Open-source backend · MIT · Any PostgresREST, a typed SDK, realtime, auth and storage for your app; spreadsheets, media, relations and roles for your team. Our own CRM is twenty-three collections and not one hand-written screen.
From the makers of FireCMS, the open-source CMS in 10,000+ projects.
01·How it works
Schema, REST API, typed SDK, edit forms and every panel view come out of it, and move when it moves. There is no second data model to keep in sync and no CRUD screen to go and maintain when a field changes name.
import type { PostgresCollectionConfig } from "@rebasepro/types"; export const products: PostgresCollectionConfig = { name: "Products", slug: "products", table: "products", properties: { name: { name: "Name", type: "string", validation: { required: true }, }, category: { name: "Category", type: "string", enum: { electronics: "Electronics", fashion: "Fashion", home: "Home & Garden", }, }, price: { name: "Price", type: "number" }, in_stock: { name: "In Stock", type: "boolean" }, image_url: { name: "Image", type: "string", url: true }, }, };
→ generates DB schema · REST API · Typed SDK · entity forms · admin views
02·What you get
A typed SDK for your collections, REST over every table and realtime on a WebSocket, running against your database from minute one.
Plus auth and roles, S3-compatible storage, scheduled jobs, serverless functions and backups. None of it is a separate service to sign up for and wire together.
Explore the backendSpreadsheet editing, media, relations, roles and workflows — an admin panel you can hand a non-developer on their first day. It is a client of your API like any other, so whatever it can see, your policies said so.
What your app talks to
The server your app calls: REST, a typed SDK, realtime, auth and storage over your own Postgres.
@rebasepro/server
Where your team works
Spreadsheet editing, media, relations, roles and workflows — with your own React components dropped in wherever the default field isn't enough.
@rebasepro/cms
The developer half of the panel
SQL editor, schema visualizer, RLS policy editor, logs and API explorer. Studio is the developer half of the same panel your team already uses.
@rebasepro/app
03·Security-first
Your access rules compile into real Postgres policies — granular per collection, per field, per role. The database holds them on every path into it: your routes, your nightly job, the backfill script someone ran once, the agent holding a key. Not middleware someone has to remember to call.
securityRules: [
{ operation: "select", using: "owner_id = rebase.uid()" },
{ operation: "update", using: "owner_id = rebase.uid()" },
]
-- compiled into Postgres; enforced on every statement, for every caller
CREATE POLICY orders_select ON orders FOR SELECT USING (owner_id = rebase.uid());
-- a table with no policy is not served at allrls-check reads your database's own catalogue and reports what is actually exposed — tables served with row-level security switched off, policies that evaluate to true for everyone, views that read straight past the RLS on their base tables. Fifteen checks. Any Postgres: Supabase, Neon, RDS, your own server. It is read-only, it needs no account, and it does not care whether you use Rebase.
npx @rebasepro/rls-checkSELECTs against the system catalogues and nothing else. No telemetry, no upload, and it never reads your data.
04·Built for the agent era
An AI agent can scaffold a backend in an hour. It can't tell you whether that backend is safe. Agents are extremely good at producing plausible backends — and famously bad at producing secure ones. Rebase makes the safe outcome the only outcome, by construction.
Explore AI and agent featuresNo controllers, no serializers, no migrations to hand-write, and nothing for a model to invent between the schema and the route. The whole contract fits in one context window, and the compiler checks whatever it writes back.
05·Built for real products
A certified medical device, a retail loyalty programme, a two-sided marketplace, public data, an outbound sales agent, a design tool and a CRM — some of them ours, some of them our customers'.
Digital Pain Therapy
A certified digital medical device delivering AI-personalized pain therapy. Rebase runs the entire backend — patient records, therapy plans, the exercise content library, and the clinical dashboards on top of them.
medicalmotion.com
Retail loyalty
The loyalty programme behind an apparel brand. Orders from Odoo POS and Shopify land in Postgres, a tier engine recomputes points and discounts, and the Apple and Google Wallet passes customers scan at the till are issued from the same schema.
unfeignedgear.com
Marketplace & Job Portal
A two-sided marketplace connecting sustainability professionals with green companies. Rebase powers both sides of the market: role-based auth, typed matching APIs, and the moderation back office.
sustentalent.com
Vector Design Tool · Built by the Rebase team
Our own product: a fast, in-browser vector editor with cloud sync. Dadaki runs on a completely standard Rebase backend — the same auth, storage, and generated APIs every project gets.
dadaki.com
Public data · Built by the Rebase team
A public reading of Spanish government spending, from €725bn down to a single budget line. There is no database in the read path: a cron recompiles the official figures each month, storage serves them as JSON, and the page itself makes zero API calls.
presupuestos.rebase.website
AI sales agent · Built by the Rebase team
An outbound agent that reads your site, plans audiences, then finds real companies and the people at them — each one verified against its own website. Crons, functions and the review board are stock Rebase. It drafts; the schema has no state in which it sends.
prospector.rebase.websiteInternal tool · CRM and workflow automation
A CRM the team can rebuild without a deploy: pipelines, tags, tasks and an automation canvas whose triggers, branches and actions are all rows in Postgres. Twenty-three collections generated the entire back office — no admin screens were written.
Internal tool — no public site
01/07
MIT-licensed, end to end. Your data stays in your Postgres: no vendor dependency, no per-seat pricing, and leaving is a redeploy.
One command against the Postgres you already have. No account, no container to pull, nothing to sign up for.
pnpm dlx @rebasepro/cli initDocker, Fly, Railway, Hetzner or bare metal. Your data stays in your infrastructure and never reaches us.
docker compose up -dManaged hosting on our infrastructure. It runs real tenants today and opens in batches.
Request access