Supabase

Key Findings

• Economic: A third-party technology-detection service identified approximately 1,487 Israel-associated websites using Supabase technology, but this does not establish paid subscriptions, contractual counterparties, revenue, or settlement-related activity.¹
• Military: Supabase supports GovSignals, a US defence-acquisition software contractor, but GovSignals - not Supabase - received the documented Defense Innovation Unit contract, and no evidence connects that relationship to Israeli security organisations.^{2, 3}
• Digital: Supabase offers general-purpose database, authentication, storage, realtime, Edge Functions, and AI-vector infrastructure; the reviewed evidence did not identify an Israeli hosting region, Israel-domiciled subprocessor, Project Nimbus participation, or an Israeli military deployment.^{4, 5, 6}
• Not found: No public evidence identified of direct Israeli military or government contracts, settlement operations, Israeli state control, conflict-related lobbying or donations, or a Supabase-specific boycott or divestment campaign.^{7, 8, 9}

Target Profile

Key Facts:

• Supabase was founded in 2020 by Paul Copplestone and Ant Wilson.¹¹
• The company announced a $100 million Series E in October 2025, a $500 million Series F in June 2026, and an additional $150 million financing in October 2026.^{13, 15, 16}
• Its legal disclosures generally identify the Singapore entity as the ordinary contracting and processing entity, while specified AWS Marketplace arrangements involve the US entity.^{7, 6}
• The audits found the question of ultimate beneficial ownership unresolved because public investor lists, financing announcements, and regulatory filings do not provide a complete verified ownership and control register.^{12, 7, 10}

Executive Summary

Supabase is a privately held developer-infrastructure company offering managed and self-hosted PostgreSQL-based services, including databases, authentication, storage, APIs, realtime functions, Edge Functions, and vector-search infrastructure.^{4, 12} Its disclosed corporate structure comprises a Singapore entity and a Delaware corporation, and its workforce has been described as fully distributed rather than organised around conventional offices.^{7, 15} The audited record does not identify an Israeli parent, subsidiary, office, data centre, research facility, or dedicated hosting region.^{5, 6}

The only documented Israel-specific commercial indicator is a BuiltWith detection list reporting approximately 1,487 Israel-associated websites using Supabase technology in October 2026.¹ That evidence shows a visible technology-use footprint, but it cannot determine whether the detected sites use free, paid, managed, or self-hosted services; identify contractual counterparties; quantify revenue; or establish an Israeli government, military, or settlement customer. Supabase itself publishes worldwide adoption figures without an Israel-specific customer, employment, revenue, or tax breakdown.^{12, 16}

Outside the Israel/Palestine nexus, Supabase has documented relationships with companies serving the US defence and government markets. Its GovSignals case study describes Supabase technology supporting government-procurement software across commercial, FedRAMP, and IL5 environments, together with engineering help on database performance and scaling.² GovSignals separately announced its own Defense Innovation Unit contract, while its IL5 authorisation was obtained through Second Front Systems’ Game Warden platform.^{3, 17} A separate Supabase case study concerns Epsilon3, which independently serves US defence and aerospace customers.¹⁸ These records do not name Supabase as the government contractor or formally designated subcontractor, do not establish that every military-facing deployment uses Supabase, and do not connect either relationship to Israel or occupied Palestinian territory.

Across the four audited domains, no public evidence was identified of a Supabase contract with Israeli military, intelligence, police, prison, border, or government bodies; participation in Project Nimbus; an Israeli defence-prime supply arrangement; weapons or surveillance development; settlement operations; Israeli state control; conflict-related political advocacy, lobbying, or donations; or disciplinary action against employees for pro-Palestinian expression.^{7, 19, 8, 9} Published products are general-purpose infrastructure, and customers can independently self-host the open-source components in environments they control.²⁰

The reviewed evidence therefore does not support a qualifying Israel/Palestine complicity mechanism under V6.6. Each domain receives 0.00, producing a BRS Score of 0 and Tier E (Minimal/No Complicity). This result does not prove that no Israeli individual or organisation has ever used Supabase; it reflects the absence of verified, attributable activity meeting the scoring criteria.

Timeline of Relevant Events

Corporate Overview

Supabase’s disclosed operating structure centres on Supabase Pte. Ltd. in Singapore and Supabase, Inc. in Delaware. Its terms generally make the Singapore company the contracting party, except for specified AWS Marketplace purchases ordinarily contracted through the Delaware entity.⁷ Data-residency disclosures similarly identify the Singapore entity as the ordinary primary processor and the US affiliate as a provider of technical and operational support, subject to marketplace-specific arrangements.⁶

The company’s commercial platform combines PostgreSQL with authentication, storage, APIs, realtime services, Edge Functions, and associated developer tooling.⁴ Supabase also publishes self-hosting documentation under which a customer provisions and operates the software in its own infrastructure and assumes responsibility for security, maintenance, backups, and monitoring.²⁰ This distribution model means technical use does not necessarily demonstrate a managed-service contract or direct knowledge of an end user.

Announced integrations and acquisitions include Logflare, OrioleDB, Triplit, BKND, Hydra, and Turso.^{16, 21, 22} The reviewed announcements did not establish that any of these businesses was an Israeli operating company, defence supplier, or settlement enterprise. They also did not provide a definitive post-transaction subsidiary register or complete ownership schedule.

Supabase is privately financed. Its published investor list and financing announcements identify numerous venture and corporate investors, but not a complete capitalization table, voting-control schedule, or authenticated beneficial-ownership register.^{12, 15, 16} Elad Gil is listed as an individual investor, but the public record does not establish his Supabase ownership percentage, investment vehicle, board rights, or control. His unrelated investments cannot be attributed to Supabase. The audits accordingly classify Israeli beneficial ownership as unresolved rather than confirmed or definitively disproved.

No public evidence identified a Supabase Israeli subsidiary, office, data centre, laboratory, warehouse, tax registration, or verified employee count. Nor was there evidence of an Israeli state golden share, state-appointed director, controlling state investment, or allocation of financing proceeds to Israeli government, military, or settlement institutions.

Domain Summaries

Military: Military

Mechanism of Involvement

No qualifying Israeli military mechanism was established. The audits found no public evidence of a procurement contract, tender award, memorandum, military-specific service agreement, or formally designated subcontract between Supabase and the Israeli Ministry of Defence, IDF, Israel Prison Service, Border Police, intelligence agencies, or named Israeli defence manufacturers.

Supabase does have a documented commercial relationship with GovSignals. Supabase’s case study describes its PostgreSQL, pgvector, storage, realtime, authentication, and row-level-security components as supporting GovSignals’ government-procurement platform, including deployments described as commercial, FedRAMP, and IL5 environments.² Supabase engineers reportedly assisted with query tuning, indexes, scaling, and PostgreSQL upgrades.² GovSignals separately won a Defense Innovation Unit contract for government acquisition workflows, and subsequently announced IL5 authorisation through Second Front Systems.^{3, 17}

This evidence establishes support for a US defence-acquisition software customer. It does not establish that Supabase itself received the DIU award, was a formally named subcontractor, independently held IL5 authorisation, administered controlled government data, or served an Israeli military end user.

Counter-Arguments and Evidence Limits

The company’s strongest defence is that its products are general-purpose backend infrastructure, not weapons, targeting systems, military logistics, or defence-specific software.⁴ GovSignals’ documented application concerns procurement discovery, proposal preparation, acquisition planning, and contracting administration rather than kinetic targeting or weapons control.^{2, 3}

Customers may also self-host Supabase components in independently controlled environments.²⁰ The mere technical availability of open-source software cannot identify a particular military user or prove a commercial supply transaction. No public evidence identified an Israeli customer-specific modification, military certification, export licence, end-user certificate, or weapons-platform integration.

The evidence limit runs in both directions: public records cannot exclude undisclosed or independently deployed use, but no such possibility may be converted into an attributable company act. The verified GovSignals relationship is relevant context, yet it supplies no documentary bridge to Israel, Israeli defence primes, occupied-territory installations, or settlement infrastructure.

Named Entities and Evidence Map

Digital: Digital

Mechanism of Involvement

Supabase supplies general-purpose digital infrastructure: managed PostgreSQL databases, authentication, object storage, APIs, realtime subscriptions, server-side functions, and vector-search capabilities.⁴ Its disclosed suppliers include AWS, Cloudflare, Google, Vercel, Upstash, GitHub, security providers, analytics providers, and OpenAI.¹⁹

The reviewed October 2026 primary-region list did not include Israel.⁵ The subprocessor register did not identify an Israel-domiciled subprocessor, although those disclosures do not reveal the location of every network node, ancillary processing event, or support access.^{6, 19} No public evidence identified an Israeli data centre, Israeli sovereign-cloud arrangement, Project Nimbus participation, or routing of customer databases through Israeli-controlled infrastructure.

No evidence identified Supabase as a supplier of offensive spyware, zero-day exploitation tools, biometric surveillance, predictive policing, autonomous targeting, or weapons-guidance systems. Its AI features provide general-purpose embedding storage, retrieval, semantic search, and application-level inference rather than a documented military targeting product.

Counter-Arguments and Evidence Limits

Supabase can reasonably argue that its tools are horizontal developer infrastructure used across many sectors and that customers - not Supabase - design the applications built on them.^{4, 20} The absence of Israel from published primary-region and selectable Edge Function lists also weighs against attributing an Israel-based hosting operation.⁵

An open-source and self-hosted model limits visibility into independent deployments. Conversely, that limited visibility cannot substantiate an allegation. The audits did not identify a named Israeli military surveillance system, checkpoint database, intelligence programme, government cloud contract, or offensive-cyber deployment using Supabase.

Supabase’s cross-border-processing disclosures state that not all processing is guaranteed to remain within the customer’s selected primary region.⁶ This is a legitimate data-governance limitation, but the documents do not identify a specific processing operation in Israel. It therefore does not support a scored Israeli digital nexus.

Named Entities and Evidence Map

Economic: Economic

Mechanism of Involvement

The documented Israel-specific economic signal is BuiltWith’s identification of approximately 1,487 Israel-associated websites with detected Supabase usage.¹ This supports the limited conclusion that Supabase technology was visibly present on websites associated with Israel. It does not establish which sites were paying customers, whether services were managed or self-hosted, the identity of any contracting party, subscription values, revenue, tax payments, or continuity across the framework’s temporal dates.

No public evidence identified an Israeli office, data centre, research facility, subsidiary, controlled acquisition, verified workforce, VAT registration, or country-specific revenue. No settlement enterprise was identified as a paying Supabase customer, and no contract was found for settlement administration, construction, tourism, infrastructure, or other settlement-specific services.

The audits also found no evidence that Supabase held Israeli sovereign bonds, financed Israeli state or military entities, invested corporate capital in an Israeli operating company, or allocated its 2025–2026 financing proceeds to Israeli operations.^{13, 15, 16}

Counter-Arguments and Evidence Limits

The strongest defence is that web-technology detection is not proof of a contractual or financial relationship. Supabase offers open-source, independently deployable software, while free and managed service tiers can produce the same public-facing technical indicators.^{20, 1} The BuiltWith count therefore cannot sustain a finding about revenue, economic scale, government customers, or settlements.

Ownership evidence is also incomplete. Supabase lists Elad Gil as an investor, but no verified percentage, voting right, board entitlement, or investment vehicle was established.¹² Public records similarly do not disclose a complete current capitalization table or ultimate beneficial-ownership register. The appropriate finding is unresolved ownership - not confirmed Israeli ownership and not a claim that Israeli beneficial ownership has been conclusively excluded.

Investor portfolio activity is not automatically corporate activity. Investments made elsewhere by Supabase investors, including any exposure to Israel or defence companies, cannot be attributed to Supabase without evidence of operational integration, control, or company-directed financing. No such evidence was identified.

Named Entities and Evidence Map

Political: Political

Mechanism of Involvement

No public evidence identified of a Supabase corporate statement endorsing Israeli military operations, settlement expansion, an Israeli or Palestinian governmental position, or a conflict-related relief or advocacy programme. Reviewed executive archives and corporate announcements principally concerned software, infrastructure, fundraising, acquisitions, security, and company operations.^{23, 24}

No evidence identified corporate lobbying on Israel/Palestine policy, anti-BDS legislation, military assistance, settlement policy, or sanctions. Nor was there a verified Supabase donation to the IDF, Friends of the IDF, settlement organisations, Israeli reservist funds, or a related employee-matching programme.

The audits found no evidence of employee discipline for pro-Palestinian speech, a conflict-specific content-removal directive, an asymmetric moderation rule, or infrastructure donated to an Israeli military or settlement institution. No Supabase-specific BDS campaign, Who Profits investigation, AFSC Investigate designation, UN settlement-related finding, or settlement-divestment decision was identified.

Counter-Arguments and Evidence Limits

Supabase’s strongest defence is the absence of an attributable political act. Corporate silence is not evidence of support for either side, and technical customer relationships cannot be converted into political endorsement without documentary support. Its published Acceptable Use Policy contains general platform restrictions rather than an Israel/Palestine-specific rule.⁸

The Epsilon3 customer story illustrates the attribution boundary. Supabase documented Epsilon3’s use of self-hosted Supabase technology, while Epsilon3 separately advertises US defence and government services.¹⁸ The evidence does not establish that Epsilon3 used Supabase within every government contract, that Supabase was a party to those contracts, or that the relationship involved Israel.

Public disclosures do not provide a complete record of every executive’s personal donations, foundations, or affiliations. That evidentiary gap cannot support an affirmative finding. No verified conflict-related donation, advocacy appointment, lobbying act, settlement sponsorship, or Israeli state partnership was established for the company or the examined leadership.

Named Entities and Evidence Map

Complicity Index Score

Method: V6.6

• V_MAX: 0.00 Avg_OTHERS: 0.00
• BRS Score: 0 Tier: E (Minimal/No Complicity)

V_MAX is 0.00 because none of the four audits established a verified, attributable Israel/Palestine activity satisfying the Impact, Magnitude, and Proximity requirements. The resulting BRS 0 and Tier E reflect a scale-free, evidence-only, human-vetted method: general product availability, unresolved ownership, unrelated investor activity, and US defence-customer relationships were not treated as Israeli complicity without a documentary bridge.

Methodology Note

• The dossier uses only facts and findings contained in the four supplied domain audits; allegations not verified by those audits are excluded or expressly qualified.
• Impact (I) evaluates the type of documented activity, Magnitude (M) evaluates its evidenced scale, and Proximity (P) evaluates the directness of the company’s attributable involvement.
• The method is scale-free: company size, valuation, popularity, or worldwide customer counts do not independently increase a domain score.
• Divested, exited, or discontinued operations are temporally mitigated. No former operation may be scored as current without evidence of continuity.
• Entity attribution does not permit transitive guilt: customers’ contracts, investors’ portfolios, executives’ undisclosed personal activity, and independently self-hosted deployments are not attributed to Supabase without evidence of control, participation, or operational integration.
• A verified settlement operation would ordinarily count in both Economic and Political; none was established here. “No public evidence identified” denotes a negative result from the audit checks, not proof that an undisclosed fact is impossible.