BYOK Overview
NearSync offers two deployment models: Managed and BYOK (Bring Your Own Keys). This section covers BYOK - the model where you own and control your entire data infrastructure.
What is BYOK?
In the BYOK model, you provision and own your own Supabase (PostgreSQL) database project. The NearSync application code connects to your database. NearSync never stores your data on NearSync-owned infrastructure.
The same application code powers both Managed and BYOK deployments. The difference is where the database lives:
- Managed: NearSync hosts your data in a shared, multi-tenant Supabase instance. Tenant isolation is enforced via
org_idcolumns and Row-Level Security policies. - BYOK: You host your data in your own Supabase project. You choose the region, you hold the keys, and you control backups.
How It Works
BYOK setup is a four-step process:
1. Create Your Supabase Project
You create a Supabase project in the region of your choice (US, EU, Middle East, Asia Pacific, etc.). See Supabase Setup for a step-by-step guide.
2. One-Time Schema Setup
During the onboarding call, you provide your Supabase URL and keys via the secure Setup tab in the NearSync client portal. NearSync runs database migrations (schema creation) against your database. This is a one-time operation. See Schema Migration for details on what gets created.
3. Keys Are Discarded After Setup
Your privileged database key is used once during provisioning (schema creation, initial admin user, manifest seeding) and then immediately discarded. NearSync does not store it. You can - and should - rotate your key immediately after setup.
4. Same App Code, Your Database
The NearSync application (admin dashboard and client portal) connects to your Supabase using your public key, which only has RLS-restricted access. All data lives in your database, in your Supabase project, in your chosen region.
What NearSync CAN Access
After setup, NearSync's access to your deployment is limited to metadata-only health monitoring via Sentinel v2.
Sentinel v2 Heartbeat
A lightweight Supabase Edge Function deployed to your project during setup. It exposes a single endpoint that returns:
- Active user count (number only, not names)
- Deals created in the last 7 days (count only, not details)
- Current instance tier
- Industry vertical
- App version
- Heartbeat timestamp
No names, no emails, no deal values, no messages, no documents, no financial data.
Heartbeat Security
- Protected by signed JWT (only NearSync's master instance can call it)
- Polled hourly, not continuously
- Returns aggregate counts only - no row-level data, no PII
Your Control
You can disable or remove Sentinel at any time by deleting the edge function from your Supabase project. This is a standard Supabase CLI command. The NearSync application will continue to function normally without it.
What NearSync CANNOT Access
In a BYOK deployment, NearSync has zero access to:
- Your database contents (contacts, deals, messages, documents, invoices, employee records)
- Your authentication data (user emails, passwords, sessions)
- Your file storage (uploaded documents, contracts, images)
- Your API keys or integrations (WhatsApp, Stripe, Google Workspace credentials)
- Your privileged database key (discarded after one-time setup)
- Any PII (personally identifiable information)
- Database query logs or access logs
Managed vs. BYOK Comparison
| Aspect | Managed | BYOK |
|---|---|---|
| Database location | NearSync's Supabase (shared, multi-tenant) | Your Supabase project (any region) |
| Data isolation | org_id column + RLS policies | Full database isolation |
| NearSync DB access | Yes (restricted operations role) | None (post-setup) |
| NearSync data visibility | Metadata via restricted Sentinel role | Metadata-only via Edge Function heartbeat |
| Key control | NearSync holds keys | You hold all keys |
| Seats | Priced per seat | Unlimited (your infrastructure cost) |
| Backup responsibility | NearSync | You |
| Region selection | NearSync's Supabase region | You choose any Supabase region |
| Infrastructure cost | Included in monthly fee | You pay Supabase directly |
| Compliance scope | NearSync is data processor | NearSync is software licensor only |