Supabase backup options: what each one covers and misses

Supabase makes the daily backups itself and keeps them with the project. They are database backups: Storage metadata is included, the files themselves are not.

From the Supabase backup and PITR documentation. PITR also needs at least a Small compute add-on. database backup documentation

Daily backups are listed in the dashboard under Database, then Backups. Newer projects use physical backups, and Supabase documents that those restore inside the platform but cannot be downloaded as a file.

For a copy you can keep somewhere else, you need a logical export: pg_dump or the Supabase CLI.

PITR restores the database to any second within its retention window, with a worst-case recovery point of about two minutes. It costs about $100 a month for 7 days, $200 for 14 days and $400 for 28 days, on top of the plan and compute. Like the daily backups, it covers the database only and restores into the same project.

This is the free route, and the one Supabase recommends for projects on the free plan. Export roles, schema and data as three files, with the session pooler connection string in an environment variable:

supabase db dump --db-url "$SUPABASE_DB_URL" -f roles.sql --role-only
supabase db dump --db-url "$SUPABASE_DB_URL" -f schema.sql
supabase db dump --db-url "$SUPABASE_DB_URL" -f data.sql --use-copy --data-only

Run it on a schedule, store the files outside Supabase and alert when a run is missing. The export covers the database and Auth. It does not contain Storage files.

Storage files

The database keeps a row for each file, not the file itself. After a database-only restore, the Storage UI lists every file while every download fails. Copy the bytes separately through the S3-compatible endpoint.

Do Supabase backups include Storage files?

Edge Functions

Function code lives outside Postgres. If you deploy from git with CI, your repository is the backup. If you deploy from the dashboard or a tool such as Lovable, the deployed version is the only copy.

How to back up Supabase Edge Functions

Settings and secrets

Bucket settings, Auth configuration and API keys live in the platform, not the database. Secret values cannot be exported at all, so keep them in your own secret store.

A backup job that finishes without errors proves a file was written. It does not prove the file restores. Check it regularly, or after every backup if you can automate it:

1. Restore into an empty, isolated database, with errors treated as fatal.
2. Compare tables, row counts and Auth users with the source.
3. Download a few Storage files through the restored project.
4. Time it, so you know how long a real recovery takes.

A side project on the free plan

Run the CLI export weekly and copy Storage with aws s3 sync. It costs nothing except the time to keep it running.

A paid plan, with only database data

The daily backups cover it. Add PITR when losing up to a day of writes is not acceptable.

Users upload files

Add a separate copy of Storage, whichever tool makes it. Neither the daily backups nor PITR include files.

Project deletion is a risk you plan for

Supabase removes a project's backups when the project is deleted. Keep a copy outside Supabase that includes Storage and Edge Functions, and test that it restores.