Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (12)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| Supabase Postgres ↗ | 10.0 | 9.9 |
| Amazon S3 ↗ | 9.3* | 5.6* |
| GitHub ↗ | 7.6* | 5.6* |
| GitLab ↗ | 7.6* | 5.6* |
| Linear ↗ | 7.6* | 5.7* |
| Stripe ↗ | 8.3 | 6.3 |
| Paddle ↗ | 4.7* | 3.8* |
| Chargebee ↗ | 4.7* | 3.6* |
| Amplitude ↗ | 7.6* | 4.4* |
| Mixpanel ↗ | 7.6* | 3.9* |
| Intercom ↗ | 6.9* | 5.6* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
Supabase Postgres
Databases and data platforms · Checked 2026-10-12
Supabase hosted Postgres / customer SQL connections, APIs and logical exports. Self-hosting is an exit destination; hosted backup products have separate prices. Customer-operated logical replication is assessed separately from browser Realtime and managed alpha pipelines.
Read findings and sources ↗Amazon S3
Object storage · Checked 2026-10-12
Amazon S3 general-purpose buckets / customer IAM grants, object APIs and notifications. Archive classes and directory buckets have different behavior and charges.
Read findings and sources ↗| Customer control | Supabase Postgres ↗ | Amazon S3 ↗ | GitHub ↗ | GitLab ↗ | Linear ↗ | Stripe ↗ | Paddle ↗ | Chargebee ↗ | Amplitude ↗ | Mixpanel ↗ | Intercom ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Category | Databases and data platforms | Object storage | Developer tools | Developer tools | Work management | Payments | Billing | Billing | Product, web and search analytics | Product, web and search analytics | Support and service management | Databases and data platforms |
| Overall control | ||||||||||||
| Data access | ||||||||||||
| Third-party accessibility | ||||||||||||
| External action | ||||||||||||
| Continuity | ||||||||||||
| Data exit | ||||||||||||
| Business logic and customization | ||||||||||||
| Assessment scope | Supabase hosted Postgres / customer SQL connections, APIs and logical exports. Self-hosting is an exit destination; hosted backup products have separate prices. Customer-operated logical replication is assessed separately from browser Realtime and managed alpha pipelines. | Amazon S3 general-purpose buckets / customer IAM grants, object APIs and notifications. Archive classes and directory buckets have different behavior and charges. | GitHub.com / customer-installed GitHub App, repository issues and issue webhooks; Git repository backups are disclosed separately and do not establish issue-archive completeness. | GitLab.com / user-authorized OAuth, project issue REST operations, work-item webhooks and project file exports; self-managed instance policies and complete repository/platform migration are separate. | Linear / customer-authorized OAuth, GraphQL issues and related team metadata, issue webhooks and CSV issue exports; native workflow ownership and enterprise administration are separate. | Stripe Standard Payments / customer-controlled restricted API key, core API and webhooks. Sigma, Data Pipeline, marketplace distribution and Connect platform rights are separate. | Paddle Billing API v1 / seller API keys, customers, billing events and notifications; Paddle Classic is excluded. | Chargebee Billing API v2 / site-scoped customers and customer lifecycle events; Product Catalog version and business-entity boundaries remain explicit. | Amplitude Analytics / customer project key/secret, raw Export API, HTTP V2 event ingestion and dashboard CSV downloads; Session Replay, cross-project views and separately entitled warehouse delivery are excluded. | Mixpanel / customer project/service-account raw Event Export API and Import Events; reporting, profiles, warehouse pipelines and full project configuration have separate contracts. | Intercom / customer-owned private apps for their own workspace and approved third-party OAuth apps for contacts, conversations and webhooks. Listed and unlisted third-party apps both require provider review; private tokens must not be handed to third parties. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-12 | 2026-10-12 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-12 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Choose startup software that leaves room to change your stack
This collection covers software and SaaS startups from development through billing and customer support. These tools do different jobs (a billing platform and a product analytics system are not alternatives). The comparison concerns documented access and portability; it does not rank programming languages, free-credit offers or total startup cost.
Build and ship
Keep application data, source history and work tracking recoverable. Compare the scoped Supabase and S3 data-exit routes alongside repository and issue APIs; a database restore does not reconstruct every hosted service or permission.
Bill customers
Compare Stripe core payments with the assessed Paddle customer/billing-event and Chargebee customer-lifecycle routes. Verify subscription and invoice coverage separately before planning how to join billing records or reconcile events.
Understand and support customers
Compare event exports and customer-service records separately. An aggregate dashboard, a raw event export and a support conversation preserve different parts of customer history.
What to verify before connecting or migrating
- Can a chosen application reuse production data without a provider-selected integration?
- Which records, files and executable definitions would be needed to rebuild outside the current runtime?
- Will the access route still work when the free tier ends or the customer count grows?
Industry references establish terminology and business context. The linked vendor reviews contain the assessed API, commercial and export evidence (with their own product scopes and check dates).
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
Supabase Postgres ↗
Supabase provides direct Postgres access and a documented restore path to self-hosting. Database portability is strong, but storage objects, auth settings and edge functions require separate migration work.
Supabase hosted Postgres / customer SQL connections, APIs and logical exports. Self-hosting is an exit destination; hosted backup products have separate prices. Customer-operated logical replication is assessed separately from browser Realtime and managed alpha pipelines.
Amazon S3 ↗
Customers control S3 object access through IAM and can download their files. The main exit barriers are data volume, transfer charges, encryption keys and storage-class retrieval conditions.
Amazon S3 general-purpose buckets / customer IAM grants, object APIs and notifications. Archive classes and directory buckets have different behavior and charges.
GitHub ↗
GitHub supports repository-scoped apps and structured issue APIs. Webhook redelivery helps repair recent failures, but repository mirroring does not preserve the complete hosted collaboration state.
GitHub.com / customer-installed GitHub App, repository issues and issue webhooks; Git repository backups are disclosed separately and do not establish issue-archive completeness.
GitLab ↗
GitLab supports issue APIs and project exports with explicit omissions. GitLab.com limits differ from self-managed controls, and issue/work-item event coverage must match the current API version.
GitLab.com / user-authorized OAuth, project issue REST operations, work-item webhooks and project file exports; self-managed instance policies and complete repository/platform migration are separate.
Linear ↗
Linear provides a public GraphQL API with direct issue mutations and change payloads. Archived issues require explicit inclusion, and API budgets depend on authentication type and query complexity.
Linear / customer-authorized OAuth, GraphQL issues and related team metadata, issue webhooks and CSV issue exports; native workflow ownership and enterprise administration are separate.
Stripe ↗
Restricted keys give customers direct control of core API access. Request quotas, search freshness and the permissions of paid data products still constrain extraction.
Stripe Standard Payments / customer-controlled restricted API key, core API and webhooks. Sigma, Data Pipeline, marketplace distribution and Connect platform rights are separate.
Paddle ↗
Paddle Billing exposes structured customers and a 90-day event stream. That window supports bounded gap recovery, while API credentials and event delivery do not establish complete service migration rights.
Paddle Billing API v1 / seller API keys, customers, billing events and notifications; Paddle Classic is excluded.
Chargebee ↗
Chargebee supports customer lists, customer creation and lifecycle events. Event IDs and resource versions help reconcile duplicates and ordering, while contractual reuse and complete replay retention remain unresolved.
Chargebee Billing API v2 / site-scoped customers and customer lifecycle events; Product Catalog version and business-entity boundaries remain explicit.
Amplitude ↗
Amplitude exports project event records by upload hour, which differs from event time. Consumers must allow for export delay, validate complete archives and avoid treating a request-size window as a data-retention promise.
Amplitude Analytics / customer project key/secret, raw Export API, HTTP V2 event ingestion and dashboard CSV downloads; Session Replay, cross-project views and separately entitled warehouse delivery are excluded.
Mixpanel ↗
Mixpanel exports raw event JSON and permits event ingestion through separate endpoints. Date-window extraction is not a provider change log, so late arrivals and privacy deletions need a defined reconciliation policy.
Mixpanel / customer project/service-account raw Event Export API and Import Events; reporting, profiles, warehouse pipelines and full project configuration have separate contracts.
Intercom ↗
Intercom exposes searchable contacts and conversations through private workspace apps and reviewed third-party OAuth apps. Both listed and unlisted third-party apps require approval, and webhook retry is bounded.
Intercom / customer-owned private apps for their own workspace and approved third-party OAuth apps for contacts, conversations and webhooks. Listed and unlisted third-party apps both require provider review; private tokens must not be handed to third parties.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.