shouldiuse.io

New check

Comparison

PostgREST 16 vs Supabase

PostgREST 16 and Supabase both land on Depends.

Supabase

supabase.com

Depends
Confidence: Low

Buy if you have developers who want a managed Postgres backend with serious compliance credentials (SOC 2, HIPAA, ISO 27001).

Read the full report

PostgREST 16 versus Supabase
ComparePostgREST 16Supabase
VerdictDependsDepends
Best forPostgres-first developersDeveloper teams wanting Postgres plus auth, APIs, and storage
Who it's not forNon-technical teams wanting a managed API . no vendor to callNon-technical teams wanting a no-code database
PrivacyNo known public vulnerabilities found in the sources reviewed.³Strong on paper: SOC 2 Type 2, ISO 27001, HIPAA (with BAA), AES-256 at rest, TLS in transit, regular pen tests.⁹
Support qualityNo support evidence foundNo support evidence reviewed
Public sentimentDevelopers on Hacker News and Reddit praise PostgREST for spinning up APIs straight from Postgres, with complaints sparse in available sources.⁶No independent user reviews were found in the sources reviewed.
Biggest gotchaLeaving Supabase Cloud surfaces PostgREST config failures that produce no error⁷Shared responsibility model: misconfigured RLS policies or leaked API keys are your problem, not theirs.⁹

Pick PostgREST 16 when

  • Postgres-first developers
  • Internal tools and admin APIs
  • Teams treating the DB as single source of truth
  • CRUD backends without custom servers

When PostgREST 16 is not a fit

  • Non-technical teams wanting a managed API . no vendor to call
  • Buyers needing SLAs, vendor support, or a pricing plan
  • Teams unwilling to own Postgres roles, RLS, and schema design
  • Projects needing custom business logic beyond CRUD endpoints

Pick Supabase when

  • Developer teams wanting Postgres plus auth, APIs, and storage
  • Healthcare apps needing HIPAA-compliant hosting with a BAA
  • EU-focused products needing in-region data residency
  • GDPR-sensitive deployments needing a formal DPA

When Supabase is not a fit

  • Non-technical teams wanting a no-code database
  • Small teams unwilling to write and maintain RLS policies
  • Buyers expecting the vendor to manage all security end-to-end
  • Projects with zero developer resources

Sources

  1. PostgREST 16 Documentationpostgrest.org
    official
  2. PostgREST Authentication docsdocs.postgrest.org
    official
  3. PostgREST Security pagepostgrest.org
    security
  4. PostgREST - REST API from any PostgreSQL database (HN, 2015)news.ycombinator.com
    review
  5. PostgREST: REST API for any Postgres database (HN, 2020)news.ycombinator.com
    review
  6. In Codd we Trust: Using PostgreSQL as your REST APIreddit.com
    review
  7. Leaving Supabase Cloud: the three failuresdev.to
    news
  8. PostgREST vs Heroku Postgres . StackSharestackshare.io
    review
  9. Supabase product security pagesupabase.com
    security
  10. Supabase homepagesupabase.com
    official