Supabase
Database · supabase.com · last read 2026-10-12
Identity
| Legal entity | Supabase Pte. Ltd. |
|---|---|
| HQ | SG |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | supabase.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | supabase.com | 2026-10-08 |
EU: The document lists EU regions you can pick for a project, such as West EU (Ireland), Central EU (Frankfurt), West EU (Paris) and North EU (Stockholm), and says the region you choose also determines where your primary project data is stored. It doesn't name a plan or a cost for picking these regions.
Subprocessor chain
23 third parties · 1 of the vendor's own group companies · 0 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Active Campaign, LLC d/b/a Postmark | — | Communication with Authorized Users in connection with the provision of the Services and support |
| Amazon Web Services, Inc | — | Provision of hosting services |
| Atlassian Corporation Plc | — | Provision of status page services |
| Braintrust Data, Inc | — | Provision of monitoring and tracing |
| Clay Labs Inc. | — | Provision of customer insight services |
| Clazar, Inc | — | Provision of marketplace services |
| Cloudflare, Inc | — | Provision of hosting services |
| ConfigCat Korlátolt Felelősségű Társaság | — | Feature flagging |
| Fly.io, Inc | — | Provision of hosting services |
| FrontApp, Inc | — | Communication with Authorized Users in connection with the provision of the Services and support |
| Functional Software, Incd/b/a Sentry | — | Error monitoring and tracing |
| Github, Inc | — | Authorized Users account authentication |
| Google, LLC | — | Provision of hosting services |
| Hex Technologies, Inc | — | Provision of data analytics services |
| Hubspot, Inc | — | Communication with Authorized Users in connection with the provision of the Services and support |
| Latacora, LLC | — | Managed Security Service Provider |
| Notion Labs, Inc | — | Communication with Authorized Users in connection with the provision of the Services and support |
| OpenAI, LLC | — | Provision of natural language processing and generation services |
| PandaDoc, Inc | — | Communication with Authorized Users in connection with the provision of the Services and support |
| Slack Technologies, LLC | — | Communication with Authorized Users in connection with the provision of the Services and support |
| Sublime Security Inc | — | Email Security |
| Upstash, Inc | — | Provision of serverless data hosting services |
| Vercel, Inc | — | Provision of hosting services |
Supabase's own group companies listed as subprocessors (1)
| Company | Country | Purpose |
|---|---|---|
| Supabase, Inc. | — | Provision of support services |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · supabase.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | SCC module 4 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 30 days' notice of proposed changes, to customers who subscribe to notifications via the Subprocessor List page |
| If you object to one | If no mutually acceptable resolution within a reasonable timeframe not exceeding 30 days, customer may terminate the portion of the Agreement for the affected Services |
| If you object to one | Written objection within 5 days of notice; parties work in good faith on a resolution; if none within a reasonable time (max 30 days), customer may terminate the affected portion of the Agreement |
| Breach notification | without undue delay and, where feasible, within 48 hours |
| Audit | Audit Reports (certifications/documentation) on request, accepted in lieu if dated within 12 months; otherwise customer audit no more than once per calendar year, on 30 days' written notice, during business hours, at customer's sole expense; third-party auditor permitted |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| GDPR | Claimed | Projects hosted in EU regions keep your primary database data in-region, and a Data Processing Agreement (DPA) is available | supabase.com | 2026-10-08 |
| HIPAA | Claimed | You can store Protected Health Information (PHI) on our hosted platform once you enter into a Business Associate Agreement (BAA) with us and fulfill your HIPAA obligations under our shared responsibility model. | supabase.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Available on request | information security management systems (ISMS); Enterprise and Team customers can access our ISO 27001 certificate on the dashboard. | supabase.com | 2026-10-08 |
| SOC 2 Type 2 · SOC2T2 | Available on request | Enterprise and Team customers can access our SOC 2 Type 2 report on the dashboard. | supabase.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Supabase; Supabase Pte. Ltd.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Supabase; Supabase Pte. Ltd.
- Data Privacy Framework List (US): checked 2026-10-12, no entry under Supabase; Supabase Pte. Ltd.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Supabase; Supabase Pte. Ltd.
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Supabase; Supabase Pte. Ltd.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Supabase; Supabase Pte. Ltd.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: hackerone.com (security.txt, no Expires field; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.