Lo que convierte el stack actual en grado producción, y el escalado AWS por triggers. Fuente completa: doc 19, Apéndices B1–B3.
| Area | Tasks |
|---|---|
| Payments (tech) | Stripe / RevenueCat integration, entitlements table, webhooks, free-vs-paid gates |
| Observability | Sentry (app+web, EU), uptime checks on 3 hostnames, Supabase log retention, alerting channel |
| Security | WAF rules + Turnstile (signup, waitlist) · per-user quotas on write RPCs · secrets rotation · Dependabot |
| DB secure zone | Supabase network restrictions (no public SQL), SSL enforced, encryption-at-rest verified, service_role vault-only |
| Backup discipline | Restore drill (actually restore a snapshot and verify) · enable PITR (Supabase Pro) |
| Release eng | Staging env (2nd Supabase project + Pages preview) · CI on org repos (typecheck+tests per PR) · EAS robot token |
| Store pipeline | EAS Build → TestFlight/Play internal → staged rollout, crash-gated |
| Compliance ops | DPIA · registro de tratamientos · DPAs on file · retention jobs · delete-account E2E test |
| Support ops | contact@ ownership + SLA · feedback triage ritual · public status page |
Triggers: sustained p95 degradation · Supabase ceilings at ~70% · cost crossover · enterprise requirement. Intermediate first: Supabase dedicated compute (10–100× headroom, zero migration). If fired: AWS landing zone (IAM 3+1, EU-only) → Aurora in private VPC (KMS, Secrets Manager) → logical replication cutover with 30-day Supabase rollback → re-run all of B1 on the new stack.
Cloudflare edge unchanged → ALB → ECS Fargate (API · auth · workers) in private subnets → Aurora Multi-AZ (KMS, no public endpoint) · S3 · Secrets Manager · CloudWatch/OTel. Region eu-central-2 (Zurich). The 4 surfaces, deploy commands and RLS model do not change; config.ts is the single switch point.