> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firstflow.app/llms.txt
> Use this file to discover all available pages before exploring further.

# What you own

> Running FirstFlow as an SDK is light on operations. Here is the short list of what stays your responsibility.

Because there is no FirstFlow server to operate, the operational surface is small. You are running *your* app against *your* Supabase FirstFlow is library code inside it. This page is the division of labor.

## You own

| Area                   | What it means                                                                                                                                               |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Supabase project**   | Provisioning, the connection, backups, and point-in-time recovery. FirstFlow only reads and writes the `firstflow_*` tables.                                |
| **Migrations**         | Applying the shipped SQL in order, and applying new files when you upgrade `@firstflow/config-schema`. See [Set up Supabase](/self-hosting/supabase-cloud). |
| **Row Level Security** | The policies that protect the `firstflow_*` tables from the browser's `anon` key. See [Row Level Security](/self-hosting/oauth-providers).                  |
| **Key hygiene**        | Keeping `SUPABASE_SERVICE_ROLE_KEY` (and any AI provider key) server-only and out of git.                                                                   |
| **Identity**           | Authenticating your users and passing a trustworthy `user.id`. FirstFlow has no auth of its own. See [Identity & auth](/self-hosting/auth-and-orgs).        |
| **AI cost**            | The tokens spent by any LLM you wrap, and by the intent classifier. FirstFlow adds observability, not a model.                                              |
| **Your app deploy**    | Shipping the frontend and (optional) backend that embed the packages your normal CI/CD.                                                                     |

## FirstFlow owns

Nothing at runtime. The packages are MIT-licensed code you vendor into your build. There is no FirstFlow-operated service in the data path, no telemetry sent anywhere, and no account required. Upgrades are package version bumps you choose to take.

## Supabase owns

The `auth` schema (if you use Supabase Auth), Postgres operations, and the managed backups you configure. FirstFlow only ever touches the `public.firstflow_*` tables never hand-edit rows it manages while a flow run is active.

## Next

Harden the deployment with the [production checklist](/self-hosting/production), or contribute improvements via [Contributing](/self-hosting/contributing).