Eurobase is a fully EU-native backend-as-a-service platform — a free, GDPR-native European alternative to Firebase and Supabase. It provides 6 authentication methods (email, magic links, OAuth with Google/GitHub/LinkedIn/Apple, and phone SMS OTP), managed PostgreSQL, object storage, realtime subscriptions, Deno edge functions, encrypted vault, cron jobs, webhooks, a CLI with 50+ commands, and audit logging — all hosted exclusively on European infrastructure under EU jurisdiction.

How is Eurobase different from Firebase or Supabase?

Unlike Firebase (Google) and Supabase (US-based), Eurobase is 100% European-owned and operated on EU infrastructure. It is not subject to the US CLOUD Act, offers GDPR-native architecture with automated DPA reports, GDPR data export, sub-processor registry, and full audit logging. It includes features like encrypted vault, cron scheduling, webhooks with HMAC signing, and a dedicated CLI — with zero sovereignty compromise.

Is Eurobase GDPR compliant?

Yes. Eurobase is GDPR-native by design — not as an add-on. Every project ships one-click DSAR exports (Article 15 right of access + Article 20 right to data portability), an Article 30 Record-of-Processing report generated from your live configuration, a tamper-evident audit log with actor/action/IP, a per-project sub-processor registry, and row-level security. All data is stored on 100% EU-owned infrastructure (Scaleway, France) — zero US CLOUD Act exposure.

Do Firebase or Supabase offer built-in DSAR exports?

No. Neither Firebase nor Supabase ships a built-in DSAR (Data Subject Access Request) primitive. On Firebase you write a custom Cloud Function that walks every Firestore collection plus Auth and Storage. On Supabase you hand-roll SQL across auth.users and every public table. On AWS Amplify you stitch DynamoDB, Cognito, and S3 buckets together yourself. Eurobase is the only EU-native BaaS that ships GDPR Article 15 + Article 20 exports as a one-click platform feature, available on every project and every tier — free included. We won't paywall a legal obligation.

How much does a DSAR cost to fulfil manually?

Industry surveys put the average cost of fulfilling a single DSAR at around $1,500 — typically 8–12 hours of engineering time spent stitching CSV exports together, searching support tools, and walking application logs. Request volume jumped 246% in the two years to 2024. Statutory response time under GDPR Article 12 is 30 days; missing it carries supervisory-authority risk up to €20 million or 4% of global annual turnover. Eurobase replaces the manual workflow with a one-click console export plus an SDK call (`eb.auth.exportMyData()`) that lets end-users self-serve, rate-limited and audited.

Is Eurobase free to use?

Yes. The Free tier includes 5,000 monthly active users, 512 MB storage, 2 GB bandwidth, 50 realtime connections, and every feature — no credit card required. Projects auto-pause after 30 days idle and wake on the first request. Pro is €25/mo per project (no pausing, custom email templates, BYO SMTP, quota alerts, 100,000 MAU). A Team tier with dedicated PostgreSQL 16 (2 vCPU / 4 GB RAM / 50 GB SSD, France) is €149/mo per project (coming soon). A Legal Team tier for German legal-tech is in closed beta — pricing on request.

What are the limits for auth emails (verification, password reset, magic link) on Pro?

No throughput cap from our side when you use BYO SMTP. Verification, password-reset, and magic-link emails all route through the same dispatcher: if a verified custom SMTP sender is configured on your project, the send goes through your provider and skips our platform sender entirely — your provider's limits apply, not ours. Without BYO SMTP, sends go through our platform TEM; there's no hourly project cap enforced today. Rate-limits page in the console shows what applies.

Can I send verification or password-reset emails to thousands of users at once on Eurobase?

Yes — no recipient-count limit. Distributed real users each come from their own IP, so the two anti-abuse throttles that do apply don't bite a real user base: signup/signin is capped per-IP (up to 30 per 5 minutes on Pro), and token verifications are capped per-IP (up to 150 per 5 minutes on Pro). Password-reset volume itself is unbounded from our side. Pair Pro with BYO SMTP (SendGrid, Postmark, Amazon SES, Scaleway TEM) and your provider is the only ceiling.

Can I fully customize verification, password-reset, and magic-link emails on Eurobase?

Yes on Pro and above — subject line and HTML body are independently customizable per template type (verification, password_reset, magic_link). Templates are picked up automatically on every send with no code change. Free tier uses the default templates.

Does Eurobase support German legal-tech retention (§50 BRAO / §257 HGB / §147 AO)?

Yes, on the Legal Team tier (closed beta). §50 BRAO Aufbewahrungspflicht is 6 years flat; §257 HGB is split (10 years for Handelsbücher / Rechnungen / Jahresabschlüsse, 6 years for Handelsbriefe); §147 AO mirrors the §257 HGB split. Legal Team ships WORM per-prefix object-storage locks, ad-hoc retention holds (per record / per prefix), DSAR erasure that respects legal holds, a 10-year audit-log retention window, signed §203 StGB Verschwiegenheitsverpflichtungen from every staff member with data access, and a GoBD Verfahrensdokumentation. See eurobase.app/security#de-legaltech for the full dossier and the linked v2 legal documents.

What backend does a German legal-tech / Kanzlei-facing product actually need?

Four hard blockers you cannot solve with a plain EU-region Firebase or Supabase deployment: (1) §203 StGB / §43e BRAO staff-secrecy paperwork — signed declarations from every staff member with data access; (2) statutory retention with WORM enforcement — §50 BRAO 6y, §257 HGB 10y books / 6y letters, §147 AO mirror; (3) GoBD-conformant exports plus a Verfahrensdokumentation; (4) 10-year tamper-evident audit-log retention. Eurobase closes all four on the Legal Team tier (closed beta) via an addendum to the DPA. Region-only EU hosting does not satisfy any of them.

Does Eurobase have BSI C5, ISO 27001, and IT-Grundschutz coverage?

Actual certificates are on the post-beta roadmap. Today the dossier at eurobase.app/security#de-legaltech includes a dated BSI C5 roadmap (target Type-1 attestation 12 months post-launch), an ISO 27001 Statement of Applicability draft covering 2022 Annex A controls, a BSI IT-Grundschutz self-declaration under the Basis-Absicherung profile for SME, a NIS-2 positioning document (below employee/revenue thresholds today, voluntary cascade-obligation compliance, commitment to register on crossing), and an AI Act positioning document (Eurobase is infrastructure, not an AI system; the Customer is the deployer for any high-risk build).

Is Eurobase available today?

Yes — sign up at console.eurobase.app, no credit card required. The complete backend platform — including auth, database, storage, realtime with row-level filtering, edge functions with scheduled jobs, vault, cron, webhooks, CLI, GDPR self-serve export, MCP server, and audit logging — is built and in production. Free tier: 5,000 monthly active users, 512 MB Postgres, all features included. Pro: €25/mo per project.

Is Eurobase good for vibe coding?

Absolutely. Eurobase is designed for fast iteration — sign up, get your API keys, and start building in minutes. Auth (6 methods), database, storage, realtime, functions, vault, cron, and webhooks are ready out of the box with simple SDKs and a CLI with 50+ commands. No infrastructure setup, no DevOps, no compliance paperwork. Just vibe and build.

Where is Eurobase data stored?

All data is stored exclusively on European infrastructure operated by EU-owned providers, specifically Scaleway in France. Eurobase has zero exposure to the US CLOUD Act or similar extraterritorial legislation. Your data never leaves EU jurisdiction.

Is there a Supabase alternative in the EU?

Yes. Eurobase is a Supabase-compatible backend built and hosted entirely in the EU. Same Postgres foundation, same auth + storage + realtime + edge functions surface, same SDK shape. The difference is the corporate parent (Estonian OÜ vs Delaware) and the infrastructure floor (Scaleway in France vs AWS). That removes the CLOUD Act exposure that survives even when Supabase is deployed in an EU region.

Is a Supabase EU-region deployment enough for GDPR?

Picking Supabase's EU region gives you physical data residency in the EEA and a standard SCC-based DPA — a competent baseline, but not immunity from the CLOUD Act. Because Supabase Inc. is a Delaware corporation using AWS, US authorities can compel data access even for EU-region deployments. Eurobase removes that exposure by having no US corporate parent and no US-owned processor in the critical path.

How do I migrate from Supabase to Eurobase?

Use the Eurobase CLI: `eurobase import supabase assess` for a read-only report against your existing Supabase project, then `eurobase import supabase schema | data | storage | functions` to move each surface. Auth-user import is next. The CLI reads your Supabase project directly and emits an executable plan; no rewrites required on your app code.

My app is built on the supabase-js client. Do I have to rewrite my client layer?

The honest picture on three levels. (1) Shape-parity: @eurobase/sdk mirrors @supabase/supabase-js deliberately — same .from(table).select().eq() chain, same channel(name).on('postgres_changes', …) subscribe shape, same auth methods. In practice this is search-replace on imports + package name, not a rewrite of query call sites. (2) Drop-in supabase-js wire-compat (same package name, no code change at all) is on the roadmap as a shim package — it removes the young-company objection entirely. (3) Zero-SDK escape hatch on Team tier: a direct Postgres DATABASE_URL means Payload, Prisma, Drizzle, or any Postgres client works without any Eurobase-specific code — the reversibility guarantee then covers your app code too, not just your data.

What happens if I exceed the Pro-tier storage or bandwidth caps?

No overnight blackout — that is a business-risk pattern paying customers can't manage, and one of the clearest pieces of feedback from beta users. The Pro-tier overage policy for public beta: (1) email alerts at 75% and 100% of the storage / bandwidth caps. (2) A 14-day soft-grace window where writes continue and the console shows the overage banner — enough time to upgrade to Team, buy an add-on capacity block, or optimise. (3) Only after the grace window does the affected module hard-block writes — and even then reads always continue. Team tier (dedicated Postgres per project + elastic storage tier) removes the caps entirely and is the recommended path for photo/video-heavy or streaming workloads. We do not meter per-GB overage on Pro — no surprise line items.

How is the 10,000 realtime connections cap counted?

Active concurrent WebSocket connections. No hard limit on messages/second or connection duration today, but soft fair-use at ~100 msg/s per connection and ~1M msg/s per project — raiseable on request. Practical connection duration is bounded by TCP keepalive + our load-balancer idle timeout (600 s).

Can I point Eurobase at my own S3 bucket (BYO storage)?

Not today. BYO S3 is on the Team-tier roadmap — it needs per-tenant credentials + audit-path rewiring. No firm date. In the meantime, our object storage runs on Scaleway (Paris, France) with the same sovereignty guarantees as the rest of the platform.

Who is the contracting legal entity, and does it have any non-EU parent or subsidiary?

Contracting entity: Eurobase OÜ, Estonian private limited company, registry code 17557586, Ahtri 12, Tallinn 15551. Not VAT-registered under Estonian VAT Act §19. No parent company, no subsidiaries, no non-EU entity. Sole shareholder is the founder. Every sub-processor in the RoPA is EU-headquartered.

Do you provide a signable DPA and an up-to-date sub-processor list?

Yes. DPA v2 is signable at eurobase.app/legal. The sub-processor list is auto-generated per project in the console Compliance tab as an Article 30 report (downloadable PDF, updated on every configuration change). No email tickets, no stale spreadsheets.

When can your team access customer data, and can I audit it?

Our team is three people, all physically in the EU. Every operator SQL call goes through an authenticated pool that writes to public.data_access_log — every query stamped with actor, source IP, and active Postgres role. You see that table from your own console (Audit tab). We do not process your data content for any purpose other than platform operation.

What SLA do you commit to per tier?

Free: no commitment. Pro: 99.5%/month, support response within 24h business hours. Team: 99.9%/month, response within 4h. No automatic downtime credits today — honest reflection of team size at launch. Credits land with the Team tier opening.

What happens to my data — and my app code — if Eurobase ceases operations?

Data reversibility, four lines of defence. (1) Standard formats: Postgres + S3-compatible = migration to any host (Scaleway direct, OVH, Aiven, self-hosted) is documented, not a rewrite. (2) Export CLI: eurobase export produces a full dump (schema + data + storage + functions). (3) Source is public today: platform code lives on github.com/STGime/euroback under BUSL-1.1, with an Additional Use Grant that permits self-hosting for your own apps and internal tools; each commit auto-converts to Apache 2.0 four years after it lands. SDK + MCP server are MIT. What is not shipped yet is a supported self-host distribution. (4) On shutdown: 90-day notice + 90 additional days of read-only service to finalise export. App-code reversibility, two mitigations: (a) @eurobase/sdk is shape-parity with supabase-js, so migrating away is search-replace on imports, not query-site rewrites. (b) On Team tier, the direct DATABASE_URL means your app can talk to Postgres with Payload / Prisma / Drizzle / psql — no Eurobase code in the client at all — so migration is a hostname change.

How big is the Eurobase team, and how are you funded?

Core team: founder + two long-term freelancers, all EU-based. Bootstrapped, with EU-Sovereign-Cloud grant applications in flight and preliminary angel conversations. The way to size that risk is not our reassurances — it is the reversibility guarantee (Postgres dump + standard S3 + source public on GitHub under BUSL, auto-Apache 2.0 after four years). If we sink, you migrate to Scaleway direct in a weekend using the export CLI.

← Back to home

Security, vulnerability disclosure & German legal-tech

How we secure the platform, where our controls sit against EU NIS2 Article 21 and GDPR Article 32, how to responsibly report a security issue, and the dated German legal-tech dossier (BSI C5 / ISO 27001 / IT-Grundschutz / NIS2 / AI Act).

TL;DR

▸ All customer data lives on Scaleway fr-par (Paris, France). No US-owned processor in the critical path.
▸ Corporate parent is Eurobase OÜ (Estonian commercial-register code 17557586). No US corporate parent means no CLOUD Act or FISA §702 reach.
▸ Encryption in transit is TLS 1.3; at rest is AES-256; secrets vault is AES-256-GCM per-tenant; signing is HMAC-SHA256 with domain separation.
▸ Data-breach and cyber-incident SLAs align with GDPR Article 33 and NIS2 Article 23 — 24 h early warning, 72 h notification, 1-month final report.
▸ Written ISMS-lite governs the platform — public, versioned.
▸ Report a security issue: security@eurobase.app — response within 3 business days.

NIS2 & regulatory posture

Eurobase OÜ is currently below the size threshold for direct NIS2 applicability (fewer than 50 employees AND less than €10 M annual turnover). Cloud computing service providers of our size are, per Article 2(1), not directly obligated entities under NIS2. We adopt the controls anyway because our customers do rely on us at that standard.

When Eurobase crosses the threshold, we will register with the Estonian national CSIRT (RIA / CERT-EE) and issue an updated ISMS reflecting our new status as an important entity.

GDPR compliance is not conditional on the size threshold. GDPR Articles 32 (security of processing) and 33 (breach notification) apply from day one, and are governed by our published Privacy Policy, FAQ, and DPA.

German legal-tech / Steuerberater / regulated-industry customers: see the German legal-tech dossier for BSI C5 / ISO 27001 / IT-Grundschutz / NIS2 / AI Act positioning.

NIS2 Article 21 control matrix

The ten risk-management measures required by Article 21(2). Status reflects the platform as of the ISMS effective date — 22 July 2026.

§	Requirement	Status	Notes
(2)(a)	Risk analysis + information system security policies	Shipped	Written ISMS-lite; risk register reviewed annually.
(2)(b)	Incident handling	Shipped	Console-side data-breach register with 24h / 72h SLA workflow; internal on-call rota + runbooks.
(2)(c)	Business continuity + crisis management	Shipped	RTO measured + RPO policy-bounded, published below in Backup & recovery; daily scheduled Postgres backups (7-day retention) plus customer-triggered on-demand snapshots; monthly regression test (script + CronJob scaffolded, on operator demand today, automated once the ops image lands).
(2)(d)	Supply-chain security	Shipped	Public sub-processor register with region + CLOUD-Act flags; 30-day advance notice on additions.
(2)(e)	Security in acquisition, development, maintenance + vulnerability handling	Shipped	Dependabot, static analysis, mandatory PR review, staged rollouts; CVD policy below.
(2)(f)	Policies to assess effectiveness of the risk-management measures	Partial	Annual ISMS review + post-incident review formalised; independent audit deferred to ISO 27001 track.
(2)(g)	Basic cyber hygiene practices + cybersecurity training	Shipped	Applies at hiring; formalised in HR-security section of the ISMS.
(2)(h)	Cryptography and encryption policies	Shipped	TLS 1.3 in transit; AES-256 at rest; AES-256-GCM vault; HMAC-SHA256 signing with domain separation.
(2)(i)	HR security, access control, asset management	Shipped	Six-role Postgres split; per-tenant role isolation; PATs with expiry; superadmin flag not self-servable.
(2)(j)	Multi-factor authentication, secured comms, secured internal systems	Roadmap	Platform TOTP + WebAuthn planned for Team tier (Q4 2026). Tenant end-user MFA via OAuth today.

Encryption

Surface	Algorithm	Notes
Data in transit — all HTTP	TLS 1.3 (1.2 fallback)	HSTS 1-year max-age.
Data at rest — Postgres	AES-256	Scaleway managed disk encryption.
Data at rest — Object storage	AES-256 (SSE-S3)	Scaleway managed.
Vault secrets	AES-256-GCM, per-tenant key	Application-layer envelope; key rotated per major release.
JWT session tokens	HMAC-SHA256	Kubernetes Secret; never logged.
Webhook signing	HMAC-SHA256	Per-webhook secret; timestamp in signed payload for replay protection.
Unsubscribe tokens	HMAC-SHA256	Domain-separated from JWT via SHA-256 derivation.
Password storage	bcrypt cost 12	Platform + tenant end-user passwords alike.

Incident-response SLAs

Aligned with GDPR Article 33 and NIS2 Article 23. Timing is measured from the moment Eurobase becomes aware of the incident.

6 hInternal early warning. Incident opened; on-call founder acknowledges.
24 hCustomer early warning. Notice that a significant incident has occurred, where customer-facing impact is suspected.
72 hFormal incident notification. Notice to affected customers with initial assessment and known-facts summary. Regulatory notification when GDPR Article 33 thresholds are met — to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
30 dFinal report. Root cause, corrective actions, lessons learned. Anonymised post-mortem published on /blog if impact was material.

Backup & recovery

Team-tier dedicated Postgres instances carry daily scheduled backups (7-day retention) plus customer-triggered on-demand snapshots, with 1 self-service restore per calendar month included (from either source, either counts against the same cap). Free and Pro tiers share a managed instance without customer-selectable restore; Eurobase restores the shared instance to its own recovery targets in a disaster scenario.

The RTO below is measured, not aspirational — it comes from a runbook and script an operator can run against a throwaway Scaleway RDB instance in ~30 minutes (docs/runbooks/backup-pitr-test.md). The RPO is a policy bound set by the daily-backup schedule, not a measurement — an on-demand snapshot tightens it to a customer-chosen window on that specific recovery.

RTOMeasured restore time at ~5 MB dataset: 16s (fixed provisioning + plumbing overhead — the baseline that dominates at small data volumes). Restore time increases with database size; for workloads above ~100 MB we provide a bespoke measurement on request. Test executed 2026-09-06 via the customer-facing backup create → backup restore path.
RPOUp to 24 hours between scheduled backups. Team-tier customers can take on-demand snapshots at any point to reduce this to a window of their own choosing — a snapshot immediately before a risky migration means the RPO on that recovery is seconds. Tighter guarantees than "the last scheduled backup" require customer action; this is a deliberate trade-off against the cost of continuous shipping to a warm standby.

An automated monthly regression job (Kubernetes CronJob) is scaffolded to re-measure the RTO on the 1st of every month and alert on drift; today it runs on operator demand until the ops image build lands. The runbook covers scenarios T1–T8 including cross-project isolation and backup-ciphertext-in-EU verification.

Coordinated Vulnerability Disclosure

If you believe you have found a security vulnerability in the Eurobase platform, please report it to security@eurobase.app.

What to include: a description of the issue, the affected surface (URL, API endpoint, CLI command, etc.), reproduction steps, and any suggested mitigation. Attach proof-of-concept material as needed.

Our commitments:

Acknowledgement of receipt within 3 business days.
Initial assessment within 10 business days.
Fix or documented mitigation within 90 days of confirmation for high/critical; 180 days for medium.
Public disclosure coordinated with the reporter.
Public credit for the reporter, on request.
No legal action against good-faith researchers who follow this policy.

Please do not:

Access, modify, or delete data belonging to other customers.
Conduct denial-of-service testing without prior written consent.
Publicly disclose the vulnerability before an agreed coordination window.
Use social engineering against Eurobase staff or contractors.

Machine-readable pointer at /.well-known/security.txt (RFC 9116).

ISMS-lite

The full written Information Security Management System is public and versioned in the Eurobase source repository:

📄docs/legal/v2/isms.md→

Reviewed annually and after every significant incident. Version 2.0, effective 22 July 2026, approved by the sole board member of Eurobase OÜ.

German legal-tech

▸BSI C5 roadmap — target Type-1 attestation 12 months post-launch, phase plan + assessor shortlist.
▸ISO 27001 — Statement of Applicability (draft) — 2022 Annex A control coverage, path to certificate.
▸BSI IT-Grundschutz self-declaration — Basis-Absicherung profile for SME, self-attested until formal ISO 27001.
▸NIS-2 positioning — below employee/revenue thresholds today; voluntary compliance to cascaded obligations; commitment to register on crossing.
▸AI Act positioning — Eurobase is infrastructure, not an AI system; Customer is the deployer for any high-risk build.

Legal Team tier backing docs

▸Legal-tech DPA addendum — §203 StGB / §43e BRAO staff-secrecy, §50 BRAO / §257 HGB / §147 AO retention holds, GoBD export.
▸GoBD Verfahrensdokumentation — the process documentation §146 AO expects.