Backend platforms

With a BaaS the app talks to the platform directly: the SDK signs the user in, reads and writes data and uploads files, and the platform enforces who may do what through security rules or database policies. Logic that must stay secret, such as charging a card with a private key, runs in the platform's serverless functions.

Firebase popularised the idea for mobile apps; Supabase, Appwrite and PocketBase are open-source alternatives. The appeal is speed and no servers to maintain. The costs are lock-in to the platform's APIs, bills that follow usage, and security that depends entirely on writing the rules correctly, because every client holds a public key.

Each Supabase project is a full PostgreSQL database with services around it: Auth for sign-in, Storage for files, Realtime for live updates, Edge Functions for server code, and an automatic REST API through PostgREST (plus GraphQL). Client libraries for JavaScript, Flutter, Swift, Kotlin and Python call these directly, and a dashboard, a CLI and a local stack handle migrations and development.

Because apps query tables with a public key, row level security policies are what keep data private: a table without them is open to anyone. Being plain Postgres brings SQL, extensions such as pgvector and pg_cron, and a realistic exit, since the database can be dumped and moved anywhere. The whole stack can be self-hosted, although most teams use the hosted service.

Firebase started as a realtime database startup and was bought by Google in 2014. Today it combines Cloud Firestore and the older Realtime Database, Authentication, Cloud Storage, Cloud Functions (Node.js or Python), Hosting and App Hosting, Cloud Messaging for push notifications, plus Crashlytics, Analytics, Remote Config and App Check. SQL Connect (formerly Data Connect) adds a managed PostgreSQL option.

Apps use the Firebase SDKs directly, and security rules decide who may read or write each document or file. Its strengths are mobile SDKs with offline support and instant updates. The costs are proprietary APIs that are hard to leave, per-operation billing that grows with reads, and some services (Cloud Functions, Cloud Storage) that need the pay-as-you-go Blaze plan.

Appwrite puts the usual backend pieces behind one API, with SDKs for web, Flutter, Android, Apple platforms and React Native: Auth (email, phone, magic links, OAuth and teams), Databases with permissions on tables and rows, Storage with image resizing, Functions in many languages (Node.js, Python, PHP, Dart, Go and more), Messaging for email, SMS and push, Realtime subscriptions, and Sites for hosting frontends.

The self-hosted version runs as a set of Docker containers on any server, and Appwrite Cloud is the managed service from the same company, which has added native PostgreSQL and MySQL databases. Unlike Supabase, its default database sits behind Appwrite's own API rather than open SQL, which is simpler for beginners and less flexible for complex queries.

PocketBase is a single Go executable with SQLite built in. Run ./pocketbase serve and you have a REST-style API, a web dashboard for managing collections and records, user sign-in (password, one-time codes, OAuth and MFA), file uploads to disk or S3-compatible storage, and realtime subscriptions over Server-Sent Events. JavaScript and Dart SDKs talk to it.

It can be extended with JavaScript hooks or used as a Go framework, and schema changes are saved as migration files. Everything lives on one server, which keeps it cheap and simple but limits growth to the size of that machine. It has not reached version 1.0 yet, so upgrades can require manual migration steps.

Realtime offers three features over one WebSocket connection. Broadcast sends low-latency messages between clients, such as chat or cursor positions. Presence tracks who is online in a channel. Postgres Changes listens for inserts, updates and deletes in chosen tables and pushes them to subscribers, checking row level security for each one.

It is an Elixir server that reads database changes through Postgres logical replication. For busy apps Supabase recommends Broadcast, sent from database triggers, over Postgres Changes, because it scales better and gives finer control over who receives what. Usage counts towards each plan's quota of concurrent connections and messages.

Each function is a TypeScript file that handles an HTTP request, deployed with the Supabase CLI and run close to users on a global network. Functions run on Deno, can import npm packages, read secrets from environment variables, and receive the caller's sign-in token so they can act on the user's behalf. Common jobs are webhooks, payments, sending email and calling AI APIs.

They are meant for short tasks: each request gets up to two seconds of CPU time (waiting on the network does not count) and 256 MB of memory, and a worker lives for at most 150 seconds on the Free plan or 400 seconds on paid plans. Outgoing SMTP ports are blocked, so email goes through an HTTP API such as Resend. Long jobs belong in a queue or another service.

Neon runs standard Postgres on top of its own storage layer. Compute scales up with load and down to zero when nobody is querying, then wakes on the next query after a short delay. Because storage is copy-on-write, a branch (a full, writable copy of the database) takes seconds and little extra space, which suits preview deployments, tests and experiments.

It includes connection pooling and a serverless driver that queries over HTTP or WebSockets from edge functions. Neon joined Databricks in 2025, and its technology also powers Databricks' Lakebase. It has started adding backend pieces around the database, such as managed authentication (Better Auth) and object storage, but it is still mainly a database rather than a full BaaS.

Turso is a rewrite of SQLite in Rust that keeps SQLite's file format and SQL and adds concurrent writes, vector and full-text search, encryption and sync. It can run inside an app as a local file, as a remote database in Turso Cloud, or both: with Turso Sync, reads and writes hit the local copy and changes are pushed to and pulled from the cloud, which suits offline-first apps.

Because each database is little more than a file, creating thousands is cheap, which suits a separate database per customer or per AI agent. Turso Cloud adds branching, point-in-time restore and scale to zero for idle databases. The team's older libSQL client, based on its earlier fork of SQLite, still has the widest ORM support (Drizzle, Prisma), and the new engine is far younger than SQLite itself.

PlanetScale began as a hosted version of Vitess, the system YouTube built to spread MySQL across many machines (sharding). Its signature workflow treats schema changes like code: branch the database, change the branch, open a deploy request, and PlanetScale applies the change in production without locking tables or taking the site down.

In 2025 it added PlanetScale Postgres, and it offers Neki for sharded Postgres and Metal clusters on fast local NVMe drives. It dropped its free plan in 2024 and is aimed at production workloads rather than hobby projects, although single-node Postgres databases now start at a few dollars a month.

Atlas handles what running MongoDB yourself involves: replica sets for failover, backups, upgrades, monitoring, and sharding when data grows. You pick a cloud and region, choose a cluster size and connect with the standard MongoDB drivers. Clusters can span several regions or even several clouds.

On top of the database it adds Atlas Search (full-text search built on Apache Lucene), Vector Search for AI features, triggers, charts and archiving to cheaper storage. Tiers run from a free 512 MB cluster for learning, through Flex clusters billed by usage, to dedicated clusters for production, which is where most of the cost sits.

Upstash Redis accepts Redis commands and also answers over a REST API, so code on Cloudflare Workers, Vercel's edge runtime or other serverless platforms can use it without holding a connection open. It is commonly used for caching, sessions and rate limiting, and the @upstash/ratelimit library does the counting.

QStash delivers HTTP messages to your endpoints later or on a schedule, with retries, which gives serverless apps queues and cron without a worker server. Upstash Vector stores embeddings for AI search, and Workflow builds durable multi-step jobs on top of QStash. Pay-as-you-go pricing suits small or spiky traffic; at steady high volume, fixed plans or a self-run Redis can cost less.