Scope: Access & provisioning, credits/usage, system setup, updates/releases. Last reviewed: 26 August 2026. Note: "Supabase" is the internally documented product name for the platform sometimes informally referred to as "Superbase."

Access and provisioning

Supabase projects must be provisioned under the Docebo organization through the AI Operations Jira Service project — personal Supabase accounts are not permitted.

Access is named-user and least-privilege. The security baseline calls for SSO/MFA, limited administrative maintainers, quarterly access reviews, and immediate removal when a user changes role or leaves. Project-specific Admin access is granted through approved Jira requests.

Credits and cost management

A Supabase proof of concept used a credit-based commercial model with spending capped at up to $10,000 for the pilot. Expansion or ongoing use required deeper review.

Open gap: no recurring Supabase budget, credit-monitoring, spend-alert, chargeback, or named cost-owner policy was found.

System setup

Supabase is used when an application needs database, storage, realtime, or Edge Functions — stateless applications should not use it. AI Ops provisions a Docebo-owned project and provides the project URL, anon key, and server-only service-role key. Runtime secrets belong in Vercel environment variables, not source control or GitLab CI variables.

Production, staging, preview, and development environments should be separated with distinct credentials and controlled migration promotion. Row-level security (RLS) is mandatory for every production table. The service-role key bypasses RLS and must remain server-side; the anon key is permitted for client access only when RLS protects the data.

Updates and releases

Schema changes must be committed as version-controlled SQL migration files rather than ad-hoc dashboard edits. Types should be regenerated after migrations.

Open gap: Supabase-specific upgrade cadence, vendor-update handling, and rollback procedures were not clearly documented.

For citizen-developer applications, Supabase changes move through the governed GitLab merge-request and security workflow, with deployment through Vercel.

Open items

Assign the recurring cost owner, define ongoing credit monitoring, publish the project deprovisioning process, and document upgrade/rollback handling.