Supabase DIGITAL

Target: Supabase Domain: Digital Research date: 23 October 2026 Evidence period: 2020–2026, with current disclosures prioritised.

Enterprise Technology Stack & Vendor Relationships

Corporate technology profile

Supabase is a developer infrastructure company founded in 2020 by Paul Copplestone and Ant Wilson, providing managed PostgreSQL databases, authentication, storage, realtime capabilities, APIs, and other backend services.^{1, 2}

Y Combinator identifies Supabase as an active Summer 2020 company and describes its architecture as isolated PostgreSQL clusters supporting database, authentication, security, and realtime functionality.²

Supabase’s June 4, 2026 Series F announcement reported a $500 million funding round led by GIC, alongside participation by existing investors and new investors Georgian and Salesforce Ventures.³

Supabase’s October 2025 Series E announcement identified Accel, Peak XV, Y Combinator, Coatue, Felicis, Craft, Square Peg, and Figma among participating investors.⁴

Salesforce Ventures independently identified Paul Copplestone as CEO and Ant Wilson as CTO in its June 2026 investment announcement.⁵

Verified infrastructure and technology suppliers

Supabase’s October 12, 2026 subprocessor disclosure identifies Amazon Web Services as a hosting provider, Cloudflare as a hosting and content-delivery provider, Google and Vercel as hosting providers, and Upstash as a serverless data-hosting provider.⁶

The same October 2026 disclosure identifies Latacora as a managed security service provider, Sublime Security as an email-security provider, Sentry as an error-monitoring provider, Braintrust Data as a monitoring and tracing provider, and GitHub as an authentication provider.⁶

Additional disclosed subprocessors include Hex Technologies for data analytics, ConfigCat for feature configuration, OpenAI for natural-language processing and generation, and other communications and administrative service providers.⁶

Supabase’s current legal framework permits the use of subprocessors under contractual obligations governing covered data and international processing.⁷

Israeli-origin technology

No public evidence identified establishing that Supabase currently licenses or uses Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, Palo Alto Networks, or another specifically identified Israeli-origin cybersecurity provider.

No public evidence identified establishing whether any undisclosed internal endpoint-security or enterprise-security deployment uses technology from an Israeli-origin vendor.

Dependency and procurement

AWS provides hosting services and is therefore a documented infrastructure supplier to Supabase; Supabase separately identifies AWS regional hosting as the foundation for its managed PostgreSQL environment.^{6, 8}

Cloudflare, Google, and Vercel are documented hosting or delivery suppliers, but their inclusion in Supabase’s subprocessor list does not establish the location of every physical server or traffic-processing node.^{6, 9}

No public evidence identified of an Israeli systems integrator, managed service provider, reseller, or consultancy deploying Israeli-origin technology into Supabase’s infrastructure.

No public evidence identified of a Supabase procurement contract with an Israeli technology company that specifies commercial value, licensed product, deployment dates, or infrastructure dependency.

Surveillance, Biometrics & Retail Technology

Facial recognition and biometrics

No public evidence identified establishing Supabase’s procurement or operational deployment of Israeli-origin facial recognition, biometric identification, gait analysis, or retail-surveillance systems from Trigo, BriefCam, AnyVision/Oosto, Trax, or comparable providers.

Behavioural analytics and monitoring

Supabase acquired Logflare in December 2021, describing the acquired product as a platform for log ingestion, realtime observability, and analytics across application and database activity.¹⁰

Supabase’s acquisition announcement described the ability to correlate application logs and database information to investigate requests, application usage, and operational performance.¹⁰

Supabase’s current security documentation identifies the managed platform as including access to customer data environments and operational security controls.¹¹

No public evidence identified establishing that Supabase’s own monitoring infrastructure incorporates Israeli-origin predictive policing, workforce surveillance, biometric profiling, or intelligence-grade behavioural analysis.

Indirect deployment

Supabase’s October 2026 subprocessor register identifies monitoring and security suppliers but does not describe a deployment of the Israeli-origin biometric or surveillance products investigated.⁶

No public evidence identified of Israeli-origin surveillance products reaching Supabase through a named managed security contractor, bundled enterprise suite, or third-party integrator.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Managed database locations

Supabase’s current region documentation states that each hosted project has one primary region and that customers can select available AWS regions for their databases.¹²

The documented specific regions include locations in the United States, Canada, Ireland, the United Kingdom, France, Germany, Switzerland, Sweden, India, Singapore, Japan, South Korea, Australia, and Brazil.¹²

The reviewed October 2026 list does not include Israel among the available primary managed-project regions.¹²

Supabase’s October 6, 2026 Data Residency and Transfers FAQ states that PostgreSQL databases, authentication services, storage objects, and backups are hosted within the AWS region selected for the project.⁸

Cross-border processing and legal access

Supabase’s October 2026 data-residency guidance explicitly states that it does not guarantee all processing remains inside the customer’s selected region, even when core databases and backups remain there.⁸

The same guidance identifies Supabase Pte. Ltd. in Singapore as the primary processing entity and Supabase, Inc. in the United States as an affiliate supplying support and operational services.⁸

Supabase’s DPA permits processing through geographically distributed supplier facilities under its contractual restrictions, processing instructions, and applicable data-protection requirements.⁷

The October 2026 subprocessor register identifies the United States, Singapore, and Hungary as the countries associated with its listed entities; it does not identify an Israel-domiciled subprocessor.⁶

The disclosed legal and infrastructure arrangements establish potential processing outside the selected primary database region, but the reviewed documents do not identify any specific processing operation occurring within Israeli jurisdiction.^{7, 8}

Edge processing

Supabase’s Edge Functions documentation describes globally distributed TypeScript execution using a Deno-compatible runtime, request routing, authentication checks, and access to databases and other services.¹³

Its architecture documentation describes deployment to multiple edge locations and geographic routing of invocations toward suitable execution nodes.¹⁴

Supabase’s Regional Invocations documentation states that Edge Functions ordinarily execute in the region nearest the requesting user and can be directed to specified supported regions.¹⁵

The documented selectable Edge Function execution regions include Asia-Pacific, North America, Europe, and South America; Israel is absent from the published list reviewed.¹⁵

Supabase separately markets regional invocation controls as a means of keeping compute closer to database workloads and supporting data-location requirements.¹⁶

No public evidence identified establishing that Supabase operates, leases, or colocates an Israeli data centre.

No public evidence identified establishing that Supabase routes customer-controlled database storage or authenticated user records through Israeli-controlled infrastructure.

No public evidence identified establishing the geographic location of every CDN request, ancillary processing event, or third-party support access associated with Israeli users.

Sovereign and government cloud

No public evidence identified of direct Supabase participation in Project Nimbus.

No public evidence identified of a Supabase contract to provide Israeli government sovereign-cloud infrastructure.

No public evidence identified of Supabase operating a data-residency or resilience service specifically contracted to the Israeli Ministry of Defence, intelligence services, or other Israeli state institutions.

Defence, Intelligence & Security Sector Technology Relationships

Military and intelligence procurement

No public evidence identified of a contract between Supabase and the Israel Defense Forces, Israeli Ministry of Defence, Mossad, Shin Bet, Unit 8200, or another Israeli security agency.

No public evidence identified of a named Israeli defence procurement award, contract value, implementation programme, or authorised distributor involving Supabase.

General-purpose digital infrastructure

Supabase’s hosted platform provides databases, authentication, storage, APIs, realtime subscriptions, and execution infrastructure that developers can use to construct applications across industries.^{1, 2}

Its documented Edge Functions architecture allows applications to execute server-side logic, process requests, and interact with databases and external services.^{13, 14}

These capabilities are documented as general-purpose development infrastructure, and the reviewed company documentation does not identify a Supabase-developed military targeting or weapons-control product.^{1, 13}

No public evidence identified establishing deployment of Supabase technology in an Israeli military surveillance system, intelligence database, occupied-territory checkpoint system, or military communications programme.

Offensive cyber capabilities

No public evidence identified of Supabase developing, selling, licensing, or maintaining zero-day exploitation platforms, offensive spyware, intrusion frameworks, or cyber weapons for Israeli government or military customers.

No public evidence identified of an Israeli state agency deploying a Supabase-developed offensive cyber capability.

Temporal continuity

Supabase’s October 2026 supplier and infrastructure disclosures establish that its general cloud and security-provider relationships continued after July 19, 2024 and November 2024.^{6, 8}

No public evidence identified establishing an Israeli military or settlement-related Supabase technology relationship continuing after either date.

AI, Algorithmic & Autonomous Systems

AI platform capabilities

Supabase’s current AI documentation describes PostgreSQL and pgvector-based storage, indexing, and retrieval of vector embeddings, with integrations involving external model providers and application frameworks.¹⁷

Supabase’s automatic embeddings documentation describes an architecture using PostgreSQL triggers, pgmq, pg_net, pg_cron, Edge Functions, and an optional external embedding provider such as OpenAI.¹⁸

Its semantic-search documentation explains that applications can generate embeddings using integrated models or third-party services and query these embeddings through PostgreSQL.¹⁹

Supabase’s Edge Functions AI documentation describes built-in embedding generation and support for conversational workflows and model execution.²⁰

Its published application examples include using Next.js, OpenAI embeddings, and PostgreSQL vector search to build retrieval-based applications.²¹

Third-party AI processing

Supabase’s October 2026 subprocessor list identifies OpenAI as a provider of natural-language processing and generation services to Supabase.⁶

The existence of this supplier relationship does not itself establish that every customer database, AI workload, or customer-created embedding is transferred to OpenAI.^{6, 18}

Israeli state and military provision

No public evidence identified establishing the supply of Supabase AI or machine-learning services to Israeli military, intelligence, police, or state agencies.

No public evidence identified establishing that Supabase itself trained AI models using intercepted Palestinian communications, Israeli military surveillance records, biometric datasets from occupied territories, or other specifically identified surveillance-derived sources.

No public evidence identified establishing that Supabase developed or supplied autonomous target-generation, fire-control, lethal-autonomy, or weapons-guidance software to Israeli military organisations.

Technology classification

Supabase documents vector databases, semantic search, application-level inference, and programmable server-side execution as general-purpose application-development capabilities.^{17, 20}

No public evidence identified of a Supabase product primarily designed to generate kinetic targeting decisions or weapons effects.

Technology Ecosystem & R&D Footprint

Founders and corporate investors

Y Combinator identifies Paul Copplestone and Ant Wilson as the active founders of Supabase.²

The June 2026 Series F financing announcement identifies GIC as lead investor and records participation by Stripe, Salesforce Ventures, Georgian, and existing institutional investors.³

CapitalG’s 2026 investment profile identifies Paul Copplestone and Ant Wilson as co-founders and confirms CapitalG’s investment in the Series F round.²²

Supabase’s company website separately lists institutional and individual investors, including Elad Gil, Guillermo Rauch, Kurt Mackey, and others.¹

The disclosed presence of individual and institutional investors does not establish their precise current voting rights, board-control arrangements, or personal investment portfolios.^{1, 3}

No public evidence identified establishing that a Supabase founder, controlling executive, chair, or independently verified shareholder holding at least 10% has a disclosed attributable equity interest in an Israeli surveillance, cyber-intelligence, or military technology company.

No public evidence identified establishing an attributable founder or controlling-principal investment in NSO Group, Cellebrite, Carbyne, Oosto, Wiz, Check Point, Verint, or another specifically identified Israeli security-technology company.

Geographic engineering footprint

Supabase stated in its October 3, 2025 Series E announcement that it operated as a fully distributed organisation with employees across 37 countries and without conventional offices.⁴

The company’s general profile describes a remote engineering organisation with backgrounds spanning major technology companies.¹

No public evidence identified of a Supabase-operated research laboratory, engineering office, innovation centre, or accelerator facility physically established in Israel.

No public evidence identified establishing a specific Supabase employee’s participation in Israeli military reserve service while working for the company.

No public evidence identified establishing a Supabase reservist salary-continuation programme or military-leave subsidy specifically involving Israel.

Acquisitions

Supabase announced its acquisition of Logflare on December 2, 2021, identifying Chase Granberry as Logflare’s founder and explaining the planned integration of logging and observability into Supabase’s platform.¹⁰

The announced acquisition concerned application logs, analytics, observability, and developer tooling.¹⁰

No public evidence identified establishing that the Logflare acquisition involved an Israeli-domiciled company or an Israeli defence or intelligence technology asset.

No public evidence identified of Supabase acquiring an Israeli-origin cybersecurity, surveillance, cloud, or AI technology business.

Patents and research cooperation

No public evidence identified of a Supabase patent-licensing programme, joint patent application, or technology co-development agreement with Technion, Hebrew University, Weizmann Institute, or another Israeli research institution.

No public evidence identified of a Supabase investment in an Israeli military-technology accelerator or specialised defence venture-capital fund.

Civil Society Scrutiny & Regulatory History

Public transparency and compliance

Supabase’s Legal Hub makes its Data Processing Addendum, subprocessor disclosures, and data-residency documentation publicly available.²³

Its current subprocessor register was updated on October 12, 2026 and identifies named operational suppliers and their processing purposes.⁶

Supabase’s security documentation states that the company maintains SOC 2 Type 2 controls across the hosted product environment, with defined boundaries between Supabase’s responsibilities and customer-managed systems.¹¹

United Nations and civil-society investigations

No public evidence identified of a Supabase-specific finding in the authoritative UN, NGO, or specialist investigations located during this research.

No public evidence identified establishing that Supabase is a named Project Nimbus contractor or has been formally identified by the UN as operating a settlement-related digital service.

No public evidence identified of a Supabase-specific technical investigation published by Who Profits, AFSC Investigate, Amnesty International, Human Rights Watch, Citizen Lab, Access Now, or comparable organisations concerning technology supplied to Israeli state bodies or occupied territories.

Boycott and divestment activity

No public evidence identified of a named organised boycott or divestment campaign specifically targeting Supabase’s Israeli technology provision.

No public evidence identified of a Supabase corporate response to such a campaign.

Regulatory and legal proceedings

No public evidence identified of a regulatory investigation, export-control enforcement action, sanctions proceeding, or court judgment concerning Supabase technology supplied to Israeli military, intelligence, or settlement-related entities.

No public evidence identified of a confirmed Israeli public-sector procurement dispute involving Supabase.

Additional disclosures

Supabase’s public customer-story catalogue documents commercial uses of its database and backend infrastructure across multiple application categories.²⁴

No public evidence identified from the reviewed customer disclosures establishing that a named Israeli military or settlement-related institution is a direct Supabase enterprise customer.

No public evidence identified establishing that Supabase operates a consumer mapping product whose depiction of Israeli settlements or Palestinian territories is controlled by Israeli state authorities.

No public evidence identified of a Supabase-specific public content-moderation dispute involving the removal of Palestinian or Gaza-related content at the request of Israeli authorities.