Supabase hosts the Postgres database, file storage buckets, realtime channels, and the auth layer that the entire platform runs on. RLS policies enforce per-org tenancy at the database layer — no application path can return a row from another organization, by design.
@supabase/ssr + @supabase/supabase-js with createClient pattern across server actions