Architecture and data flows
The Next.js application serves the interface and authorized server APIs.
Locate durable state
The Next.js application serves the interface and authorized server APIs. Supabase provides PostgreSQL, Auth, Storage and Realtime. PostgreSQL holds application records, account/platform state and Storage metadata; the Storage backend holds object bytes. Protected server configuration contains keys and provider credentials. Application containers can be recreated, but database volumes, raw Storage and matching keys must persist. A complete restore needs them together.
Follow a user request
The browser uses public application and Supabase origins. Auth establishes the session; server endpoints verify the actor and object access before reading or changing content. Realtime projects updates to connected sessions. In the full profile, server-to-Supabase calls use internal Kong without changing browser origins or account-link identity. The scheduler invokes authenticated HTTP jobs independently of browser connections.
Identify each outbound boundary
AI models, email, Git, remote MCP, push, analytics and external object backends are separate destinations when enabled. Running the app yourself does not make those services local. Managed Supabase operates your selected backend while the full profile places the pinned stack under your control. Cloud operates the service with its configured providers; self-hosting supplies your own accounts and choices. Review permissions, costs and data terms for each enabled integration. Never infer a provider or Cloud edition from a hostname or deployment platform.