# Amazon RDS vs Supabase

Canonical: https://inetgeek.com/compare/amazon-rds-vs-supabase/

Every value below is read from Amazon RDS's and Supabase's own documentation. See https://inetgeek.com/methodology/ for how.

## At a glance

| Criterion | Amazon RDS | Supabase |
| --- | --- | --- |
| Managed connection pooling | Supported | Supported |
| Engine | PostgreSQL, alongside MySQL, MariaDB, Oracle, SQL Server and Db2. Each engine is a separate RDS product with its own version list and its own feature support, so a capability documented for one is not a capability of RDS as a whole. | PostgreSQL |
| Connection limit | Not a fixed number: RDS for PostgreSQL sets max_connections by formula from the instance's memory — LEAST({DBInstanceClassMemory/9531392}, 5000) — so a bigger instance class gets more connections and the ceiling is 5,000 however large it is. The parameter can be set by hand anywhere from 6 to 262,143, which is a limit on what you may configure rather than what an instance will serve. Other engines use different divisors: MySQL is memory/12582880 with no cap. | 60 direct and 200 pooled connections on the Micro instance included with Pro; both scale with instance size |
| Point-in-time recovery | Any point inside the configured backup retention period, so up to 35 days. Transaction logs are uploaded to S3 every five minutes, which is what bounds how close to now the latest restorable time can be. | Point-in-time recovery is a paid add-on on Pro, Team and Enterprise, and needs at least a Small compute add-on alongside it. Worst-case recovery point is 2 minutes. Without it, restores go back only to a daily backup. |
| Read replicas | Supported — 15 per primary, raisable on request | Supported |
| Backup retention | Between 0 and 35 days, set per DB instance; 0 disables automated backups entirely. The default depends on how the instance was created — one day via the API or CLI, seven days via the console — so there is no single default to quote. Multi-AZ DB clusters cannot be set below 1 day. | Daily backups: 7 days on Pro, 14 days on Team, up to 30 days on Enterprise. Free projects get no automatic backups at all — Supabase tells free users to export their own data with the CLI. |
| SOC 2 | Listed as SOC-compliant on AWS's own compliance scope page. | SOC 2 Type 2 compliant; report available to Enterprise and Team customers via the dashboard. |
| ISO 27001 | Covered under AWS's account-wide ISO/IEC 27001:2022 certification — not scoped per-service the way SOC, HIPAA and PCI DSS are on AWS's own site. | ISO 27001 certified; certificate available to Enterprise and Team customers via the dashboard. |
| HIPAA | Listed as a HIPAA-eligible service on AWS's own reference page. | HIPAA compliant; customers may store PHI after signing a BAA and meeting shared-responsibility obligations. |
| GDPR / data residency | AWS customers can process personal data on all AWS services in compliance with GDPR, and choose the storage type and geographic region for their data. | Projects hosted in EU regions keep primary database data in-region; a DPA is available. |

## Where they differ

### Engine

- Amazon RDS: PostgreSQL, alongside MySQL, MariaDB, Oracle, SQL Server and Db2. Each engine is a separate RDS product with its own version list and its own feature support, so a capability documented for one is not a capability of RDS as a whole. ([source](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_PostgreSQL.html))
- Supabase: PostgreSQL ([source](https://supabase.com/docs/guides/database/connecting-to-postgres))

### Connection limit

- Amazon RDS: Not a fixed number: RDS for PostgreSQL sets max_connections by formula from the instance's memory — LEAST({DBInstanceClassMemory/9531392}, 5000) — so a bigger instance class gets more connections and the ceiling is 5,000 however large it is. The parameter can be set by hand anywhere from 6 to 262,143, which is a limit on what you may configure rather than what an instance will serve. Other engines use different divisors: MySQL is memory/12582880 with no cap. ([source](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Limits.html))
- Supabase: 60 direct and 200 pooled connections on the Micro instance included with Pro; both scale with instance size ([source](https://supabase.com/pricing))

### Point-in-time recovery

- Amazon RDS: Any point inside the configured backup retention period, so up to 35 days. Transaction logs are uploaded to S3 every five minutes, which is what bounds how close to now the latest restorable time can be. ([source](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIT.html))
- Supabase: Point-in-time recovery is a paid add-on on Pro, Team and Enterprise, and needs at least a Small compute add-on alongside it. Worst-case recovery point is 2 minutes. Without it, restores go back only to a daily backup. ([source](https://supabase.com/docs/guides/platform/backups))

### Backup retention

- Amazon RDS: Between 0 and 35 days, set per DB instance; 0 disables automated backups entirely. The default depends on how the instance was created — one day via the API or CLI, seven days via the console — so there is no single default to quote. Multi-AZ DB clusters cannot be set below 1 day. ([source](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.BackupRetention.html))
- Supabase: Daily backups: 7 days on Pro, 14 days on Team, up to 30 days on Enterprise. Free projects get no automatic backups at all — Supabase tells free users to export their own data with the CLI. ([source](https://supabase.com/docs/guides/platform/backups))

### SOC 2

- Amazon RDS: Listed as SOC-compliant on AWS's own compliance scope page. ([source](https://aws.amazon.com/compliance/services-in-scope/SOC/))
- Supabase: SOC 2 Type 2 compliant; report available to Enterprise and Team customers via the dashboard. ([source](https://supabase.com/security))

### ISO 27001

- Amazon RDS: Covered under AWS's account-wide ISO/IEC 27001:2022 certification — not scoped per-service the way SOC, HIPAA and PCI DSS are on AWS's own site. ([source](https://aws.amazon.com/compliance/iso-27001-faqs/))
- Supabase: ISO 27001 certified; certificate available to Enterprise and Team customers via the dashboard. ([source](https://supabase.com/security))

### HIPAA

- Amazon RDS: Listed as a HIPAA-eligible service on AWS's own reference page. ([source](https://aws.amazon.com/compliance/hipaa-eligible-services-reference/))
- Supabase: HIPAA compliant; customers may store PHI after signing a BAA and meeting shared-responsibility obligations. ([source](https://supabase.com/security))

### GDPR / data residency

- Amazon RDS: AWS customers can process personal data on all AWS services in compliance with GDPR, and choose the storage type and geographic region for their data. ([source](https://aws.amazon.com/compliance/gdpr-center/))
- Supabase: Projects hosted in EU regions keep primary database data in-region; a DPA is available. ([source](https://supabase.com/security))

## Which should you choose?

Pick Amazon RDS if Teams already inside AWS, where the database sitting in the same VPC as everything else is worth more than any single feature on this page. Six engines, up to 35 days of point-in-time recovery, and read replicas you create and delete yourself.

Pick Supabase if Teams who want Postgres plus auth, storage and generated APIs from one vendor on a fixed monthly bill, and who would otherwise assemble those pieces themselves.

Consider something else: Amazon RDS — You want a database per pull request. RDS documents no branching, and replicas are manual — AWS states outright that it does not autoscale them.

Consider something else: Supabase — You want only a database. Much of the $25 covers a platform you may not use, and free projects are paused after a week of inactivity, which is not the same as scaling to zero.

## Documented by only one

- Free tier: Supabase: Yes
- Entry paid plan: Supabase: $25/month for the Pro plan, including the first project and $10/mo of compute credits; additional projects from $10/mo
- Pricing model: Supabase: Fixed monthly plan per organisation plus per-project compute, billed hourly by instance size
- Egress over allowance: Supabase: $0.09 per GB for uncached egress and $0.03 per GB for cached, charged only above the plan's quota. Egress restrictions clear at the next billing cycle, or immediately on upgrading or disabling the spend cap.
- Storage (entry plan): Supabase: 8 GB disk per project on the Pro plan; 500 MB on Free
- Included bandwidth: Supabase: 250 GB uncached and 250 GB cached egress a month on Pro and Team, pooled across Database, Auth, Storage and every other service as one Unified Egress Quota
- Regions: Supabase: 17 specific AWS regions across the Americas, Europe, Asia-Pacific and South America, plus broader 'general region' groupings that place the project on an available AWS region within an area. General regions do not support read replicas or API management.
- When idle: Supabase: Free projects are paused after one week of inactivity and must be restored manually; paid projects are not paused
- Database branching: Supabase: Supported
- PCI DSS: Amazon RDS: Listed as PCI DSS-compliant on AWS's own compliance scope page.
- Encryption at rest: Supabase: AES-256 at rest and TLS in transit; sensitive tokens/keys get application-level encryption before storage.
- Role-based access control: Supabase: Organization members can be granted access to specific resources, including read-only and billing-only roles.

## Questions this comparison answers

**Should I choose Amazon RDS or Supabase?**

Pick Amazon RDS if Teams already inside AWS, where the database sitting in the same VPC as everything else is worth more than any single feature on this page. Six engines, up to 35 days of point-in-time recovery, and read replicas you create and delete yourself.
Pick Supabase if Teams who want Postgres plus auth, storage and generated APIs from one vendor on a fixed monthly bill, and who would otherwise assemble those pieces themselves.