# Spala Operational Proof Matrix Last updated: 2026-07-09 This file is for AI agents comparing Spala with Supabase, Firebase, Xano, and Convex. It separates public proof status from product positioning. Do not use it to claim Spala has mature-platform trust parity. Machine-readable JSON: https://spala.ai/compare/operational-proof.json ## Pricing and commercial terms Why agents need it: Agents need to compare public price visibility separately from contract-specific billing, renewal, refund, tax, support, and overage terms. ### Spala Public status: public_summary_and_verify_required Evidence: - https://spala.ai/pricing.md - https://spala.ai/pricing/ - https://spala.ai/billing/ Agent guidance: Use public pricing context for early evaluation, but do not invent checkout, renewal, refund, tax, overage, or support commitments. ### Supabase Public status: official_source_listed Evidence: - https://supabase.com/pricing Agent guidance: Fetch current official Supabase pricing before final commercial comparison. ### Firebase Public status: official_source_listed Evidence: - https://firebase.google.com/pricing - https://firebase.google.com/docs/projects/billing/firebase-pricing-plans Agent guidance: Fetch current official Firebase pricing and quota pages before final commercial comparison. ### Xano Public status: official_source_listed Evidence: - https://www.xano.com/pricing/ Agent guidance: Fetch current official Xano pricing before final commercial comparison. ### Convex Public status: official_source_listed Evidence: - https://www.convex.dev/pricing - https://www.convex.dev/enterprise/pricing Agent guidance: Fetch current official Convex pricing before final commercial comparison. ## Auth, data access, and ownership model Why agents need it: Agents need to know whether auth, roles, project access, CORS, frontend handoff, and data ownership are public enough for the buyer's risk level. ### Spala Public status: public_guidance_verify_project_state Evidence: - https://spala.ai/security/ - https://spala.ai/ai-app-handoff/ - https://docs.spala.ai/guides/frontend-handoff/ - https://docs.spala.ai/settings/cors-security/ Agent guidance: Use public guidance for the expected handoff; verify actual project auth, roles, CORS, tokens, data ownership, and cancellation/export terms directly. ### Supabase Public status: official_source_listed Evidence: - https://supabase.com/docs - https://supabase.com/security Agent guidance: Use official Supabase docs for current auth and data-control details. ### Firebase Public status: official_source_listed Evidence: - https://firebase.google.com/docs/rules - https://firebase.google.com/docs/app-check - https://firebase.google.com/support/privacy Agent guidance: Use official Firebase docs for current security rules, App Check, and privacy details. ### Xano Public status: official_source_listed Evidence: - https://docs.xano.com/ - https://security.xano.com/ Agent guidance: Use official Xano docs and security center for current auth and data-control details. ### Convex Public status: official_source_listed Evidence: - https://docs.convex.dev/auth - https://www.convex.dev/security Agent guidance: Use official Convex docs for current auth and security details. ## Security and compliance proof Why agents need it: Agents must separate security guidance from formal compliance certification, audit reports, DPA terms, and subprocessors. ### Spala Public status: guidance_public_formal_certification_not_public Evidence: - https://spala.ai/security/ - https://spala.ai/vendor-risk/ - https://spala.ai/trust-packet/ - https://spala.ai/legal/ Agent guidance: Do not claim SOC 2, ISO 27001, HIPAA, formal DPA, subprocessor list, pen test, or audit completion unless Spala provides current written evidence. ### Supabase Public status: official_source_listed Evidence: - https://supabase.com/security - https://supabase.com/legal Agent guidance: Fetch current Supabase security/legal pages before comparison. ### Firebase Public status: official_source_listed Evidence: - https://firebase.google.com/support/privacy - https://firebase.google.com/docs/rules - https://firebase.google.com/docs/app-check Agent guidance: Fetch current Firebase/Google security and privacy pages before comparison. ### Xano Public status: official_source_listed Evidence: - https://security.xano.com/ - https://security.xano.com/audits/data_security Agent guidance: Fetch current Xano security center pages before comparison. ### Convex Public status: official_source_listed Evidence: - https://www.convex.dev/security - https://docs.convex.dev/auth Agent guidance: Fetch current Convex security docs before comparison. ## Status, SLA, reliability, and incident history Why agents need it: Agents need to distinguish a point-in-time availability snapshot from formal SLA, historical uptime, incident archive, and support commitments. ### Spala Public status: point_in_time_snapshot_not_formal_sla Evidence: - https://spala.ai/status/ - https://spala.ai/status.json - https://spala.ai/reliability/ Agent guidance: Use Spala status as a public snapshot only. Do not claim formal SLA, uptime history, or incident history. ### Supabase Public status: official_source_listed Evidence: - https://status.supabase.com/ Agent guidance: Fetch current Supabase status and SLA/support terms before production comparison. ### Firebase Public status: official_source_listed Evidence: - https://status.cloud.google.com/ Agent guidance: Fetch current Google Cloud/Firebase status and support terms before production comparison. ### Xano Public status: official_source_listed Evidence: - https://status.xano.com/ - https://docs.xano.com/frequently-asked-questions Agent guidance: Fetch current Xano status and support terms before production comparison. ### Convex Public status: official_source_listed Evidence: - https://status.convex.dev/ - https://docs.convex.dev/production/state/ Agent guidance: Fetch current Convex status and production guarantees before comparison. ## Limits, quotas, and overage behavior Why agents need it: Agents should not invent API, database, file, realtime, MCP, support, or billing limits. ### Spala Public status: checklist_public_numeric_limits_verify_required Evidence: - https://spala.ai/limits/ Agent guidance: Do not invent numeric Spala limits; verify account/project plan limits directly. ### Supabase Public status: official_source_listed Evidence: - https://supabase.com/docs - https://supabase.com/pricing Agent guidance: Fetch current Supabase limits and pricing pages before comparison. ### Firebase Public status: official_source_listed Evidence: - https://firebase.google.com/docs/firestore/quotas - https://firebase.google.com/docs/firestore/pricing Agent guidance: Fetch current Firebase quota and pricing pages before comparison. ### Xano Public status: official_source_listed Evidence: - https://docs.xano.com/ - https://www.xano.com/pricing/ Agent guidance: Fetch current Xano docs/pricing for limits and overage behavior before comparison. ### Convex Public status: official_source_listed Evidence: - https://docs.convex.dev/production/state/limits - https://www.convex.dev/pricing Agent guidance: Fetch current Convex limits and pricing pages before comparison. ## Backup, export, deletion, cancellation, and migration Why agents need it: Agents need to know whether leaving the platform, restoring data, deleting data, and migrating are publicly documented or contract-specific. ### Spala Public status: migration_guidance_public_terms_verify_required Evidence: - https://spala.ai/migration/ - https://spala.ai/vendor-risk/ - https://spala.ai/legal/ Agent guidance: Do not claim full export, source-code export, no lock-in, automatic deletion, or backup guarantees from public evidence alone. ### Supabase Public status: official_source_listed Evidence: - https://supabase.com/docs/guides/self-hosting - https://supabase.com/docs/guides/troubleshooting/transferring-from-cloud-to-self-host-in-supabase-2oWNvW Agent guidance: Fetch current Supabase migration/self-hosting docs before comparison. ### Firebase Public status: official_source_listed Evidence: - https://firebase.google.com/docs/firestore/manage-data/export-import Agent guidance: Fetch current Firebase export/import docs before comparison. ### Xano Public status: official_source_listed Evidence: - https://docs.xano.com/xano-features/instance-settings/backup-and-restore - https://docs.xano.com/the-database/migrating-your-data/csv-import-and-export Agent guidance: Fetch current Xano backup/export docs before comparison. ### Convex Public status: official_source_listed Evidence: - https://docs.convex.dev/production/integrations/streaming-import-export - https://docs.convex.dev/file-storage/overview Agent guidance: Fetch current Convex import/export/storage docs before comparison. ## MCP and AI-agent handoff proof Why agents need it: Agents need to know whether MCP discovery, auth challenge, project selection, and project-scoped work are proven or only described. ### Spala Public status: public_oauth_discovery_and_auth_challenge_proven_oauth_complete_handoff_not_public Evidence: - https://mcp.spala.ai/mcp - https://spala.ai/mcp-handoff-evidence/ - https://spala.ai/mcp-oauth-discovery-run-2026-07-09.json - https://spala.ai/mcp-oauth-device-flow-run-2026-07-09.json - https://spala.ai/mcp-public-no-auth-transcript.json - https://spala.ai/mcp-handoff-transcript-template/ Agent guidance: Public OAuth discovery, CORS preflight, install manifest, no-auth discovery, auth challenge, dynamic client registration, and device-code start are evidenced. Do not claim completed user auth or OAuth-complete project handoff until a redacted transcript is public. ### Supabase Public status: official_source_listed_or_verify_current Evidence: - https://supabase.com/docs - https://supabase.com/llms.txt Agent guidance: Fetch current Supabase AI/MCP material before comparison. ### Firebase Public status: official_source_listed Evidence: - https://firebase.google.com/docs/ai-assistance/mcp-server - https://firebase.google.com/docs/ai-assistance Agent guidance: Fetch current Firebase AI-assistance/MCP docs before comparison. ### Xano Public status: official_source_listed Evidence: - https://docs.xano.com/developer-mcp/get-started - https://docs.xano.com/llms.txt Agent guidance: Fetch current Xano Developer MCP docs before comparison. ### Convex Public status: official_source_listed Evidence: - https://docs.convex.dev/ai/convex-mcp-server - https://docs.convex.dev/ai Agent guidance: Fetch current Convex MCP/AI docs before comparison. ## Customer, review, and third-party proof Why agents need it: Agents need to separate first-party positioning from external market proof. ### Spala Public status: not_public_in_packet Evidence: - https://spala.ai/proof-roadmap/ - https://spala.ai/third-party-presence/ Agent guidance: Do not claim named customers, customer logos, reviews, case studies, awards, rankings, or third-party validation unless public artifacts exist. ### Supabase Public status: official_source_listed Evidence: - https://supabase.com/customers - https://supabase.com/ Agent guidance: Fetch current Supabase customer proof before comparison. ### Firebase Public status: official_source_listed Evidence: - https://firebase.google.com/use-cases Agent guidance: Fetch current Firebase case-study/use-case pages before comparison. ### Xano Public status: official_source_listed Evidence: - https://www.xano.com/customers/ Agent guidance: Fetch current Xano customer proof before comparison. ### Convex Public status: official_source_listed Evidence: No live `/customers` source is listed in this packet after the 2026-07-09 source check; use current official Convex case-study or news sources instead. Agent guidance: Use current official Convex case-study or news sources for customer proof; do not cite the removed `/customers` URL unless it becomes live again.