Where Supabase stands in Southeast Asia, which buyers need in-country hosting, how I would build the territory, and a deal desk that runs the first call: latency, residency rules, cost and discovery.
Developers and AI app builders across the region already start on Supabase. Most of the ASEAN book will grow from usage.
Enterprise and public-sector buyers in Indonesia, Vietnam and parts of Malaysia must host in-country. Supabase's only ASEAN region is Singapore.
Three motions: expand usage-triggered accounts, replace Firebase and hand-built RDS stacks, and run a few regulated deals with AWS co-sell and a clear residency answer.
| Takeaway | Why it matters for selling |
|---|---|
| Most ASEAN buyers can use Singapore | No general privacy law in the region bans hosting in Singapore. Singapore, Malaysia, Thailand, the Philippines and Indonesian private companies transfer with paperwork: a DPA, a transfer basis and the SOC 2 report. |
| A few buyers cannot | Indonesian government bodies (PP 71/2019), Indonesian banks without OJK approval, Vietnamese domestic firms and Malaysian official-secret data need in-country hosting. Qualify early and offer self-hosting or Bring Your Own Cloud. |
| For banks the gate is process | BNM wants consultation before first critical public cloud use and approval for material outsourcing; MAS wants audit and access rights. Contract terms matter more than location. |
| AWS is the channel | Supabase sells on AWS Marketplace, and Marketplace spend counts toward AWS commitments. In a region with no resellers yet, AWS account teams are the fastest route into enterprises. |
A Singapore-born company with its main contracting entity in Singapore, and a thin regional footprint so far.
| Area | What is public | Sales read |
|---|---|---|
| Entity | Supabase Pte. Ltd. (Singapore) contracts every purchase except AWS Marketplace; Asia disputes go to ICC arbitration seated in Singapore. | A local counterparty and local seat help procurement in the region. |
| Hosting | 17 AWS regions; in ASEAN only Singapore (ap-southeast-1). Bring Your Own Cloud is early access, regions not stated. | Latency is fine for most of the region; residency is the open question. |
| Buying | Free, Pro from $25 a month, Team from $599, Enterprise custom. Pro and Team on AWS Marketplace; Enterprise by private offer. | Self-serve covers small teams; the AE adds value at Team, Enterprise and AWS commits. |
| Trust | SOC 2 Type 2 and ISO 27001 reports from Team; HIPAA add-on; AWS PrivateLink on Team and Enterprise. | The first documents a bank or insurer will ask for. |
| Customers | Xendit (Jakarta) and Mobbin (Singapore) have customer stories; no published story from Malaysia, Thailand, Vietnam or the Philippines. | A first Malaysian and a second Indonesian reference are worth more than any slide. |
| Momentum | Series F of $500M (June 2026) and $150M more (October 2026), both led by GIC; Turso acquired; 70% of new databases created by agents or AI tools. | AI builders are the region's fastest-growing buyer group. |
Developer platforms are mostly Singapore-only like Supabase. The in-country competition comes from hyperscalers selling a database without the platform around it.
| Vendor | ASEAN hosting | Their gap | Where Supabase wins |
|---|---|---|---|
| Firebase | Firestore in Singapore, Jakarta, Bangkok; Auth runs from US data centres | Document database, bill grows with every read, not self-hostable | SQL and joins, row level security, cost tied to instance size, open source |
| AWS RDS and Aurora | Singapore, Jakarta, Malaysia, Thailand | Database only; auth, storage, APIs and realtime are left to the team | The platform on top of Postgres, bought on the same AWS bill |
| Neon (Databricks) | Singapore | Adding auth and storage, but newer to them | Mature integrated platform, community size |
| PlanetScale Postgres | Singapore; others on request | Database only, no free tier | Platform and free start |
| Appwrite, Nhost | Singapore | Smaller ecosystems; Appwrite has no direct SQL | Postgres depth and AI builder integrations |
| Convex | None in ASEAN (nearest Sydney) | Proprietary document database | Latency and open Postgres |
| Azure, Google Cloud SQL | Azure in Indonesia and Malaysia; Google in Jakarta and Bangkok, Malaysia announced | Database only | Developer experience and speed to ship |
| Alibaba, Huawei, Tencent | Widest in-country footprint (KL, Johor, Jakarta, Manila, Bangkok); Tencent CloudBase opened Singapore in July 2026 | Closed platforms; China-first tooling | Open source, portability, global community |
The JD asks the AE to handle data residency with enterprise and public-sector buyers. This is the map I would carry into those calls. Laws summarised for a first conversation; the buyer's counsel decides.
| Country | Buyer | Rule | In-country? | Path |
|---|---|---|---|---|
| Singapore | Private companies | PDPA s26 transfer limitation; Supabase Singapore is in-country | no | Standard DPA |
| Singapore | Banks | MAS outsourcing guidelines: audit and access rights, outsourcing register | no | Contract terms, SOC 2 |
| Malaysia | Private companies | PDPA s129 (2025): substantially similar law or adequate protection; transfer impact assessment | no | TIA template, DPA |
| Malaysia | Banks, insurers, e-money | BNM RMiT 17.1 consultation before first critical public cloud; written approval for material outsourcing | process | BNM pack, AWS private offer |
| Malaysia | Federal agencies | Cloud Framework Agreement panel to June 2027; official-secret data decided case by case | case by case | Panel reseller route |
| Indonesia | Private companies | PP 71/2019 Art 21 allows storage abroad with access for authorities; PDP Law transfer rules from January 2027 | no | Transfer basis, DPA |
| Indonesia | Government bodies | PP 71/2019 Art 20: store and process in Indonesia | yes | Self-host in AWS Jakarta, or wait |
| Indonesia | Banks | OJK POJK 11/2022: data centre in Indonesia unless OJK approves | yes | Non-core workloads first |
| Vietnam | Domestic firms | Decree 53 and the 2026 Cybersecurity Law keep localisation; PDP Law 2026 filing for transfers | yes | Qualify carefully |
| Thailand | Private companies | PDPA s29 safeguards: ASEAN Model Contractual Clauses or approved BCRs | no | ASEAN MCCs |
| Philippines | Private companies | Data Privacy Act s21: controller stays accountable; no location rule | no | DPA, breach terms |
Indonesian bank, Vietnam and Thailand rows rest on law-firm summaries where the official text could not be fetched; all others on official sources. Sources in §08 and per line in the demo.
That covers most buyer types in the map. Lead with latency, measured from the buyer's own office in the demo, and the trust documents.
Self-hosted Supabase in AWS Jakarta, Malaysia or Thailand, or Bring Your Own Cloud when its regions are confirmed. Start with workloads outside the rule.
Log every deal lost or paused on residency with country, sector and ARR. That list is the business case for the next region.
| Segment | Why they buy | Motion | Proof to show |
|---|---|---|---|
| AI app and agent startups | Already on Supabase through AI builders; need pgvector, auth and scale | Usage-triggered expansion to Team and annual commits | MCP server, Vector, branching |
| Payments and fintech | Postgres, audit trails, fast shipping | Team to Enterprise with SOC 2, PrivateLink and AWS private offers | Xendit story |
| E-commerce and consumer apps | Firebase bills that grow with reads; need SQL for reporting | Migration offer: one service first, then the rest | Cost model on their real read counts |
| Regulated enterprise | Innovation teams need speed inside risk rules | AWS co-sell, regulator pack, proof of concept with success criteria | Trust documents, residency answer |
| Public sector | Citizen portals, internal tools | Through panels and resellers; qualify hard | Self-host option, partner |
| JD duty | How I would do it | Detailed in |
|---|---|---|
| Own the full sales cycle, including multi-threaded enterprise deals | Champion, economic buyer, security and legal mapped per deal in HubSpot from the first call; a written mutual plan with a decision date before any proof of concept. | §05, demo |
| Technical discovery tied to business outcomes | Three questions per current stack, then their real numbers in the cost model: reads, instance size, engineers spent on auth and storage. | demo |
| Demos, proofs of concept, architecture reviews with SEs and Product | Run the first demo myself; bring a Solutions Architect for a scoped proof of concept on one service with agreed success criteria. | §06 |
| Show where Supabase fits and what it replaces | Per stack: Firebase (database, auth, storage), RDS (the layers around Postgres), self-hosted Postgres (the ops), plus the official migration guides. | §02, demo |
| Territory plan: pipeline, forecasting, account strategy | Country sequence, three motions, weekly pipeline review, forecast by stage with written exit criteria. | §05 |
| AWS and regional partners and resellers | Map AWS ASEAN account teams by vertical; private offers against EDP commits; recruit one SI each in Jakarta and KL with the partnerships team. | §06 |
| Data residency, security, procurement with enterprise and public sector | The residency map above, a standard pack per country (DPA, transfer basis, SOC 2, breach terms), and early qualification of hard in-country cases. | ★ |
| Hand-off to Customer Success | Written handover: use case, success criteria, stakeholders, risks, expansion path; joint call with the TAM before go-live. | §07 |
Sequence by where Singapore hosting works and where developers already are. Calibrate with the real book in week one.
| Market | Wave | Focus | Entry route |
|---|---|---|---|
| Singapore | 1 | AI startups, fintech, regional HQs buying for the region | Usage triggers, founders, AWS Singapore teams |
| Indonesia | 1 | Payments and fintech outside bank rules, consumer apps on Firebase | Xendit-style references, AWS Jakarta teams |
| Malaysia | 2 | Digital banks' innovation teams, e-commerce, GLC digital units | BNM pack, AWS Malaysia launch momentum |
| Vietnam | 2 | Software exporters and startups selling abroad | Partners; qualify domestic data carefully |
| Thailand, Philippines | 3 | Consumer apps, BPO-built products | AWS and partners first |
| Pipeline source | How it works | Measure weekly |
|---|---|---|
| Usage triggers | Accounts hitting compute, disk or MAU limits get a usage review and a right-sized plan | Response rate, uplift against non-responders |
| Stack replacement | Firebase and RDS teams found through job ads, community and AWS | Proofs of concept started and won |
| AWS co-sell | Shared opportunities with AWS account teams; private offers | Opportunities shared, Marketplace deals |
| Community and partners | Meetups in KL and Jakarta (only Singapore has had one), SI recruiting | Sourced pipeline by channel |
ASEAN accounts already on Pro and Team are the fastest revenue. Offer a usage review with a right-sized instance and an annual commit.
Read-heavy consumer apps pay per read. Show the bill on their own numbers and migrate one service first.
With no ASEAN resellers yet, AWS account teams in Singapore, Jakarta and Malaysia are the route to enterprises; Marketplace private offers burn down their commits.
One page per country with the rule, the transfer paperwork and the self-host or BYOC path, so legal teams say yes faster.
There is no published Malaysian customer story. One credible local reference unlocks the next ten conversations.
Run the first Supabase meetups in KL and Jakarta with local AI builder communities; developer love turns into pipeline.
Built from the public job posting (2026), Supabase's pricing, regions, compute, AWS Marketplace and customer pages, AWS region launch posts, Firestore pricing, and the regulators' own texts where reachable, all read on 10 November 2026. Company figures are labelled as such. The deal desk is my own tool built for this application; it uses list prices and public endpoints, and its sample prospects are invented.
Supabase: pricing · regions · compute · BYOC early access
Buying: AWS Marketplace · terms · SOC 2
Customers: Xendit · Mobbin · all stories
Funding: Series F · Turso · $150M round
AWS regions: Jakarta · Malaysia · Thailand
Singapore: PDPC key concepts · MAS outsourcing
Malaysia: cross-border guideline · BNM RMiT · MyGovCloud CFA
Indonesia: PP 71/2019 · POJK 11/2022 summary
Vietnam, Thailand, Philippines: Vietnam cybersecurity law · Thailand BCRs · RA 10173
Competitors: Firestore locations · Neon · PlanetScale · Convex
Independent homework for the Supabase Account Executive (ASEAN) role · 2026 · edwardtay.com