If your Supabase database goes nuclear on a Friday afternoon, how long until your customers are back online? If you've never drilled a disaster recovery, the answer is "longer than you think." Here's the uncomfortable truth: most small-business SaaS have backups but no recovery plan. They're not the same thing.
What You Actually Need to Back Up
A small-business stack has four critical components: (1) the database (Supabase Postgres), (2) application code (GitHub repo), (3) environment variables (API keys, Supabase credentials, Stripe secrets), and (4) customer-uploaded files (if any). You don't need a backup for the application itself—if your code is in git and Netlify can rebuild from git, you're covered. But the other three? Non-negotiable.
Supabase Pro: Daily Snapshots Are Your Foundation
Supabase Pro includes daily automated snapshots. Your database is point-in-time recoverable to any moment in the last 7 days. That's your RPO (Recovery Point Objective)—24 hours of data loss, maximum. Spin up a recovery database from a snapshot in the Supabase dashboard in under 30 minutes. Your RTO (Recovery Time Objective) is 4 hours: 30 minutes to recover the DB, 2 hours to validate and flip DNS, 90 minutes buffer.
One production thing: test the recovery quarterly. A snapshot you've never restored is a backup that doesn't exist. Spin up a clone database, run a smoke test, then tear it down.
GitHub: Code Is Self-Healing
Your repo is the immutable source of truth. Keep main deployable at all times. Netlify clones from git, builds, and deploys. If your live site explodes, you've already got every version ever shipped in git history. Rollback is a branch swap.
Netlify Env Vars: Screenshot + Store in a Vault
Export your Netlify environment variables once a quarter. In the dashboard, go to Site Settings → Environment and screenshot each var (except secrets—keep those in 1Password or your password manager). If Netlify ever nukes your site config (rare, but Heroku's gone down), you'll have a record of every key-value pair you need to restore.
Quarterly Disaster Drill
Once every three months, run this playbook: (1) Restore Supabase from the oldest available snapshot, (2) Point a test subdomain at the recovery database, (3) Run a smoke test (login, CRUD a record, check RLS policies), (4) Document the time it took and any surprises, (5) Tear everything down. A 15-minute drill beats a 4-hour firefight.
Six Questions You'll Ask
What if GitHub goes down?
GitHub stores your code on Microsoft infrastructure across multiple data centres. The probability of total data loss is near zero. Even if GitHub went dark tomorrow, you have every build artifact in Netlify's logs. You'd lose only unpushed local changes.
Do I need hourly snapshots?
Only if you can't afford 24 hours of data loss. For most small SaaS, daily is fine. Supabase Business tier offers hourly snapshots for ~$2k/month.
What about customer-uploaded files?
Supabase Storage uses Google Cloud under the hood with built-in redundancy. For critical files, replicate them to S3 or Backblaze via a cron Edge Function quarterly.
Should I back up Stripe?
Stripe is Stripe's responsibility. Your job is to log webhooks and keep a local copy of subscription state in Supabase. You can always re-sync from Stripe's API.
How do I know if my backup actually works?
You don't, until you've tested it. That's why you drill.
What about ransomware?
Supabase snapshots are read-only after creation. An attacker who compromises your database credentials can't delete them. Your 7-day recovery window survives ransomware.
The Bottom Line
A small-business disaster recovery doesn't require enterprise backup hardware or five-figure SaaS contracts. It requires three things: (1) Supabase Pro with snapshots enabled, (2) git-backed code that Netlify can rebuild, (3) quarterly drills to prove it works. Spend 30 minutes once a quarter testing recovery, and you'll sleep better every other night of the year. The businesses that don't? They discover their backup is broken at 3 a.m. on a Sunday.