Sanity vs Supabase: CMS, Backend or Both?

Sanity and Supabase aren't competitors. Sanity is a content management system (CMS): your team uses it to edit the words and images on your website. Supabase is a backend: a Postgres database with sign-in (Auth), file storage and server functions (Edge Functions) for an app, portal or CRM. A marketing website usually needs only Sanity. A customer portal or internal tool needs a backend like Supabase. Many projects use both, Sanity for the public website and Supabase for the private side.

Which one does your project need?

Look at who changes the data. If your staff edit pages, articles and photos that the public sees, you need a CMS like Sanity. If customers or staff sign in and create records, such as bookings, orders, students or payments, you need a backend like Supabase. If you have both kinds of data, you need both, and each one should own its own records so nobody keeps two copies of the same thing.

We usually build on Supabase because it's quick to set up and it's Postgres underneath, so your data isn't tied to one vendor. If a project needs MongoDB, another database or an API your business already runs, we build around that instead.

A project that uses both: A Step Above Medical

A Step Above Medical has a replacement Next.js website with Sanity, where the team edits its courses and locations. Alongside it, an operations portal built on Supabase brings together class rosters, instructor assignments, certificates and payments. The portal runs on the client's own Supabase account. The project is live, as confirmed by the owner on 20 October 2026.

This is the backend package we build most often: the database plus a custom CRM on top, in the same build. The team runs the business from its own admin screens, the same way it edits the website in Sanity.

What do Sanity and Supabase cost?

We build on Supabase's Free plan and move the project to Pro when it goes live, so you don't pay for the database during the build. For client production apps we use Pro, because free projects pause after a week of inactivity and have no included automatic backups. Prices are from Sanity's pricing page and Supabase's pricing page. For the whole monthly bill, including hosting, see what a website costs to run each month.

Signing in isn't the same as permission

Signing someone in tells your app who they are. It doesn't decide which records they can see. In Supabase, that second job belongs to row-level security (RLS): rules on each table, such as "a customer can read only their own bookings". Every table the browser can reach needs those rules, and admin keys stay on the server, never in browser code. See Supabase's row-level security guide.

Test it before launch. Sign in as one customer and try to load another customer's record. Remove a staff member and check they lose access. Send the same payment notification twice and check you get one payment. Also agree who restores the database from a backup if something goes wrong.

Where do Vercel and GitHub fit?

Vercel hosts the website and runs its server code, but it doesn't store your business data; that's the database's job. Vercel's own runtime guidance recommends its Node.js runtime over the Edge runtime for performance and reliability. GitHub holds the code and the history of every change. At handover, you should know who owns each account (code, hosting, CMS and database) and have written steps for releasing a change.

What to ask for in a proposal

• The public pages, the content your team edits, and the private screens.
• Who can see and change each kind of record.
• Tests for publishing, permissions and failed payments or integrations.
• Separate prices for the build, moving your existing data, vendor plans and maintenance.
• Who owns the code, hosting, CMS and database accounts.

Our Sanity service covers the website and its editor. Our backend development service covers databases, portals and custom CRMs. Comparing editors instead? Read Sanity vs WordPress.