Supabase development
Ship fast on Postgres, without giving up control of the data.
Acasa Labs is a Supabase development agency. We build web and mobile apps on Supabase Postgres with row-level security, Edge Functions, and Realtime. GymFast runs a web dashboard and three apps for staff, members, and trainers on Supabase, and NoteTube keeps its data in Supabase Postgres. The project sits in your Supabase account.
The problem
Supabase makes the first version easy. Security is where it gets hard.
Supabase gives you Postgres, auth, storage, and an API on day one, and the client talks to the database directly. That is the speed, and it is also the risk. If row-level security policies are missing or wrong, a logged-in user can read rows that are not theirs. Scheduled work ends up as a cron job on someone's laptop, and business rules get copied into every app. A Supabase app holds up in production when the rules live in the database and the scheduled work lives on the platform.
What we build with Supabase
- 01
Row-level security that matches your roles
Policies written from your real role hierarchy, from owner down to end user, and tested by trying to read data each role should not see.
- 02
Scheduled and background work
Edge Functions on a schedule for reminders, expiries, and syncs, so the automation runs without a server for anyone to look after.
- 03
Several apps on one project
Web dashboards and Expo apps for different kinds of users on the same Supabase project, each seeing only what its role allows.
- 04
Realtime screens
Supabase Realtime for check-ins, queues, and dashboards that update while someone is looking at them, without a refresh.
From production
How we build on Supabase, from GymFast.
Roles enforced by Postgres
GymFastGymFast has six role levels, from owner to member. They are enforced in the database with row-level security, not in app code, so the dashboard and all three apps follow the same rules without each one re-implementing them.
Reminders without a server
GymFastRenewal, payment, class, and session reminders, plan expiry, enquiry follow-ups, and auto check-out all run as scheduled Edge Functions. There is no worker machine to keep alive.
Staff, members, and trainers on one backend
GymFastThe staff app, the member app, and GymFast Pro for trainers share one token-authenticated mobile API with the web dashboard. Supabase Realtime sits alongside for screens that need live updates.
The database, not the whole backend
NoteTubeNoteTube keeps its data in Supabase Postgres but runs AI in a separate FastAPI service. Model keys and long streaming chats stay out of the database layer, where they do not belong.
Honest trade-offs
When Supabase is not the right base
If the backend does long-running work, such as AI calls, document processing, or a sync engine with retries, put that in its own service and keep Supabase for the data. NoteTube does this with FastAPI. If you need strict data residency or Postgres extensions your plan does not offer, a managed Postgres in your own cloud may fit better. And for a content website, Supabase is more than you need.
What we reach for
- Supabase Postgres, row-level security
- Supabase Auth, Storage
- Edge Functions on a schedule
- Supabase Realtime
- Expo and Next.js clients
- Turborepo
- RevenueCat
Proof
Shipped, not pitched.
01Our product
GymFast
Members, billing, classes, and workout plans for a gym, in one platform and three apps.
Gym management software for gym owners and personal trainers. A web dashboard and a staff app run members, plans, invoices, enquiries, and classes; members get their own branded app; GymFast Pro gives independent trainers the same tools for their clients.
Web dashboard · iOS · Android · Staff, member, and trainer apps
02Our product
NoteTube
A lecture becomes a study system: chat, flashcards, quizzes, all grounded in the source.
An AI learning platform that turns PDFs, YouTube lectures, recordings, and notes into a structured notebook with grounded chat, spaced-repetition flashcards, and graded quizzes.
Web · iOS · Android · Chrome extension · MCP server
Questions
Supabase questions we get asked.
Is Supabase ready for production?
Yes, when row-level security is designed properly and scheduled work is planned. GymFast runs a web dashboard and three mobile apps on it, with roles enforced in Postgres and reminders on scheduled Edge Functions.
Supabase or Firebase?
Supabase when your data is relational: members, plans, invoices, and the links between them. It is Postgres, so you can query it, join it, and move it. Firebase suits document-shaped data. We have shipped on both.
Can you audit our Supabase row-level security?
Yes. We read every policy against your roles, then try to read and write data as each role, including anonymous users. You get a list of what is open and the fixes, in order of risk.
Can we move off Supabase later?
Yes. It is standard Postgres, so the schema and data move with the usual tools. Auth and Edge Functions take more work to move, and we plan for that up front if you expect to.
Do you build mobile apps on Supabase?
Yes. GymFast's staff, member, and trainer apps are Expo apps on the same Supabase backend as its web dashboard.
Supabase development
Building on Supabase? Check the policies first.
A free 30-minute review of your Supabase schema, row-level security, and functions, or of the app you are about to build. You leave with what we would fix first.