Eurobase is a fully EU-native backend-as-a-service platform — a free, GDPR-native European alternative to Firebase and Supabase. It provides 6 authentication methods (email, magic links, OAuth with Google/GitHub/LinkedIn/Apple, and phone SMS OTP), managed PostgreSQL, object storage, realtime subscriptions, Deno edge functions, encrypted vault, cron jobs, webhooks, a CLI with 50+ commands, and audit logging — all hosted exclusively on European infrastructure under EU jurisdiction.

How is Eurobase different from Firebase or Supabase?

Unlike Firebase (Google) and Supabase (US-based), Eurobase is 100% European-owned and operated on EU infrastructure. It is not subject to the US CLOUD Act, offers GDPR-native architecture with automated DPA reports, GDPR data export, sub-processor registry, and full audit logging. It includes features like encrypted vault, cron scheduling, webhooks with HMAC signing, and a dedicated CLI — with zero sovereignty compromise.

Is Eurobase GDPR compliant?

Yes. Eurobase is GDPR-native by design — not as an add-on. Every project ships one-click DSAR exports (Article 15 right of access + Article 20 right to data portability), an Article 30 Record-of-Processing report generated from your live configuration, a tamper-evident audit log with actor/action/IP, a per-project sub-processor registry, and row-level security. All data is stored on 100% EU-owned infrastructure (Scaleway, France) — zero US CLOUD Act exposure.

Do Firebase or Supabase offer built-in DSAR exports?

No. Neither Firebase nor Supabase ships a built-in DSAR (Data Subject Access Request) primitive. On Firebase you write a custom Cloud Function that walks every Firestore collection plus Auth and Storage. On Supabase you hand-roll SQL across auth.users and every public table. On AWS Amplify you stitch DynamoDB, Cognito, and S3 buckets together yourself. Eurobase is the only EU-native BaaS that ships GDPR Article 15 + Article 20 exports as a one-click platform feature, available on every project and every tier — free included. We won't paywall a legal obligation.

How much does a DSAR cost to fulfil manually?

Industry surveys put the average cost of fulfilling a single DSAR at around $1,500 — typically 8–12 hours of engineering time spent stitching CSV exports together, searching support tools, and walking application logs. Request volume jumped 246% in the two years to 2024. Statutory response time under GDPR Article 12 is 30 days; missing it carries supervisory-authority risk up to €20 million or 4% of global annual turnover. Eurobase replaces the manual workflow with a one-click console export plus an SDK call (`eb.auth.exportMyData()`) that lets end-users self-serve, rate-limited and audited.

Is Eurobase free to use?

Yes. The Free tier includes 5,000 monthly active users, 512 MB storage, 2 GB bandwidth, 50 realtime connections, and every feature — no credit card required. Projects auto-pause after 30 days idle and wake on the first request. Pro is €25/mo per project (no pausing, custom email templates, BYO SMTP, quota alerts, 100,000 MAU). A Team tier with dedicated PostgreSQL 16 (2 vCPU / 4 GB RAM / 50 GB SSD, France) is €149/mo per project (coming soon). A Legal Team tier for German legal-tech is in closed beta — pricing on request.

What are the limits for auth emails (verification, password reset, magic link) on Pro?

No throughput cap from our side when you use BYO SMTP. Verification, password-reset, and magic-link emails all route through the same dispatcher: if a verified custom SMTP sender is configured on your project, the send goes through your provider and skips our platform sender entirely — your provider's limits apply, not ours. Without BYO SMTP, sends go through our platform TEM; there's no hourly project cap enforced today. Rate-limits page in the console shows what applies.

Can I send verification or password-reset emails to thousands of users at once on Eurobase?

Yes — no recipient-count limit. Distributed real users each come from their own IP, so the two anti-abuse throttles that do apply don't bite a real user base: signup/signin is capped per-IP (up to 30 per 5 minutes on Pro), and token verifications are capped per-IP (up to 150 per 5 minutes on Pro). Password-reset volume itself is unbounded from our side. Pair Pro with BYO SMTP (SendGrid, Postmark, Amazon SES, Scaleway TEM) and your provider is the only ceiling.

Can I fully customize verification, password-reset, and magic-link emails on Eurobase?

Yes on Pro and above — subject line and HTML body are independently customizable per template type (verification, password_reset, magic_link). Templates are picked up automatically on every send with no code change. Free tier uses the default templates.

Does Eurobase support German legal-tech retention (§50 BRAO / §257 HGB / §147 AO)?

Yes, on the Legal Team tier (closed beta). §50 BRAO Aufbewahrungspflicht is 6 years flat; §257 HGB is split (10 years for Handelsbücher / Rechnungen / Jahresabschlüsse, 6 years for Handelsbriefe); §147 AO mirrors the §257 HGB split. Legal Team ships WORM per-prefix object-storage locks, ad-hoc retention holds (per record / per prefix), DSAR erasure that respects legal holds, a 10-year audit-log retention window, signed §203 StGB Verschwiegenheitsverpflichtungen from every staff member with data access, and a GoBD Verfahrensdokumentation. See eurobase.app/security#de-legaltech for the full dossier and the linked v2 legal documents.

What backend does a German legal-tech / Kanzlei-facing product actually need?

Four hard blockers you cannot solve with a plain EU-region Firebase or Supabase deployment: (1) §203 StGB / §43e BRAO staff-secrecy paperwork — signed declarations from every staff member with data access; (2) statutory retention with WORM enforcement — §50 BRAO 6y, §257 HGB 10y books / 6y letters, §147 AO mirror; (3) GoBD-conformant exports plus a Verfahrensdokumentation; (4) 10-year tamper-evident audit-log retention. Eurobase closes all four on the Legal Team tier (closed beta) via an addendum to the DPA. Region-only EU hosting does not satisfy any of them.

Does Eurobase have BSI C5, ISO 27001, and IT-Grundschutz coverage?

Actual certificates are on the post-beta roadmap. Today the dossier at eurobase.app/security#de-legaltech includes a dated BSI C5 roadmap (target Type-1 attestation 12 months post-launch), an ISO 27001 Statement of Applicability draft covering 2022 Annex A controls, a BSI IT-Grundschutz self-declaration under the Basis-Absicherung profile for SME, a NIS-2 positioning document (below employee/revenue thresholds today, voluntary cascade-obligation compliance, commitment to register on crossing), and an AI Act positioning document (Eurobase is infrastructure, not an AI system; the Customer is the deployer for any high-risk build).

Is Eurobase available today?

Yes — sign up at console.eurobase.app, no credit card required. The complete backend platform — including auth, database, storage, realtime with row-level filtering, edge functions with scheduled jobs, vault, cron, webhooks, CLI, GDPR self-serve export, MCP server, and audit logging — is built and in production. Free tier: 5,000 monthly active users, 512 MB Postgres, all features included. Pro: €25/mo per project.

Is Eurobase good for vibe coding?

Absolutely. Eurobase is designed for fast iteration — sign up, get your API keys, and start building in minutes. Auth (6 methods), database, storage, realtime, functions, vault, cron, and webhooks are ready out of the box with simple SDKs and a CLI with 50+ commands. No infrastructure setup, no DevOps, no compliance paperwork. Just vibe and build.

Where is Eurobase data stored?

All data is stored exclusively on European infrastructure operated by EU-owned providers, specifically Scaleway in France. Eurobase has zero exposure to the US CLOUD Act or similar extraterritorial legislation. Your data never leaves EU jurisdiction.

Is there a Supabase alternative in the EU?

Yes. Eurobase is a Supabase-compatible backend built and hosted entirely in the EU. Same Postgres foundation, same auth + storage + realtime + edge functions surface, same SDK shape. The difference is the corporate parent (Estonian OÜ vs Delaware) and the infrastructure floor (Scaleway in France vs AWS). That removes the CLOUD Act exposure that survives even when Supabase is deployed in an EU region.

Is a Supabase EU-region deployment enough for GDPR?

Picking Supabase's EU region gives you physical data residency in the EEA and a standard SCC-based DPA — a competent baseline, but not immunity from the CLOUD Act. Because Supabase Inc. is a Delaware corporation using AWS, US authorities can compel data access even for EU-region deployments. Eurobase removes that exposure by having no US corporate parent and no US-owned processor in the critical path.

How do I migrate from Supabase to Eurobase?

Use the Eurobase CLI: `eurobase import supabase assess` for a read-only report against your existing Supabase project, then `eurobase import supabase schema | data | storage | functions` to move each surface. Auth-user import is next. The CLI reads your Supabase project directly and emits an executable plan; no rewrites required on your app code.

My app is built on the supabase-js client. Do I have to rewrite my client layer?

The honest picture on three levels. (1) Shape-parity: @eurobase/sdk mirrors @supabase/supabase-js deliberately — same .from(table).select().eq() chain, same channel(name).on('postgres_changes', …) subscribe shape, same auth methods. In practice this is search-replace on imports + package name, not a rewrite of query call sites. (2) Drop-in supabase-js wire-compat (same package name, no code change at all) is on the roadmap as a shim package — it removes the young-company objection entirely. (3) Zero-SDK escape hatch on Team tier: a direct Postgres DATABASE_URL means Payload, Prisma, Drizzle, or any Postgres client works without any Eurobase-specific code — the reversibility guarantee then covers your app code too, not just your data.

Are automatic backups included?

Free and Pro projects share a pooled Postgres cluster (Scaleway Managed Database, France) with cluster-level snapshots (daily, 7-day retention). Restores go through support. Team tier gets dedicated Postgres per project with daily scheduled backups (7-day retention) plus customer-triggered on-demand snapshots and 1 self-service restore per calendar month — from either source, either counts against the same cap. On every tier, `eurobase db dump` produces a standard pg_dump you can export anywhere at any time — the first-line reversibility guarantee independent of us.

What happens if I exceed the Pro-tier storage or bandwidth caps?

No overnight blackout — that is a business-risk pattern paying customers can't manage, and one of the clearest pieces of feedback from beta users. The Pro-tier overage policy for public beta: (1) email alerts at 75% and 100% of the storage / bandwidth caps. (2) A 14-day soft-grace window where writes continue and the console shows the overage banner — enough time to upgrade to Team, buy an add-on capacity block, or optimise. (3) Only after the grace window does the affected module hard-block writes — and even then reads always continue. Team tier (dedicated Postgres per project + elastic storage tier) removes the caps entirely and is the recommended path for photo/video-heavy or streaming workloads. We do not meter per-GB overage on Pro — no surprise line items.

How is the 10,000 realtime connections cap counted?

Active concurrent WebSocket connections. No hard limit on messages/second or connection duration today, but soft fair-use at ~100 msg/s per connection and ~1M msg/s per project — raiseable on request. Practical connection duration is bounded by TCP keepalive + our load-balancer idle timeout (600 s).

Can I point Eurobase at my own S3 bucket (BYO storage)?

Not today. BYO S3 is on the Team-tier roadmap — it needs per-tenant credentials + audit-path rewiring. No firm date. In the meantime, our object storage runs on Scaleway (Paris, France) with the same sovereignty guarantees as the rest of the platform.

Who is the contracting legal entity, and does it have any non-EU parent or subsidiary?

Contracting entity: Eurobase OÜ, Estonian private limited company, registry code 17557586, Ahtri 12, Tallinn 15551. Not VAT-registered under Estonian VAT Act §19. No parent company, no subsidiaries, no non-EU entity. Sole shareholder is the founder. Every sub-processor in the RoPA is EU-headquartered.

Do you provide a signed DPA (Auftragsverarbeitungsvertrag) and an up-to-date sub-processor list?

Yes, on every tier — including Free. Our Data Processing Agreement v2 (Art. 28 GDPR) is accepted click-through when you create your account, which is a valid written form under Art. 28(9). The full text, with Eurobase OÜ's legal name, registered address and registry code, the technical and organisational measures, and the live sub-processor annex, is always at console.eurobase.app/legal/dpa — print it or save it as PDF for your records. The always-current list of authorised sub-processors is at console.eurobase.app/legal/sub-processors, and the per-project Article 30 report in the console Compliance tab lists the ones actually engaged by the features you have enabled. A countersigned copy of the DPA on our letterhead, with the sub-processor list attached, is a paid-tier service: available on Pro and above on request, not on Free.

When can your team access customer data, and can I audit it?

Our team is three people, all physically in the EU. Every operator SQL call goes through an authenticated pool that writes to public.data_access_log — every query stamped with actor, source IP, and active Postgres role. You see that table from your own console (Audit tab). We do not process your data content for any purpose other than platform operation.

What SLA do you commit to per tier?

Free: no commitment. Pro: 99.5%/month, support response within 24h business hours. Team: 99.9%/month, response within 4h. No automatic downtime credits today — honest reflection of team size at launch. Credits land with the Team tier opening.

What happens to my data — and my app code — if Eurobase ceases operations?

Data reversibility, four lines of defence. (1) Standard formats: Postgres + S3-compatible = migration to any host (Scaleway direct, OVH, Aiven, self-hosted) is documented, not a rewrite. (2) Export CLI: eurobase export produces a full dump (schema + data + storage + functions). (3) Source is public today: platform code lives on github.com/STGime/euroback under BUSL-1.1, with an Additional Use Grant that permits self-hosting for your own apps and internal tools; each commit auto-converts to Apache 2.0 four years after it lands. SDK + MCP server are MIT. What is not shipped yet is a supported self-host distribution. (4) On shutdown: 90-day notice + 90 additional days of read-only service to finalise export. App-code reversibility, two mitigations: (a) @eurobase/sdk is shape-parity with supabase-js, so migrating away is search-replace on imports, not query-site rewrites. (b) On Team tier, the direct DATABASE_URL means your app can talk to Postgres with Payload / Prisma / Drizzle / psql — no Eurobase code in the client at all — so migration is a hostname change.

How big is the Eurobase team, and how are you funded?

Core team: founder + two long-term freelancers, all EU-based. Bootstrapped, with EU-Sovereign-Cloud grant applications in flight and preliminary angel conversations. The way to size that risk is not our reassurances — it is the reversibility guarantee (Postgres dump + standard S3 + source public on GitHub under BUSL, auto-Apache 2.0 after four years). If we sink, you migrate to Scaleway direct in a weekend using the export CLI.

Do Free-tier projects really pause, and what counts as activity?

After 30 days without a request, yes. Activity means a request to your project's own endpoint, .eurobase.app — anything the SDK, REST API, realtime or an edge-function call sends. Scheduled cron jobs running inside the project and console / CLI actions on the platform API do not count. Nothing is deleted or archived when a project pauses: the database keeps running, your data stays exactly where it is, and cron jobs keep firing. The only effect is that the first request after a pause takes about 30 seconds while the project flips back to active; every request after that is instant. Pro projects never pause.

How do I script a full export or nightly backup of a project?

Use the compliance export, which works on every tier including Free. Create a Personal Access Token in the console (Account → Personal Access Tokens; it starts with eb_pat_) and call POST /platform/projects/{id}/compliance/export on api.eurobase.app with Authorization: Bearer and a body of {"format":"json"} or "csv". The project's public / anon key cannot call it — it is a platform endpoint, and the token must belong to an admin of the project. The call returns an export id; poll GET …/compliance/exports/{exportId} until status is completed, then fetch download_url (a presigned link valid for one hour). The ZIP holds every table in your project's schema (up to 100,000 rows per table), including the auth users table, plus the project audit log (latest 10,000 entries) and a metadata file, and is kept for 7 days. Uploaded files in storage are not in the archive — pull those through the storage API. Limit: one full export per project per hour, so a nightly job is fine. Every export is written to the audit log. On Free the export is API-only; the one-click button in the console Compliance tab is Pro and above.

Why does my SDK insert fail with 'row-level security policy denied this operation' even with WITH CHECK (true)?

This is a Postgres RLS gotcha, not a gateway bug. The SDK executes every insert as INSERT ... RETURNING * so it can return the created row. On RETURNING, Postgres applies RLS twice: the INSERT policy's WITH CHECK when writing, then the SELECT policy's USING when reading the row back. If you have an INSERT policy but no matching SELECT policy, the write rolls back with the same error text as a real INSERT failure — misleading, which is why WITH CHECK (true) did not help. Fix: add a matching SELECT policy, usually with the same predicate. If your INSERT is WITH CHECK (user_id = auth_uid()), add FOR SELECT USING (user_id = auth_uid()). The Table Editor works because it goes through the elevated is_service_role() branch, so tenant RLS does not apply there. Full guide: console.eurobase.app/docs/rls.

← Back to home

Eurobase vs Appwrite: PostgreSQL vs collections, EU-owned infra vs Appwrite Cloud on AWS

Same open-source spirit, different data model and different infrastructure — Postgres on Scaleway (France) instead of collections on AWS, GDPR-native primitives in every project, €25/mo per project once you go live.

Two open-ish, developer-first stacks — two very different jurisdictional shapes

Eurobase and Appwrite both aim at the same buyer: a developer who wants an open, batteries-included backend without stitching together auth, storage, functions, and a database from scratch. Both ship auth, storage, functions, realtime, and a data layer. The differences are jurisdictional (where the corporate parent sits, what statutes the infrastructure is subject to) and structural (PostgreSQL as the primary abstraction vs. Appwrite's dual document/relational surface via Collections + TablesDB).

Appwrite is open-source (BSD-3-Clause) with a self-host option, plus a managed Appwrite Cloud. The company (Appwrite Code Ltd) is headquartered in Tel Aviv, Israel; Appwrite Cloud runs on AWS, with the EU region on eu-central-1 (Frankfurt). Israel has an EU adequacy decision (Commission Decision 2011/61/EU, renewed in 2024), which handles the transfer mechanism for Israel itself — but the AWS layer is a separate question, because AWS is a Delaware corporation subject to the CLOUD Act regardless of region. If you evaluated Appwrite and preferred it for its data-model breadth or its Flutter-first SDK, the honest question is whether the AWS dependency and the corporate-parent-outside-the-EEA add friction to your compliance posture.

Eurobase is a PostgreSQL platform operated by Eurobase OÜ (Estonian private limited company, registry code 17557586, Ahtri 12, Tallinn), running exclusively on Scaleway in France (fr-par). The critical path — Postgres, S3-compatible object storage, Deno edge functions — is on EU-owned infrastructure, with no adequacy hop required in the corporate-parent analysis. If your team wants relational queries, a real SQL surface, and an EU-native jurisdictional stack, that combination is what Eurobase does specifically.

Data model: Appwrite's dual surface vs Postgres-first — where the differences still matter

Appwrite's model changed materially in 2025. Alongside the original Collections + Documents + Attributes shape, TablesDB introduced a relational surface (tables, rows, columns) with SQL-style constraints, and Appwrite 1.8 (October 2025) added a multi-record ACID Transactions API. Any comparison written against the pre-2025 product is out of date. The remaining differences are real but narrower than they used to be: Postgres depth vs Appwrite's dual model, and where the ecosystem meets you.

Appwrite gives you both worlds now: the document metaphor for hierarchical data (Collections) and the relational metaphor for classic joined-tables workloads (TablesDB). The multi-record Transactions API removes the previous "single-document only" constraint. For a lot of app shapes this is genuinely convenient.

PostgreSQL is still a better fit when you need the depth of the mature Postgres surface — window functions with frames, CTEs, materialised views, generated columns, GIN/GiST/BRIN indexes on JSONB, foreign-key cascades with deferrable constraints, serialisable isolation, listen/notify, extensions (pgcrypto, pg_trgm, PostGIS, pgvector on Team-tier). It is also where the majority of open-source data tooling lives natively: Metabase, Superset, dbt, Grafana, PostgREST, Hasura, Directus all speak Postgres without an export step.

The concrete question is whether the additional Postgres depth is load-bearing for your product. If you use CTEs and window functions in analytics queries, if you rely on Postgres-native tooling in your data pipeline, or if a Team-tier customer wants direct psql/postgres:// access for Prisma/Drizzle/Payload/Directus, Eurobase's Postgres-first surface is the right fit. If TablesDB's relational shape covers your needs and you value the Flutter-first SDK story, Appwrite is a reasonable pick — and the sovereignty conversation reduces to the AWS-underneath-Cloud question.

▸Data model — Appwrite: Collections (documents) + TablesDB (relational rows/columns). Eurobase: PostgreSQL tables, JSONB when you want document-shape inside a row.
▸Joins across entities — Appwrite: TablesDB supports relationships; complexity for many-way joins still lands on the SQL side. Eurobase: native SQL joins with the full planner.
▸Multi-record transactions — Appwrite: multi-record ACID Transactions API (since 1.8, Oct 2025). Eurobase: BEGIN/COMMIT across any tables, plus serialisable isolation.
▸Advanced Postgres — Appwrite: not exposed (CTEs, window functions, extensions live outside the SDK surface). Eurobase: full Postgres surface including pgvector on Team-tier.
▸Ecosystem — Appwrite: platform-specific SDKs and a growing tool list. Eurobase: every Postgres-native tool works (Metabase, dbt, Grafana, PostgREST, psql).
▸Direct DB access — Appwrite: not exposed on Cloud (SDK/REST only). Eurobase: Team & Legal Team tiers ship a rotatable postgres:// URL for Prisma / Drizzle / Payload / Directus; SDK/REST-only on Free & Pro.

Appwrite Cloud EU region: what the AWS dependency actually means

Appwrite Cloud offers a Frankfurt region built on AWS eu-central-1. Physically, your data sits in Frankfurt. Jurisdictionally, the infrastructure is operated by Amazon Web Services, Inc., a Delaware corporation subject to the CLOUD Act. This is not a criticism of Appwrite — it is the standard trade-off any managed BaaS running on a hyperscaler faces. It is worth naming so procurement can weigh it.

Under the CLOUD Act (18 U.S.C. §2713, 2018), US authorities can compel disclosure of data held by US-headquartered providers or their subsidiaries, regardless of where the bytes physically sit. AWS falls squarely inside that rule. The Microsoft France testimony under oath at the French Senate in June 2025 made the same point about Azure EU regions: physical residency does not neutralise a warrant that reaches the US parent. AWS operates on the same statutory footing.

For most Appwrite Cloud users this is a non-issue — the CLOUD Act only bites when there is a US legal process against your data, and for most consumer or B2B SaaS apps that is a distant tail risk. For teams in regulated sectors (health, legal, gov-tech, some fintech), or teams selling into buyers whose procurement checklist added an EU-parent requirement after the 2024–2025 sovereignty wave, the tail risk becomes a hard filter.

Eurobase runs on Scaleway fr-par (Paris/France), a subsidiary of the French Iliad group. No hop in the critical path goes through a US-headquartered company. That is the difference between "our data is in Europe" and "our provider is Europe."

Self-hosting Appwrite vs a managed EU alternative

Appwrite is BSD-3-Clause and genuinely self-hostable. That is a legitimate answer to the sovereignty question — run it on a Scaleway VM, and you have EU-hosted Appwrite with none of the AWS dependency. The trade-off is the operational cost.

Self-hosting Appwrite means you own the Docker Compose stack (MariaDB + Redis in the core, plus the Appwrite services; ClamAV and some other components are optional in current 1.6–1.8 releases — the pre-1.4 InfluxDB dependency is gone), the container image upgrades, the backup and restore, the certificate rotation, the SMTP / OAuth secrets, the intrusion monitoring, the log retention, the disk sizing, and the failover story. For a solo developer or a small team where one person happily does this, self-hosted Appwrite on Scaleway or Hetzner is a fine answer.

For most product teams the calculation is different. The reason people pick a BaaS is to not run infrastructure. Eurobase is a middle path: a managed platform where the operator (Eurobase OÜ) and the underlying cloud (Scaleway) are both EU-owned, and where the operational burden stays with the vendor. If self-hosting Appwrite feels like the right answer but the ongoing on-call is not something the team wants, Eurobase is the version of that decision that keeps the developer experience without the DevOps cost.

Neither answer is wrong. The wrong answer is picking Appwrite Cloud without noticing the AWS dependency, or picking self-hosted Appwrite without pricing the on-call time honestly.

The GDPR primitives every project ships with

Regardless of which side of the Appwrite vs Eurobase choice you land on, if you serve EU end-users you own three GDPR obligations that most managed platforms leave as your homework: a Record of Processing Activities (Article 30), Data Subject Access Requests within 30 days (Articles 15 + 20), and an audit trail sufficient for a breach investigation. Eurobase ships all three built-in on every tier, including Free. The point is not that Appwrite is non-compliant — it is that GDPR compliance for a data controller (your app) requires certain artifacts, and Eurobase produces them automatically while Appwrite leaves them as work the developer does.

▸DSAR export (Article 15 + 20) — one click per-user or full-project zip, signed download URL that expires after 7 days, audit-logged. Appwrite = DIY.
▸RoPA report (Article 30) — auto-generated from the live sub-processor registry every time you download it. Appwrite = DIY.
▸Audit log — every admin action (schema change, user delete, key rotation, DSAR run) with actor, IP, timestamp, tamper-evident hash chain. Appwrite Cloud has activity logs; hash-chained audit is not the default shape.
▸Sub-processor list — public, machine-readable, one-click download. Same information Appwrite publishes, delivered as a structured Article 30 artifact rather than a marketing page.
▸End-user self-serve DSAR — eb.auth.exportMyData() lets your signed-in end-users request their own export from your app. Rate-limited, audit-logged, zero engineering per request.

How your app code changes when you move from Appwrite

The Appwrite SDK shape is not identical to the Eurobase SDK — the data-model difference means a straight import-swap is not the story. What is true is that the surface areas map cleanly: Appwrite Databases → Eurobase eb.db (with SQL semantics), Appwrite Account → eb.auth, Appwrite Storage → eb.storage, Appwrite Realtime → eb.realtime, Appwrite Functions → eb.functions. The mental model port is short; the query rewrites are the substantive work.

The client SDK import changes from appwrite to @eurobase/sdk. Authentication calls (create account, create session, get session) map one-to-one to eb.auth methods. Storage upload / download / list operations translate cleanly. Realtime subscriptions move from channel strings ("databases.{id}.collections.{id}.documents") to a channel-and-filter shape (channel(name).on("postgres_changes", { event, schema, table, filter })) that is closer to Supabase realtime than to Appwrite realtime — this is one of the transitions that needs handling.

The database calls change most. Appwrite's createDocument / getDocument / listDocuments become eb.db.from('table').insert(...) / .select().eq('id', ...) / .select() with SQL filters. The Appwrite Query builder (Query.equal, Query.orderDesc, Query.limit) maps to the Eurobase query builder's .eq() / .order() / .limit() with mostly matching semantics. Appwrite's Permissions (read/write/create/update/delete on collections) become PostgreSQL RLS policies — Eurobase ships preset policies (owner_access, public_read_owner_write, service_only, read_only) that cover the same common patterns without hand-writing the SQL.

The gaps to be honest about: Eurobase does not ship a first-party Flutter SDK today (JS/TS is the primary; the wire protocol works from any Postgres client or HTTP). We do not have an Appwrite migration CLI — for teams with substantial Appwrite deployments, the current path is a script the developer writes against the Appwrite REST API to read documents and eb.db.insert() them into Postgres tables. If a specific Appwrite Cloud customer wants to migrate at scale we would build the CLI subcommand.

Pricing side by side (post-September 2025)

Appwrite repriced Appwrite Cloud in September 2025 — Pro is now $25/mo per project (the previous $15 rate applied per team member, not per organization) with usage-based overages. Eurobase Pro is €25/mo per project with fixed caps. Self-hosted Appwrite is still free plus the operational cost of running the stack.

▸Self-hosted — Appwrite: BSD-3-Clause, run it yourself (Docker Compose, MariaDB + Redis + optional components). Eurobase: source is public on GitHub under BUSL-1.1 with an Additional Use Grant permitting self-hosting for your own apps and internal tools (backend converts to Apache 2.0 four years after each commit; SDK + MCP server are MIT). We do not offer a supported self-host distribution today, but the code is not a black box.
▸Free tier — Appwrite Cloud: generous limits (250 concurrent realtime connections, 5 GB bandwidth) alongside functions, storage, and MAU caps. Eurobase: 5k MAU, 512 MB DB, 512 MB storage, 2 GB bandwidth, 50 realtime connections, pause after 30 days idle.
▸Paid tier — Appwrite Pro: $25/mo per project with usage-based overages. Eurobase Pro: €25/mo per project with fixed caps (100k MAU, 100 GB storage, 250 GB bandwidth, 10k realtime).
▸Enterprise / Team tier — Appwrite Scale is a custom-priced tier for higher usage and support. Eurobase Team: €149/mo per project (dedicated Postgres, daily backups + on-demand snapshots, SSO, RBAC, audit trail; SOC 2 Type II coming soon — invite-only beta today).
▸Billing entity — Appwrite Cloud: Appwrite Code Ltd (Israel). Eurobase: Eurobase OÜ (Estonia). Both count per project post-Sep 2025.

Feature comparison

Feature	Eurobase	Appwrite
Data model	PostgreSQL (tables, joins, transactions, SQL, JSONB when a row wants document shape)	Collections (documents) + TablesDB (relational rows/columns) — dual surface as of 2025
Direct database access	Team & Legal Team tiers — rotatable postgres:// URL for Prisma, Drizzle, Payload, Directus, psql. Not exposed on Free/Pro (shared cluster).	Not exposed — access via SDK / REST only
Infrastructure (managed)	Scaleway, France (EU-owned)	AWS eu-central-1 (US-owned, Frankfurt region)
Self-hosted option	Source public on GitHub (BUSL-1.1, Additional Use Grant permits own-app / internal-tool self-hosting; auto-converts to Apache 2.0 after 4y). No supported self-host distribution yet.	BSD-3-Clause, Docker Compose (MariaDB + Redis + optional components)
Corporate parent (managed)	Estonian OÜ (EU member state)	Appwrite Code Ltd (Tel Aviv, Israel — EU adequacy decision applies); AWS = Delaware corporation
CLOUD Act exposure (managed)	None	Yes — AWS is a US corporation
GDPR compliance	Native — DPA, RoPA, DSAR export, audit log in every project	DPA available; RoPA + DSAR left to the customer
Auth methods	Email/password, magic link, phone SMS, OAuth (6 providers)	Email/password, magic link, phone SMS, OAuth, anonymous, JWT
Row / document permissions	PostgreSQL RLS with preset shapes (owner_access, service_only, read_only, …)	Per-document permissions (read / write / update / delete)
Realtime	WebSocket subscriptions on Postgres changes with row-filter	WebSocket subscriptions on collection events
Edge functions	Deno runtime, hosted in France (fr-par)	Functions runtime, hosted on AWS
First-party mobile SDKs	JS/TS today (Flutter / React Native / native iOS / native Android can call the REST endpoints; direct postgres:// wire access is Team/Legal Team only and not intended for mobile clients).	Flutter, React Native, Android, iOS, Apple platforms — first-class
Vault / Secrets	AES-256-GCM, per-tenant key, built-in with audit log	Environment variables per function
Free-tier idle pause	After 30 days idle; single request wakes it (~30 s). Never on Pro.	No idle pause on Appwrite Cloud Free — different constraint model (usage caps).
Pricing (paid tier)	€25/mo per project (Pro). Team €149/mo (dedicated Postgres, invite-only beta today).	$25/mo per project (Pro, post-Sep 2025) + usage-based overages. Scale is custom-priced.
Cron jobs	Built-in scheduler with execution log	Function schedules (cron expression on functions)
Webhooks	Built-in with HMAC signing + retries	Webhooks for events on collections + auth
CLI	50+ commands (projects, DB, storage, vault, functions, migrations, cron, webhooks)	CLI available
MCP server (AI IDEs)	First-class — Claude Code, Cursor, Windsurf, Codex	Community MCP servers
Audit logging	Built-in — every admin action with actor, IP, timestamp, tamper-evident hash chain	Activity logs (not hash-chained by default)
DSAR / Article 15 export	One click — per-user or full-project zip, signed URL expires in 7 days	DIY: read documents by permission + zip yourself
DPA / Article 30 record	Auto-generated from actual sub-processor registry	DPA on request; RoPA generation left to the customer
Migration from Appwrite	DIY today: script the Appwrite REST API → eb.db.insert(). CLI subcommand ships when a substantial Appwrite migration is requested.	—

EU-run BaaS on EU-owned infrastructure

▸Eurobase infrastructure is 100 % EU-owned: Scaleway, France (fr-par). No AWS, no GCP, no Azure — not for the DB, not for storage, not for functions.
▸Appwrite Cloud EU region is on AWS eu-central-1 (Frankfurt). Appwrite Code Ltd is headquartered in Tel Aviv, Israel — an adequacy-decision country under EU law, so Israel-side data transfers are covered — but AWS as the underlying infrastructure is a US corporation subject to the CLOUD Act. Physical residency does not neutralise jurisdictional reach through the AWS parent.
▸Eurobase has zero CLOUD Act exposure. Corporate parent is an Estonian OÜ; every processor in the RoPA is EU-headquartered.
▸DPA, RoPA, DSAR export, and audit log are built into every project on every tier. Not paywalled — a legal obligation should not sit behind a $99/mo SKU.

Appwrite vs Eurobase — FAQ

Where is Appwrite headquartered?

Appwrite Code Ltd is headquartered in Tel Aviv, Israel. Israel has an EU adequacy decision (Commission Decision 2011/61/EU, renewed 2024), so data transfers from the EU to Israel are covered by adequacy rather than requiring Standard Contractual Clauses. The separate question is the infrastructure layer: Appwrite Cloud runs on AWS, and AWS is a Delaware corporation subject to the CLOUD Act. For regulated buyers doing a DPIA, the specific thing to name is the AWS layer.

Where does Appwrite Cloud host my data?

Appwrite Cloud offers a Frankfurt region on AWS eu-central-1. Physically your data sits in Frankfurt. Jurisdictionally the operator of the underlying infrastructure is Amazon Web Services, Inc. (Delaware corporation), which is subject to the CLOUD Act. Eurobase runs the equivalent surface (auth, database, storage, realtime, functions) on Scaleway (France) — an EU-owned operator with no US parent in the chain.

Is there a Postgres-based alternative to Appwrite?

Yes — Eurobase is a Postgres-first BaaS with auth, storage, realtime, edge functions, vault, cron, webhooks, and a CLI. The trade-off vs Appwrite is the data model: PostgreSQL tables and SQL instead of collections and attributes. That is a substantive migration when you have deeply nested documents; it is a straightforward one when your entities are naturally relational. If joins across entities, aggregations, or the Postgres analytics ecosystem (Metabase, dbt, Grafana) matter for your app, Eurobase fits.

Can I self-host Eurobase like I can self-host Appwrite?

The source is public on GitHub (github.com/STGime/euroback). SDK + MCP server are MIT; the platform backend, console, migrations, and deploy manifests are BUSL-1.1 with an Additional Use Grant that permits self-hosting for your own apps and internal tools (the grant excludes offering it as a competing managed BaaS). Each backend commit auto-converts to Apache 2.0 four years after it lands. What we do not have yet is a supported self-host distribution — no packaged installer, no reference Terraform, no upgrade tooling — because most of the sovereignty and compliance guarantees (audit-log hash chaining, sub-processor registry, DSAR pipeline, per-tenant KMS key management) are operator-side properties that need operator-side runtime to deliver. If a supported self-host is a hard requirement today, self-hosted Appwrite on Scaleway or Hetzner is a legitimate answer — you own the operational burden, in exchange for a supported self-host path.

Does Eurobase have Flutter or React Native SDKs like Appwrite?

Not first-party today — JavaScript/TypeScript is the primary Eurobase SDK. Flutter and React Native apps use Eurobase via the REST endpoints and, for direct Postgres access on Team/Legal Team, via any Postgres client library. Appwrite has invested heavily in Flutter and native-mobile SDKs, and if that developer experience is the top decision factor, that is a legitimate reason to prefer Appwrite. If SQL and EU-owned infrastructure are the top factors, Eurobase is the correct trade-off.

Can I migrate from Appwrite to Eurobase?

Not with a one-command CLI today. The path is: write a small script against the Appwrite REST API to read documents from your collections, map them to Postgres tables, and use eb.db.from(table).insert() to load them. Because collections and tables are not one-to-one (documents can be arbitrarily nested; tables have fixed columns), part of the migration is a schema design pass. If a Team-tier customer wants to migrate substantial Appwrite data at scale, we build the CLI subcommand — the pattern is already there in the eurobase import supabase implementation.

Where does Eurobase host my data?

Scaleway fr-par (Paris, France) for everything in the critical path: managed PostgreSQL, S3-compatible object storage, and Deno edge functions. No AWS, no GCP, no Azure. Sub-processors outside the critical path — GatewayAPI (Denmark) for SMS, Mollie (Netherlands) for paid billing — are also EU-headquartered. The live sub-processor list is available in every project as a downloadable Article 30 RoPA report.

Postgres, EU-owned, and no AWS in the chain

A Supabase-shaped surface on an Appwrite-adjacent scope, without the AWS dependency and with GDPR primitives built into every tier. Free tier, no credit card. Pro is €25/mo per project when you go live.

Get Started Free Talk to the Founders