WattleDB vs Supabase: the Australian-owned alternative.
Supabase is a very good product. This page is not about which one has more features, because on features you already know the answer. It is about the one question a Supabase region setting cannot answer, and what happens when your tender, your DPA or your customer's security assessment asks it.
A region is a setting. Ownership is a structure.
Supabase shipped a Sydney region, and it works. Your rows sit in Australia. But that region runs on AWS, so the company that owns the hardware is American, and Supabase Inc. is a Delaware corporation, so the company that owns the service is American too. Choosing ap-southeast-2 changes where the bytes rest. It does not change who owns them, who runs them, or which government can compel their production.
That distinction is invisible right up until someone asks you about it in writing. A health tender with a sovereignty clause. A customer's security questionnaire asking you to name every entity in the chain and every jurisdiction that reaches them. At that point a region setting is not an answer, and no amount of product quality makes it one.
WattleDB exists for the teams who have to answer that question. The contracting entity is RR Sols Pty Ltd, ABN 56 672 722 486, an Australian company with no foreign parent and no foreign holding company. The infrastructure is Binary Lane, Australian-owned, in Sydney with backups in Melbourne. The contract is governed by the laws of New South Wales. Every person with production access lives here. There is one entity, one jurisdiction, one answer.
This is not a gap Supabase can close with a release. It is a function of where the company is incorporated.
The questions that decide the deal.
Not a feature scorecard. These are the lines that appear in vendor security assessments, tenders and enterprise DPAs, and the answers are set by corporate structure, not by roadmap.
| The question on the form | WattleDB | Supabase |
|---|---|---|
| Who is the contracting entity? | RR Sols Pty Ltd, ABN 56 672 722 486 | Supabase Inc., Delaware, USA |
| Is there a foreign parent or holding company? | None | Yes, US |
| Who owns the physical infrastructure your data sits on? | Binary Lane, Australian-owned | Amazon Web Services, US-owned |
| Is the provider exposed to US CLOUD Act production orders? | Not directly. WattleDB is an Australian entity with no US parent, so it is not subject to US production orders. Australian providers can be reached only through the Australia-US CLOUD Act treaty path, which is limited to serious crime and runs through Australian legal safeguards. | Yes, as a US-incorporated provider |
| Which law governs the contract, and whose courts hear a dispute? | New South Wales, Australia | United States |
| Where do the people with production access live? | Australia, all of them | Distributed globally |
| Can you name every party in the chain and its jurisdiction? | Yes, in writing | Supabase Inc. + AWS + sub-processors |
| Who answers the phone, under which law? | Australian team, Australian law | Global support |
Every answer above is verifiable from public records and our own DPA and Terms. The US CLOUD Act reaches data in the possession, custody or control of a US-based provider regardless of the country it is stored in, which is why the Supabase column reads the way it does even with the Sydney region selected. No provider anywhere can promise immunity from every legal process, and we don't. We explain the treaty path that can reach an Australian provider, and its limits, in CLOUD Act vs Privacy Act. Nothing here suggests Supabase mishandles data. It is a question of which legal systems can reach it, and how directly.
What WattleDB deliberately does not run.
WattleDB is a data layer, not an application platform. We give you managed PostgreSQL, an auto-generated REST API over PostgREST with JWT and row-level security, S3-compatible object storage, and point-in-time recovery. That is the boundary, and we hold it on purpose.
We do not run your compute. There are no Edge Functions. Realtime subscriptions are in development and not shipped. Hosted Auth is in early access, by invitation, on Hobby, Launch and Scale, and is not generally available yet. If you need serverless functions, realtime or generally available hosted auth in production this quarter, Supabase does that today and we would rather tell you than lose your trust in month two.
The upside of a narrow boundary is that it is describable. When you are the one signing a security questionnaire, every additional service inside the trust boundary is another row you have to explain, another runtime executing code next to your data, another dependency to name. A smaller surface is not a smaller product here. It is the part you can defend.
Evidence, not adjectives.
Sovereignty claims are only worth what you can produce when someone checks them. Here is what we will put in front of your compliance team, your bid writer or your customer.
Ownership on the record
RR Sols Pty Ltd, ABN 56 672 722 486, registered in NSW. No foreign parent, no foreign holding company, verifiable against the ABR. We will put that in a signed statement for your tender.
Data processing agreement
An Australian-law DPA written against the Privacy Act and the APPs, including breach assistance, sub-processor notice rights, and return and deletion on exit.
Sub-processor list
The full list, each one named with its jurisdiction and what it touches, available on request, so nobody has to take "Australian-owned" on faith. Outside the data boundary sit our payment provider, our email provider, a fraud-prevention provider used at card entry, an address-lookup service and our certificate authority. None of them receives your database contents.
Australian jurisdiction
Contracts governed by the laws of New South Wales, disputes heard in NSW courts. No foreign forum clause, no arbitration in another hemisphere.
Security questionnaire pack
Pre-filled answers to the questions that come up in every third-party risk review, so your team is not chasing us for a fortnight mid-procurement. Ask and we will send it.
Sovereignty self-check
Run your current stack through the sovereignty checker and see which foreign entities are already in your chain before you talk to anyone, including us.
Which should you choose?
WattleDB is the right call if
- You have to answer a sovereignty, foreign-control or CLOUD Act question in writing, for a tender or a customer's security review.
- You handle health, legal, accounting or education data with Australian residency obligations.
- Your customers ask who owns their data and you want one sentence, not a diagram.
- You want flat AUD pricing per database, and an Australian team under Australian law when something breaks.
Not yet the right fit for APRA-regulated, government or card-data workloads: we hold no ISO 27001, SOC 2, IRAP or PCI DSS attestations (see the FAQ).
Supabase is the right call if
- You need Edge Functions or realtime in production today.
- Nobody is going to ask you the ownership question, and residency is not in any contract you have signed.
- You want the widest ecosystem and the largest community, and usage-based pricing suits you.
If that is you, use Supabase. It is a good product and this page is not for you.
Moving from Supabase.
Your database and API
Dump and restore Postgres, carry your RLS policies, re-point the PostgREST API and copy Storage to S3. How to migrate from Supabase, step by step.
Your users and logins
Export the bcrypt hashes, sign HS256 tokens yourself and keep your auth.uid() policies, with what does not move stated plainly. Moving off Supabase Auth and keeping your users.
The region question
What the Sydney region gives you for data residency, and why a local region is not a local company. Does Supabase have an Australian region? Sydney vs ownership.
Supabase and Australian ownership
Is Supabase available in Australia?
Does an Australian region from Supabase satisfy a data sovereignty requirement?
Who is the contracting entity behind WattleDB?
What does WattleDB not do that Supabase does?
Is every one of your sub-processors Australian?
Can I migrate from Supabase to WattleDB?
pg_dump/pg_restore of your schema and data over WattleDB's DIRECT_URL, then repointing your connection string.Does WattleDB cost less than Supabase?
Build like it is Supabase. Answer like it is the Privacy Act.
One Australian entity, one jurisdiction, one answer when someone asks who owns your data.