy ecosystem alignment | 100k stars blog credits communities/tools | Sponsorship/maintainer contracts not fully public |
| YC / Accel / Peak XV / existing investors | Capital and network | Series E blog and YC profile | Governance rights and investor support not public |
not publicly verifiable confidence: low
No public customer revenue concentration, ARR contribution or 5% customer disclosure was found.
not publicly verifiable confidence: low
No public evidence of severed major customer or supplier relationships was found; requires management certification.
verified confidence: medium
AWS-region documentation indicates a material cloud infrastructure dependency; supplier spend and contract terms are private.
| supplier or dependency | role | public evidence | concentration risk |
|---|---|---|---|
| AWS regions | Project deployment regions | Docs list AWS regions and one primary region per project | High if cloud terms/outages/data residency not managed |
| OAuth/SAML/SMTP/SMS/external APIs | Customer integrations | Shared responsibility docs reference these third-party services | Customer integration outages can affect projects |
| Open-source components | Platform foundation | Postgres, PostgREST, pgvector, Deno and Phoenix cited by company blog | License/security/maintainer risk; open-source governance required |
Competitive position is credible but crowded; win/loss and market share are not public.
verified confidence: medium
Supabase competes in developer backend/database platforms against cloud, open-source and Firebase-like alternatives; positioning rests on Postgres/open-source/developer experience.
| competitor | segment | product overlap | supabase differentiator | evidence basis |
|---|---|---|---|---|
| Firebase / Google Cloud | Backend-as-a-service | Auth, database, functions, storage | Open-source and Postgres-first positioning | Supabase product/GitHub/pricing evidence; competitor details analyst judgment |
| Neon | Serverless Postgres | Managed Postgres developer database | Broader app-backend suite and community | Analyst market comparison |
| PlanetScale / cloud databases | Developer databases | Managed database workflows | Postgres app platform vs database-only | Analyst market comparison |
| AWS/GCP/Azure native services | Hyperscale cloud | Databases, auth, storage, functions | Integrated developer experience and open-source community | Supabase docs/pricing plus analyst judgment |
| axis | supabase position | risk or gap | evidence |
|---|---|---|---|
| Developer experience | Strong public signal from GitHub/community and product-led packaging | Needs paid conversion evidence | 102k+ stars; free tier; docs/blog |
| Enterprise readiness | Improving with Team/Enterprise, SOC2/ISO mention and support tiers | Enterprise NRR/SLA outcomes private | Pricing page |
| Technical defensibility | Open-source Postgres alignment plus Oriole R&D | Open source also lowers switching barriers | Oriole and product principles |
| Scale/reliability | Production checklist and status page support maturity | Incident history not public | Docs/status snippet |
GTM appears product-led and community-driven; CAC, conversion and sales productivity are not public.
verified confidence: medium
Marketing signal is developer-led: free tier, open-source repo, docs, customer stories, community and launch/blog content.
| signal | observed value | source | diligence interpretation |
|---|---|---|---|
| GitHub stars | 102,786 via API; 100,000 milestone blog | GitHub API / company blog | Strong developer awareness; not revenue proof |
| Developers building | 8 million company-reported | 100k stars blog | Large top-of-funnel claim; require methodology |
| Community members | 540,000+ | Careers page | Community-led distribution; require active-member definition |
| Customer stories | Multiple named case studies | Customer index | Logo/story evidence; validate references independently |
verified confidence: medium
Major-customer trends are visible only through selected customer stories; pipeline and expansion metrics are private.
verified confidence: medium
Principal new-business avenues appear to be PLG/free tier, GitHub/community, docs/blog/customer stories and enterprise sales.
| channel | public evidence | likely role | missing metric |
|---|---|---|---|
| Free tier / PLG | Free plan with MAU/database limits | Acquisition and activation | Free-to-paid conversion |
| Open-source GitHub | 102,786 stars and Apache-2.0 repo | Developer trust and adoption | GitHub-to-signup conversion |
| Community/content | 540k+ community and 100k-star blog; docs/blog | Education and retention | Content attribution/CAC |
| Enterprise sales | Enterprise custom plan, designated support, SLAs, private Slack | Large ACV expansion | Quota, sales cycle, pipeline coverage |
not publicly verifiable confidence: low
Sales compensation, quotas, cycle length and salesforce productivity are not public.
not publicly verifiable confidence: low
Marketing budget sufficiency cannot be assessed publicly beyond fundraising and hiring signals.
R&D and open-source activity are strong; roadmap delivery risk needs engineering diligence.
verified confidence: medium
Open-source repositories, verified GitHub organization, public contributors and careers claims show a large technical organization and community.
| area | public signal | evidence status | diligence need |
|---|---|---|---|
| Founders | Paul Copplestone and Ant Wilson listed as active founders by YC | verified | Full executive bios and technical leadership roles |
| Open-source org | Verified GitHub org with 151 public repos and 10,127 followers | verified | Maintainer assignments and security-response process |
| Contributors | Careers page claims 1,500+ contributors | verified | Contributor license and governance controls |
| Distributed team | 280+ team members in 55+ countries | verified | Function-level R&D headcount and hiring plan |
verified confidence: medium
Public R&D agenda includes Oriole/Postgres storage work, scale and open-source initiatives; budget/timing milestones are private.
| initiative | status | public goal | risk |
|---|---|---|---|
| OrioleDB / pluggable storage | Team joined Supabase in 2024 | Faster storage, pluggable storage, decoupled storage/compute | Deep database engineering integration risk |
| Multigres | Mentioned in Series E hiring/open-source initiatives | Scale Postgres to petabytes / Vitess-for-Postgres ambition | Source page not fully fetched; milestones private |
| Platform production controls | Public docs available | RLS, SSL, network restrictions, MFA, load testing | Customer misconfiguration risk |
| Core open-source platform | Active public repo pushed 2026-05-21 | Postgres development platform | High open issue/support burden |
Founder, remote and headcount signals are public; full HR, compensation and turnover data are private.
verified confidence: medium
The company is distributed/remote with public founder evidence; complete org chart reporting lines are private.
| name or role | public role | source | caveat |
|---|---|---|---|
| Paul Copplestone | Active founder | YC profile | Full biography, equity and employment terms private |
| Ant Wilson | Active founder | YC profile | Full biography, equity and employment terms private |
| Oriole team / technical leaders | Joined Supabase for storage-engine R&D | Company blog | Named reporting lines and retention terms not public |
| Board / executives beyond founders | Not fully disclosed in reviewed public sources | Public gap | Request board deck, org chart and executive bios |
verified confidence: medium
Public headcount anchors include 280+ team members, 55+ countries and 357 LinkedIn employees; function/location breakout is private.
| source | headcount or signal | geography | interpretation |
|---|---|---|---|
| Careers page | 280+ team members | 55+ countries | Company hiring page anchor; likely current marketing metric |
| 201-500 company size; 357 discoverable employees | Global / US primary | Profile-based employee count can include alumni/lag | |
| Series E blog | 100% distributed, 37 countries, over 30 ex-founders | 37 countries | Talent positioning and seniority signal |
| Private request | Function, location and hiring-plan data unavailable | not_publicly_verifiable | Need HRIS and budget |
partially verified confidence: medium
YC verifies founders Paul Copplestone and Ant Wilson; complete senior-management biographies and tenure should be collected.
not publicly verifiable confidence: low
Employment agreements, benefits cost and executive compensation are not public.
not publicly verifiable confidence: low
Employee secondary statement indicates equity liquidity practices, but stock-plan terms and dilution are private.
not publicly verifiable confidence: low
No public employee-relations problems were identified in this standard screen.
verified confidence: medium
Public turnover rates are not available; rapid distributed growth warrants retention diligence.
| category | public evidence | verification status | follow up |
|---|---|---|---|
| Founder departures | YC lists active founders Paul Copplestone and Ant Wilson | verified | Confirm founder vesting, roles and key-person plans |
| Executive turnover | No comprehensive public turnover schedule found | not_publicly_verifiable | Provide two-year executive and R&D attrition by month/function |
| Employee relations | No material public issue identified in standard screen | unverified | Provide complaints, investigations and employment claims schedule |
Public legal terms and IP snippets exist; litigation, insurance, contracts and regulatory history need counsel review.
inconclusive confidence: medium
Public web search did not surface a clear pending lawsuit against Supabase, but this is inconclusive without docket searches.
| case | court or source | status | diligence action |
|---|---|---|---|
| No clear pending lawsuit surfaced in public web search | DuckDuckGo lawsuit search | inconclusive | Run PACER/state/international docket search |
| India network-blocking articles/snippets | Search snippets, not direct legal docket | reputational/regulatory signal only | Ask counsel for any takedown/blocking notices and jurisdictional responses |
inconclusive confidence: medium
Public web search did not surface clear plaintiff-side litigation by Supabase, but counsel confirmation is required.
| matter | public evidence | status | diligence action |
|---|---|---|---|
| Supabase as plaintiff | No clear public result found in standard search | inconclusive | Counsel docket search and IP-enforcement schedule |
| Open-source/IP enforcement | No public enforcement action identified | not_publicly_verifiable | Request cease-and-desist, infringement and trademark-opposition history |
not publicly verifiable confidence: low
No environmental or workplace-safety liabilities are public; remote/software profile lowers but does not eliminate employment-safety compliance needs.
partially verified confidence: medium
Trademark snippets show Supabase-related records; official trademark and open-source IP chain require counsel review.
| asset | jurisdiction or license | status | risk or request |
|---|---|---|---|
| supabase/supabase source code | Apache-2.0 | verified via GitHub API | Review third-party dependency notices and contributor agreements |
| SUPABASE word/design trademarks | USPTO-related snippets | partially_verified | Review official TSDR ownership/assignments/oppositions |
| OrioleDB/storage-engine IP | Open-source/company acquisition context | partially_verified | Review acquisition documents, invention assignments, patents and licenses |
not publicly verifiable confidence: low
Insurance limits, exclusions, cyber coverage and claims history are not public.
not publicly verifiable confidence: low
Material customer, cloud, investor, acquisition and employment contracts are not public; DPA provides only standard public legal terms.
verified confidence: medium
Public docs/DPA/status materials verify privacy, shared-responsibility and operational obligations; agency-action history remains unverified by comprehensive regulator search.
| matter | public evidence | verification | private request |
|---|---|---|---|
| DPA/privacy roles | DPA covers database/tooling services and continuous processing | verified | Signed customer DPAs, subprocessors, TIAs and breach log |
| Shared responsibility/security | Docs assign customer responsibility for data/access/security controls | verified | Security questionnaires, SOC/ISO reports, customer incident tickets |
| Status/incidents/SLA | Public status page surfaced by search | verified | Incident export, postmortems, SLA credits and enterprise SLAs |
| Insurance/contracts | No limits/contracts public beyond standard legal docs | not_publicly_verifiable | Cyber/E&O/D&O policies, cloud/customer/material contracts |
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | Supabase is listed by Y Combinator as an active Summer 2020 company in developer tools/open source/databases in the San Francisco Bay Area. | verified high | SRC-001 |
| EC-002 | Supabase announced a $100M Series E at a $5B pre-money valuation led by Accel and Peak XV with existing investors including YC, Coatue, Felicis, Craft and Square Peg; Figma joined the round. | verified high | SRC-002SRC-015 |
| EC-003 | A public news snippet reports Supabase raised a $200M Series D at a $2B valuation in April 2025. | partially verified medium | SRC-016 |
| EC-004 | Supabase has not been shown by public research to have IPO’d, been acquired, or shut down; YC lists it active and LinkedIn lists it privately held. | verified high | SRC-001SRC-008SRC-002 |
| EC-005 | Supabase pricing includes Free, Pro from $25/month, Team from $599/month, and Enterprise custom pricing with usage-based compute and add-ons. | verified high | SRC-003 |
| EC-006 | Supabase’s public product positioning is a Postgres development platform with database, auth, instant APIs, realtime, storage and edge functions. | verified high | SRC-001SRC-008SRC-009 |
| EC-007 | Supabase’s public GitHub repository is Apache-2.0 licensed and had 102,786 stars, 12,494 forks, 1,046 open issues, and a 2026-05-21 push during research. | verified high | SRC-005 |
| EC-008 | Supabase blog claimed it reached 100,000 GitHub stars and eight million developers building with Supabase in April 2026. | partially verified medium | SRC-009 |
| EC-009 | Supabase’s company customer-story index lists customers including Chatbase, Brevo, eXp Realty, GovSignals, Kayhan Space, Phoenix Energy, Rally, Udio, Deriv, Resend and others. | verified medium | SRC-004 |
| EC-010 | Search snippets for Supabase customer stories cite use cases at Udio, eXp Realty, Kayhan Space and Phoenix Energy with scaling, enterprise innovation, developer speed and migration claims. | partially verified medium | SRC-017SRC-018SRC-019SRC-020 |
| EC-011 | Supabase careers page states the company has 280+ team members in 55+ countries, $500M raised, 540,000+ community members and 1,500+ contributors. | verified medium | SRC-007 |
| EC-012 | LinkedIn lists Supabase as privately held, founded in 2020, in IT Services and IT Consulting, with company size 201-500 and 357 discoverable employees. | verified medium | SRC-008 |
| EC-013 | Supabase is 100% remote/distributed with no offices according to YC, Careers and Series E materials. | verified high | SRC-001SRC-002SRC-007 |
| EC-014 | Supabase acquired or brought in the Oriole team to work on a faster Postgres storage engine, pluggable storage, and decoupled storage/compute. | verified high | SRC-010 |
| EC-015 | Supabase docs define a shared responsibility model: customers remain responsible for account access, data, access management, database schema and security controls; Supabase handles infrastructure responsibilities. | verified high | SRC-011 |
| EC-016 | Supabase production documentation recommends RLS, SSL enforcement, network restrictions, MFA, load testing, indexes and availability preparation before production. | verified high | SRC-012 |
| EC-017 | Supabase projects are deployed to one primary region; docs list general and exact AWS regions across Americas, Europe, APAC and other AWS geographies. | verified high | SRC-013 |
| EC-018 | Supabase’s DPA states services involve database/tooling services for web and mobile applications and covered data processing can be continuous for storage, deletion, rectification, analysis, transfer and aggregation. | verified high | SRC-014 |
| EC-019 | Public search did not identify a clear pending lawsuit against Supabase, but the search was not a comprehensive docket review. | inconclusive low | SRC-022 |
| EC-020 | Public search did not identify clear lawsuits initiated by Supabase; this remains not publicly verifiable without docket searches and counsel confirmation. | inconclusive low | SRC-022 |
| EC-021 | Public trademark search snippets identify Supabase-related trademark records, including a Supabase, Inc. registration and a prior SUPABASE record. | partially verified medium | SRC-021 |
| EC-022 | Supabase has a public status page surfaced in search results with incident update subscriptions. | verified medium | SRC-023 |
| EC-023 | Supabase’s public GitHub organization is verified, US-located, and had 151 public repositories and 10,127 followers during research. | verified high | SRC-006 |
| EC-024 | Revenue, ARR, gross margin, churn, customer concentration, backlog, AR aging, debt, option pool and cap table details are not public. | not publicly verifiable high | SRC-002SRC-003SRC-004 |
| EC-025 | Supabase competes across developer database/backend platforms where the basis of competition includes open-source Postgres alignment, breadth of backend services, pricing, compliance, scale and developer experience. | partially verified medium | SRC-003SRC-005SRC-009 |
| EC-026 | Supabase’s marketing and distribution motion is strongly product-led and developer-community-led, supported by free tier, public docs, open source GitHub traction, customer stories and community claims. | partially verified high | SRC-003SRC-004SRC-005SRC-007SRC-009 |
| EC-027 | Management details publicly verify founders Paul Copplestone and Ant Wilson through YC; a complete executive roster, board, compensation and turnover history are not public. | partially verified medium | SRC-001SRC-007SRC-008 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.