Quickstart: hosted Supabase backups

Sign in at app.backupdrill.com/login — the login page handles signup too. The Free plan needs no credit card.

Paste your Session pooler connection string, found in the Supabase dashboard under Project Settings → Database → Connection string → Session pooler. Don’t use the Direct connection string — it resolves to IPv6 only.

The postgres user from that string works as-is — it owns your tables, so dumps pass row-level security. If you prefer a dedicated least-privilege role, be aware of two Postgres gotchas: pg_dump needs select on sequencestoo, and it errors on any RLS-enabled table the role can’t bypass (most Supabase tables have RLS on) — so a plain read-only role usually can’t back up a Supabase project. Advanced setup, only if your schema has no RLS tables:

-- replace <generate-a-strong-password> before running
create role backup_reader with login password '<generate-a-strong-password>';
grant usage on schema public to backup_reader;
grant select on all tables in schema public to backup_reader;
grant select on all sequences in schema public to backup_reader;
alter default privileges in schema public grant select on tables to backup_reader;
alter default privileges in schema public grant select on sequences to backup_reader;

Backups are written to a bucket you own — S3, R2, or B2 — never to our storage. Provide the endpoint, region, bucket name, access key ID, and secret access key. No bucket yet? The bucket setup guide has exact click-paths for all three providers. For Cloudflare R2:

Endpoint: https://<account>.r2.cloudflarestorage.com
Region:   auto

R2 is addressed path-style: the bucket name travels in the request path, so the endpoint stays the same for every bucket in your account. Because the snapshots land in your bucket, they stay yours — cancel any time and every path to recovery still works.

Backup and drill cadence follow your plan:

Nothing else to configure — the first backup kicks off within a few minutes of connecting, and later runs follow your plan’s schedule. Each run writes a pg_dump in custom format, a copy of your Storage files, and a checksummed manifest into your bucket — see the tree below for exactly what lands there.

Monthly on Solo, weekly on Team and Agency — and once on Free, on your first backup — a drill restores your latest snapshot into a throwaway Postgres and verifies it: archive sha256, pg_restore completes, post-data objects (indexes and constraints) applied, table count matches, no missing tables, and populated tables are non-empty. Every drill produces a report, and failures alert you by email — so the day you need an actual restore, it’s a known quantity.