Skip to content
ReviveDB
Browse documentation

Security, regions and retention

Credential encryption, storage regions, retention rules and deletion behavior.

ReviveDB stores the Supabase OAuth authorization needed to protect a project. Supported projects use a new read-only database login for each backup instead of a saved production database password. Credentials are encrypted and are not exposed through customer-facing APIs.

Credentials

  • Supabase OAuth tokens and service-role keys are encrypted at rest.
  • In-place restores use a separate temporary read-write login that assumes the mapped postgres role and is removed after the job.
  • Decrypted credentials are only read by the backup or recovery pipeline that needs them.
  • Saved credentials are never returned through GraphQL responses or download links.
  • Disconnecting a source removes saved source credentials and stops future backups; existing recovery points remain until deleted or expired.

Recovery-point storage

  • Managed storage is separate from Supabase, so a provider or account incident does not remove both copies at once.
  • Stored objects use server-side encryption and explicit region-specific destinations.
  • Every Storage object is read back and checked by byte size and SHA-256 after upload.

Regions

New recovery points are stored in the EU on Cloudflare R2. The selected destination is recorded with the backup. ReviveDB does not silently move a backup to another region when the selected destination is unavailable.

Retention and usage

Retention is a configurable maximum, not a promise that a recovery point exists for every day in the period. The number retained also depends on successful runs and the account-wide retained-data allowance.

  • Expired snapshots are removed automatically according to the project policy.
  • Content-addressed Storage blobs are removed only after their final retained snapshot reference expires.
  • Additional capacity is available only through a separately priced Enterprise agreement; there is no automatic self-service add-on.

Privacy and operational controls

Read the public Security page, Privacy notice, DPA and subprocessor list for the current contractual and processing details.