{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-13T23:52:59.204Z",
  "record_id": "VXI-EXT-PROCUREMENT-SUPABASE-BACKUP-01-v1",
  "record_kind": "external_reference",
  "title": "Supabase backup evidence: Database recovery and stored files",
  "system": "Supabase",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a Supabase database backup also recover the uploaded files used by my application?",
  "near_questions": [
    "Are Supabase Storage objects inside database backups?",
    "Can restoring Supabase metadata recover a deleted uploaded file?",
    "What does a Supabase database backup prove about whole-app recovery?",
    "Which Supabase backup configuration was actually enabled?",
    "What recovery point is available for the Supabase project?",
    "Do custom-role credentials need separate attention after a restore?",
    "What should a Supabase recovery test include besides tables?",
    "Can an agent claim backups are complete without checking file storage?",
    "What evidence supports a Supabase attachment-recovery claim?",
    "Does plan entitlement prove a backup was successfully captured?",
    "What should be saved for a Supabase recovery review?",
    "When do new app dependencies require a Supabase backup review?"
  ],
  "supported_claims": [
    {
      "claim": "Supabase documents that database backups contain Storage metadata, not the stored object contents. Restoring a database backup does not recover objects deleted afterwards. A whole-application recovery claim needs separate evidence for files and other dependencies, together with the actual backup configuration and a suitable restore check.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Supabase documents that database backups contain Storage metadata, not the stored object contents. Restoring a database backup does not recover objects deleted afterwards. A whole-application recovery claim needs separate evidence for files and other dependencies, together with the actual backup configuration and a suitable restore check.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-NOTION-AI-01-v1",
    "VXI-EXT-PROCUREMENT-FIGMA-TRAINING-01-v1",
    "VXI-EXT-PROCUREMENT-ATLASSIAN-RESIDENCY-01-v1",
    "VXI-EXT-PROCUREMENT-LINEAR-SCIM-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Supabase database backup coverage",
    "source_url": "https://supabase.com/docs/guides/platform/backups",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-SUPABASE-BACKUP-01-v1",
    "candidate_record_sha256": "cb7ceb1e71beac884ee064e54ce66f3ac5f43e93ad22c3bd4e95e3c795eff0d7",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Supabase documents that database backups contain Storage metadata, not the stored object contents. Restoring a database backup does not recover objects deleted afterwards. A whole-application recovery claim needs separate evidence for files and other dependencies, together with the actual backup configuration and a suitable restore check.",
    "required_buyer_context": "Project plan and database version, backup method, storage-object recovery approach and required recovery point.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "A database backup alone establishes complete recovery of our Supabase application.",
    "documented_statement": {
      "status": "documented",
      "statement": "Supabase documents that database backups contain Storage metadata, not the stored object contents. Restoring a database backup does not recover objects deleted afterwards. A whole-application recovery claim needs separate evidence for files and other dependencies, together with the actual backup configuration and a suitable restore check.",
      "source_ids": [
        "supabase-backup"
      ]
    },
    "buyer_evidence_required": [
      "The backup configuration and a dated available recovery point",
      "Separate retention and recovery evidence for stored objects",
      "A restore review covering the dependencies the application needs"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Do not approve a whole-application recovery claim when only database backup evidence is available."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "supabase-backup",
        "url": "https://supabase.com/docs/guides/platform/backups",
        "final_url": "https://supabase.com/docs/guides/platform/backups",
        "title": "Supabase database backup coverage",
        "checked_on": "2026-10-14",
        "sha256": "3afeef9b471f0982c1c3b9004221f53a54c729d5b1aa9949ae913b40e244a984",
        "bytes": 219866
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Retain the distinction between database restoration and attachment recovery during supplier review.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck backup mode, Storage handling, role credentials and application dependencies."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#supabase-backup-object-coverage-check",
  "machine_readable_record": "/varexis-index/records/supabase-backup-object-coverage-check.json"
}