Supabase

Postgres with row-level security enabled on every table holding workspace data. Policies scope reads to workspace members.

calendar_connections is the deliberate exception: it has no policy at all, so the anon and authenticated roles cannot read OAuth tokens even by accident. The service role, which only ever runs on the server, is the sole reader.

With no Supabase credentials configured the app reads the demo dataset instead and holds writes in memory for the life of the process, so an unconfigured deployment renders rather than crashes.