Supalens
Log inConnect Supabase
Supalens for Supabase

You built your SaaS on Supabase.Now who watches the business?

Connect your Supabase organization and your GitHub repository. Supalens reads the schema and the code that gives it meaning, proposes KPI definitions you approve, then monitors them and investigates what changed.

Connect SupabaseTry the live demo

Read-only data access · Human-approved monitors

The whole path

  1. 01Supabase OAuth
  2. 02GitHub
  3. 03Business rules
  4. 04KPIs you approve
  5. 05Monitoring
  6. 06Slack investigation

What actually happens when you connect

Nothing here needs your database password, and nothing here can write.

  1. 01

    OAuth, not credentials

    You authorize Supalens against your Supabase organization. The database password is never exposed by the Management API, so we never ask for it and never hold it.

  2. 02

    A read-only role per project

    Supalens mints a dedicated supalens_ro role in the project you pick, and stores only that role's credentials — encrypted per tenant.

  3. 03

    Read-only is structural

    Queries run as SELECT-only statements inside a READ ONLY transaction, with a statement timeout, a row cap and an audit record. No tool exists that writes.

  4. 04

    Disconnect whenever

    Revoking the connection destroys the stored credentials. Your project keeps working; Supalens simply stops seeing it.

Pick one project to start with — production or staging. You can add the rest later.

Why code

Your schema isn’t your business logic.

Your database knows what exists. Your code knows what to count.

Schema only

subscriptions.status = 'active'

Active subscriptions1,284

What the code actually says

status = 'active'AND deleted_at IS NULLAND trial = falseAND payment_status = 'paid'AND internal_account = false

Active subscriptions1,061lib/billing/mrr.ts:42

Illustrative values. No production database connected.

Valid SQL can still produce the wrong business answer.

That is why connecting GitHub is not an accuracy option — it is the reason Supalens exists. Supalens reads the rules from your repo, keeps them as SUPALENS.md, and every KPI and every question runs on top of them. Excluding cancelled subscriptions, filtering internal accounts, dropping refunds — nobody has to remember.

How it works

From connect to monitoring, in four steps.

Set up once. From then on, Supalens watches the business for you.

  1. 01

    Connect Supabase + GitHub

    One OAuth for Supabase, a GitHub App for the code. Read-only role, read-only permissions.

  2. 02

    Review what Supalens understood

    Entities and business rules, each with its code evidence. Approve what is right, fix what is not.

  3. 03

    Approve your KPIs

    Review execution-verified KPI proposals and pick what to monitor. Definitions in plain language, SQL one click away.

  4. 04

    Monitor all + connect Slack

    Approved KPIs are checked on your plan’s cadence; when one breaks, Supalens investigates and posts to Slack.

Product preview · sample data. Illustrative values. No production database connected.

Monitoring · Root cause

The signal, in your workflow.

When an approved monitor fires, Supalens investigates the data and stored code context. Review confirmed facts and likely causes separately in Slack or email. An all-clear follows when the metric recovers.

Try the live demo

Alert firing2:14 PM

Daily revenue below baseline

₩3.1M−26%Baseline ₩4.2M

Metric
daily_revenue
Condition
< ₩4.0M
Source
DailyCart · prod
Confirmed in data
  • Payment failure rate 0.3% → 7.8%
  • Renewal revenue −31% · new subscriptions −4%
  • Japan −52% · US normal
Likely driver

Failures at the payment-confirmation step most likely rose after the coupon migration shipped on 7/5 (0051_coupons.sql). Per the code context, review the checkout confirmation logic first.

Investigated by Supalens · the driver is a hypothesis to review

  1. Slack · #alerts2:14 PM

    Alert firing

    Confirmed in data · Likely driver

  2. Mail2:14 PM

    [supalens] Daily revenue anomaly detected

    owner@dailycart.co.kr

  3. On recovery6:40 PM

    Alert resolved

    The value moved out of the alert condition and is back to normal. Current value ₩4.3M.

Illustrative values. No production database connected.

Security

By design, Supalens can’t change your data.

Read-only isn’t a promise — it’s the architecture. There’s no tool that writes, your credentials are sealed, and the analysis AI runs isolated, without them.

ENCRYPTION

Sealed credentials

Your database credentials are envelope-encrypted with a per-organization key (AES-256-GCM). The master key that wraps it is never stored in the database, so a database dump alone can’t decrypt them. Plaintext never reaches your browser or the AI model.

  • AES-256-GCM
  • per-tenant DEK
  • AAD-bound
ACCESS

Structurally read-only

Questions and monitors run read-only. Non-SELECT statements are rejected, and a READ ONLY transaction, statement timeout, and row cap are always applied. Supabase OAuth connections get a dedicated read-only role (supalens_ro) minted per project; directly connected databases run on the credentials you provide, wrapped in the same SELECT-only guard and READ ONLY transaction.

  • SELECT-only
  • READ ONLY tx
  • supalens_ro · OAuth
RUNTIME

Isolated AI execution

The analysis AI runs in a sandbox with credentials stripped from its environment — no shell, file, or network tools. Database credentials never enter the model process, and only pre-approved tools can run.

  • env-stripped
  • no shell / net
  • deny-by-default
ISOLATION

Tenant isolation

Row-level security is enabled on every user table. One analysis is bound to one organization, chosen by the server — never by the question or the model, so it can’t reach another org’s data.

  • RLS
  • 1 run = 1 tenant

In the open

We don’t replicate your whole database. During analysis, query results are sent to Anthropic (Claude), and we store the answer, a sample of up to 200 rows, your schema structure, the context extracted from code (SUPALENS.md), approved KPI definitions, and monitor events with their investigation results. Every query is audit-logged and auto-deleted after a set period, and deleting a data source or your account revokes the stored credentials at once — they can no longer be used.

Compliance

  • Privacy policy with full subprocessor disclosure
  • Data-subject rights: access, deletion, and more
  • Payments handled by Paddle — no card data stored
Privacy policy
Pricing

Pick by how many KPIs you watch.

Start free, move up as you monitor more.

Free

$0

When you start watching metrics alone

Includes:

  • 3 monitors
  • Checked every 2 hours
  • Email · Slack · Discord alerts
  • 1 data source
  • 1 team member
  • 15 questions / month · fair use
Start free
Recommended for startups

Basic

$89/mo

For SaaS teams just getting going

Everything in Free, plus:

  • 10 monitors
  • Checked every 10 minutes
  • Email · Slack · Discord alerts
  • 3 data sources
  • 5 team members
  • 150 questions / month · fair use
Get started

Standard

$299/mo

For teams with more to watch

Everything in Basic, plus:

  • 50 monitors
  • Checked every 5 minutes
  • Email · Slack · Discord alerts
  • 10 data sources
  • 15 team members
  • 750 questions / month · fair use
Start now

Premium

$899/mo

For large-scale operations, no limits

Everything in Standard, plus:

  • Unlimited monitors
  • Checked every 5 minutes
  • Email · Slack · Discord alerts
  • Unlimited data sources
  • Unlimited team members
  • Unlimited questions · fair use
Get started

All prices are in USD. Start free — no credit card required. AI investigations run when a monitor fires.

You build the product. Supalens watches the business.

Connect SupabaseTry the live demo

No credit card · Read-only by design