Question 1

How are my database credentials stored?

Accepted Answer

Your database password is encrypted with AES-256-GCM before it ever reaches our database. Each credential gets a unique random 12-byte initialization vector (IV), so even identical passwords produce different ciphertext. We store three separate fields — the encrypted password, the IV, and the GCM authentication tag — and never store plaintext credentials anywhere.

Question 2

What is AES-256-GCM and why do you use it?

Accepted Answer

AES-256-GCM is an authenticated encryption algorithm — it both encrypts your data and produces a tamper-detection tag. If anyone modifies the ciphertext in storage, decryption fails rather than returning corrupted data. It's the same standard used by banks, government agencies, and cloud providers for data at rest.

Question 3

Where is the encryption key stored?

Accepted Answer

The master encryption key is a 256-bit key stored as a server-side environment variable. It never leaves the server, is never sent to the browser, and is never included in API responses. Only the backup worker and API routes that need to connect to your database can access it.

Question 4

Are my backups encrypted?

Accepted Answer

Yes. Backup files are encrypted with AES-256-GCM before being uploaded to storage. The transfer to Backblaze B2 also happens over TLS. Your backup data is encrypted both in transit and at rest.

Question 5

Can SupaSafe employees read my data?

Accepted Answer

No. The pg_dump process runs in an isolated Trigger.dev container. The dump output is encrypted and uploaded directly to object storage — it's never written to a persistent filesystem or inspected by any person. We have no tooling to browse customer backup contents.

Question 6

How do you prevent shell injection attacks?

Accepted Answer

We use Node.js execFile (not exec) to invoke pg_dump. This passes your connection string as an argument array rather than interpolating it into a shell command, which eliminates shell injection as an attack vector entirely.

Question 7

What happens if someone tampers with a stored credential?

Accepted Answer

AES-256-GCM includes an authentication tag that acts as a cryptographic checksum. If the encrypted password, IV, or tag is modified in the database, decryption will fail with an authentication error rather than producing an incorrect password. The backup job will fail and you'll be notified.

Question 8

Is my connection to Supabase secure?

Accepted Answer

Yes. pg_dump connects to your Supabase database over SSL/TLS. We recommend using the session pooler connection string, which routes through Supavisor with TLS enforced. Your data never travels unencrypted.

Question 9

Where are my backups stored?

Accepted Answer

Backups are stored in Backblaze B2 object storage, which provides 99.999999999% (11 nines) durability. Files are replicated across multiple drives within the data center. Each backup includes a SHA-256 checksum so you can verify integrity after downloading.

Question 10

How long are backups retained?

Accepted Answer

On the free tier, backups are retained for 7 days. Expired backups are automatically cleaned up by a daily job. Paid tiers offer longer retention windows.

Question 11

Can I restore from a SupaSafe backup?

Accepted Answer

Yes. Backups use pg_dump's custom format, which is compatible with pg_restore. You can restore to any PostgreSQL database, including a new Supabase project. Download the backup from your dashboard and run pg_restore with the file.

Question 12

What happens if a backup fails?

Accepted Answer

Failed backups are automatically retried up to 3 times with exponential backoff. If all attempts fail, we send you an email notification with the error details so you can investigate. The backup status is tracked in your dashboard.

Question 13

Why do I need SupaSafe if Supabase has backups?

Accepted Answer

Supabase provides managed backups on Pro plans, but you can't download them directly — they're for Supabase's own disaster recovery. Free-tier projects don't include backups at all. SupaSafe gives you independent, downloadable backups that you fully own and control, regardless of your Supabase plan.

Question 14

How does SupaSafe connect to my database?

Accepted Answer

You provide your Supabase connection string during project setup. We validate the connection, encrypt your credentials, and use pg_dump over SSL for each backup. We recommend the session pooler connection string for best compatibility.

Question 15

What does the free tier include?

Accepted Answer

The free tier includes 1 project, weekly automated backups, 7-day retention, and email notifications on failure. It's enough to protect a side project or small production database.

Frequently Asked Questions

Security & Encryption

Backups & Storage

General