Creating Your Database and Installing the Schema

Pental runs on a database you own. You create it, you run the schema into it, and you hand Pental two values so it can talk to it. Nothing about your engagements is stored anywhere else, which is why this is the first thing you do and why you do it yourself rather than handing over credentials for someone else to run.

1. Create the project

Go to supabase.com/dashboard and create a new project. Any region works and the free tier is enough to start; the region is worth choosing to match what you tell clients about where their data sits, but nothing in Pental depends on it. Set a strong database password and keep it in your own password manager, because nobody at Pental can recover it for you.

2. Run the setup SQL

The setup screen gives you the SQL and a button that opens a blank SQL editor tab on your own project. Paste it in and run it. It creates the tables, the row-level security policies, the functions and the storage buckets.

If Supabase asks whether to "Run with RLS" or "Run without RLS", choose Run with RLS. It is the safer default and the script is written for it.

Keep that SQL to hand. It is idempotent, so re-running the current version is also how you apply an update later: it adds what is missing and never touches your data. If the portal tells you the database is behind, this is the fix.

3. Register the access token hook

This is the step that catches people out, and skipping it leaves you with a portal that signs you in and then shows nothing, because the token never carries the claims the policies read.

• In your project, open Authentication, then Auth Hooks.
• Choose the Customise Access Token (JWT) Claims hook.
• Set Postgres Schema to public.
• Set Postgres Function to custom_access_token_hook.
• Save.

If Postgres is not offered as an option, or the function is not in the dropdown, the SQL has not finished running successfully. Go back to step two, check it completed without an error, and reload the hooks page.

4. Connect it to Pental

• Your project ID is in the address bar while you are looking at the project: supabase.com/dashboard/project/<id>.
• The key is under Project Settings, then API Keys. Copy the one labelled Publishable Key, which starts with sb_publishable_.
• Paste both into the setup screen and continue.

The publishable key is the public one. It is safe in a browser precisely because every table is behind row-level security, which is what the schema in step two installed.

What to do straight afterwards

• Enrol your second factor. The portal asks on first sign-in, and because policies check for a recent verification, it gates the data rather than just the login screen.
• Fill in Settings, then Company, so your reports and attestation letters carry the right registration and address.
• Put the portal on your own domain before you invite a client, so the first address they ever see is yours.
• Look at the backup settings in your project. Backups are part of the platform there, and because the project is yours you can add your own dumps or replication on top.