Sovereignty is not
a region setting.
Every backend platform will happily put your database in Frankfurt. That is the easy half. The half nobody sells you is the second party — the company that operates the service, holds the credentials, and can be asked for your rows without asking you first.
Rebase gives you what Firebase and Supabase give you — REST, a typed SDK, realtime, auth, storage, functions, cron and an admin panel — as an open-source container you run on a box you rent in Europe. There is no second party, because there is no us.
Who holds the keys
Everyone can host in Europe. That was never the hard part.
You will read a lot of marketing that implies your data is being flown to Virginia. It usually is not. Supabase will provision in Frankfurt; Firestore has a European multi-region. If the question is where is the disk, all three answers below are the same, and we are not going to pretend otherwise to sell you something.
The question worth asking is the other one. Who is the second party?Switch vendors below and watch which row moves.
Europe, if you ask for itunchanged
eur3 · Belgium + Netherlands
Google LLCseated in United States
Rewrite every query — Firestore is not SQL and does not dump to it
Firestore will keep your documents in eur3. Google still runs the service, holds the credentials, and is a US company.
A US-seated provider can be ordered to produce data in its possession, custody or control, including data held on European disks. Whether that ever happens to you is a legal question. Whether there is a second party who could be asked is a structural one.
Regions above are the European options each vendor publishes, not defaults — all three will keep data in Europe if you ask. Nothing here is legal advice; if you have a specific obligation, take it to counsel with the architecture in hand.
What you actually deploy
A published container and a database you already know how to run
Self-hosting has a reputation, and it is mostly deserved: most "open source alternatives" hand you a compose file with nine services in it and wish you luck. Rebase is two processes. Postgres, and the runtime image with your project mounted into it.
There is no application image to build. rebase buildproduces a bundle; the runtime is already on Docker Hub. Upgrading Rebase is a tag change, not a rebuild — your bundle is untouched.
Creating tables is a separate, deliberate command. A container restart must never be able to change your schema as a side effect of a deploy.
The self-hosting guideHetzner, OVHcloud, Scaleway, IONOS — anything with SSH and Docker
Commands taken verbatim from the self-hosting guide. There is no application image to build — the runtime is published, your project travels as a bundle.
// docker-compose.yml — the whole deployment
services:
db:
image: postgres:18-alpine
api:
image: rebasepro/server:0.11.0
volumes:
- ./dist-bundle:/bundle:ro
environment:
DATABASE_URL: postgres://…@db:5432/rebase
JWT_SECRET: ${JWT_SECRET}
// that is the deployment. There is no application
// image to build — the runtime is published, and
// your project travels as a bundle.Small enough to read in one sitting
That is the entire production deployment, minus the secrets. Two services, one volume, three environment variables. The runtime refuses to start in production withoutDATABASE_URL,JWT_SECRET andCORS_ORIGINS rather than guessing them.
Mount the bundle read-only and a compromised hook cannot rewrite the code that runs after the next restart. Point your orchestrator's liveness probe at/livez and readiness at/health; the first never touches the database, so a brief hiccup does not restart a perfectly healthy process.
The bill
Their price is a function of your success. Yours is a number you chose.
This is the part of self-hosting that people are too polite to lead with, so we will. A managed backend prices monthly active users, gigabytes stored and gigabytes served, which means the bill grows in exactly the moment you least want a new bill. A VPS charges the same amount in the month you launch and the month you get on the front page.
Below is the honest version of that comparison, including the parts that do not favour us.
Describe the app you are actually building
- Pro planincludes $10 of compute credit$25.00
- ComputeSmall — 2 vCPU, 2 GB — $15 less the credit$5.00
- Monthly active users—
- Database disk—
- File storage—
- Egress—
Every figure is a price Supabase publishes, checked 28 July 2026 — including the compute add-on, which is sized by the same rule as the box opposite rather than left on the included Micro instance. Still conservative: it counts no read replicas, no PITR and no support plan.
Pick a box — it has to fit the workload
Indicative shapes at European providers. Yours will differ — put your own number on it.
- One VPS4 vCPU · 8 GB RAM · 80 GB NVMe€12.00
- Object storage100 GB in an S3-compatible bucket, ~€0.01/GB€1.00
- Monthly active usersno per-user pricing exists€0.00
- Database disk8 GB of the 80 GB you already rented€0.00
- Egress250 GB of the 20 TB the plan includes€0.00
One machine, so no failover: this is the price of a box that can hold the workload, not of a highly available cluster. And the line no invoice shows — you patch it, back it up and get paged for it. If nobody on the team wants that job, the managed bill is buying something real and you should pay it.
The right-hand column is sized from the sliders — disk for the database plus 30% headroom and 20 GB for the system, RAM to cache a quarter of the database, a vCPU per 50k monthly actives — and the same rule sizes the compute add-on on the left, so neither column gets to run this workload on hardware that could not hold it. Files sit in an S3-compatible bucket rather than on that disk, which is how Rebase's storage layer is deployed in practice. Those shapes and rates are indicative, not a quote. Dollars and euros are shown as they are billed and not converted — we are not going to track FX on a marketing page, and at present rates it does not change the shape. Supabase's published prices are the source for the left column; check your own provider for the right one. Firebase is not modelled here on purpose: Firestore bills per document read, and nobody can tell you how many reads an app you have not written yet will do. That unpredictability is a cost too, it just does not fit in a slider.
No lite tier
The self-hosted build is the build
There is no open-core split here, no feature held back for a paid tier, and no telephone-home. The container you run on your own hardware serves every surface Rebase has. This is the list, and it is the same list on every page of this site.
The admin panel is a separate React app that talks to the same public API under the same policies. Add it, skip it, or delete it — the API response does not move.See the panel.
Where to put it
European hosts we have no relationship with whatsoever
Seventeen cities, seven companies, and a €-denominated invoice from each of them. Pick one below and watch which pins are theirs — the one thing they all have in common is that none of them is us.
Every pin is a place you could put your Postgres tonight. Pick a host to see whose it is.
17 cities. 7 companies. None of them us.
No affiliate links, no referral codes, no partner tier. A container and a Postgres connection string run anywhere, and where you put them is genuinely none of our business — which is the entire point of the page you are reading.
Locations as published by each provider, and they change — check before you commit. Switzerland sits outside the EU under an adequacy decision, which is a different legal position from a member state.
Paperwork
Where this leaves you on GDPR
You are the controller, and the only processor
- No third-party processor in the path. The software runs on your infrastructure; we receive nothing, so there is no sub-processor list to chase and no transfer to assess.
- Access and deletion requests are SQL. Answer them from your own database, on your own timetable, without filing a support ticket with a vendor.
- Residency is a decision, not a plan tier. Put Postgres wherever your obligations require it, including a machine in your own building.
Being the only processor is also a job
Nobody else can be compelled to hand over your data — and nobody else is going to patch your kernel, notice that your backup has been silently failing for three weeks, or answer the pager at two in the morning. Both halves of that sentence come from the same fact.
- Backups are yours to prove.
rebase db backuptakes role-complete dumps and restores them, but a backup nobody has restored is a hypothesis. - Keys are yours to lose. There is no support ticket that recovers a
JWT_SECRETyou deleted. - Uptime is yours to own. One VPS is one machine. If the business needs two, the architecture allows it and your invoice notices.
If nobody on the team wants that job, that is a real answer and a managed platform is buying you something real. We would rather you decide that on the way in than find out later.
None of this is legal advice. It is an architecture description, which is the part we can actually be held to — and thesecurity pagedescribes how the access rules themselves are enforced.
It takes one command to find out
No account, no credit card, no region picker. It scaffolds a project, starts Postgres, and hands you a running backend on your own machine — which is, conveniently, the most sovereign infrastructure you own.
