Supabase audit frequency
Supabase undergoes annual audits. The HIPAA controls are audited during the same audit period as the SOC 2 controls.
compliance
23 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
SOC 2 and HIPAA compliance relationship
Supabase applies the same SOC 2 controls to all environments, with additional controls being applied to HIPAA environments. Both SOC 2 and HIPAA are frameworks for protecting sensitive data and share many security and privacy controls. Meeting the controls of one normally means being close to complying with the other. SOC 2 is not industry-specific and can be applied to any service organization that handles customer data, while HIPAA is a federal regulation in the United States specific to PHI/ePHI.
Customer responsibilities for HIPAA compliance
Covered entities (the customer) are organizations that directly handle PHI. Customer responsibilities are: (1) Compliance with HIPAA Privacy Rule, Security Rule, and Breach Notification Rule to protect the privacy and security of ePHI; (2) Sign a Business Associate Agreement (BAA) with Supabase that outlines the business associate's responsibilities and requires compliance with HIPAA Rules; (3) Configure their HIPAA projects and follow guidance given by the security advisor, implementing internal processes and compliance programs to meet HIPAA requirements.
Supabase responsibilities as business associate
Supabase as the business associate has these responsibilities: (1) Direct Liability - Supabase is directly liable for compliance with certain provisions of the HIPAA Rules, implement safeguards to protect ePHI and report breaches to the customer; (2) Compliance with BAAs - Supabase must comply with the terms of the BAA, including implementing appropriate administrative, physical, and technical safeguards to protect ePHI; (3) Vendor Management - Supabase must ensure that vendors who may have access to ePHI comply with HIPAA Rules through a BAA with each vendor.
HIPAA compliance is a continuous process
Compliance should not be treated as a point-in-time audit of controls. Supabase applies all necessary privacy and security controls to ensure HIPAA compliance at audit time, and has additional checks and monitoring in place to ensure those controls are not disabled or altered between audit periods. Customers commit to doing the same in their HIPAA environments. Supabase provides checks that warn customers of changes to their projects that disable or weaken HIPAA required controls via the Security Advisor.
HIPAA compliance on hosted vs self-hosted Supabase
The hosted Supabase platform has the necessary controls to meet HIPAA requirements. These controls are not supported out of the box in self-hosted Supabase. HIPAA controls extend further than the Supabase product, encompassing legal agreements (BAAs) with providers, operating controls and policies. Achieving HIPAA compliance with self-hosted Supabase is out of scope for documentation and requires consultation with your auditor.
Postgres connection logging in HIPAA projects
Supabase sets Postgres `log_connections` to off by default for new projects. HIPAA and high-compliance projects should keep connection logging enabled. The Security Advisor warns if connection logging is disabled.
Security testing must be terminated upon Supabase notice
Security testing must be stopped immediately if Supabase contacts the customer due to a breach of policy or negative impact on Supabase and its customers.
Penetration testing permitted without prior approval
Supabase customers are permitted to carry out security assessments or penetration tests of their hosted Supabase project components without prior approval, provided the testing is limited to the customer's own project and complies with the Supabase Acceptable Use Policy.
Supabase Vulnerability Disclosure Program with HackerOne
Supabase runs a Vulnerability Disclosure Program with HackerOne for external security researchers to report bugs. Customer penetration testing does not form part of this VDP.
Permitted services for security testing
Security testing of Supabase projects is permitted for the following services: Authentication, Database, Edge Functions, Storage, Realtime, and the customer's project URLs at https://<customer_project_ref>.supabase.co/* and https://db.<customer_project_ref>.supabase.co/*.
Prohibited testing and activities
The following testing activities are prohibited: any activity contrary to the Acceptable Use Policy, Denial of Service (DoS) and Distributed Denial of Service (DDoS) testing, cross-tenant attacks targeting other customers' accounts or projects, and request flooding.
Vulnerability disclosure requirement
Any vulnerabilities discovered directly in a Supabase product during security testing must be reported to Supabase Security (security@supabase.com) immediately. If testing is completed, any findings must be reported within 24 hours of completion.
Supabase SOC 2 audit frequency and reporting
Supabase undergoes SOC 2 audits annually by an independent third party. The audit period runs from 1 March to 28 February of the next calendar year. Upon successful audit, Supabase receives a SOC 2 Type 2 report detailing compliance status.
SOC 2 coverage of Supabase product features
Supabase implements SOC 2 controls to ensure security of the platform and all features that host customer data: the Postgres Database, Storage, Authentication, Realtime, Edge Functions, and Data API.
SOC 2 compliance boundary and shared responsibility
Supabase's SOC 2 compliance does not transfer to environments outside of the Supabase product or Supabase's control. The security or compliance boundary defines the border between Supabase and customer responsibility. Customer data stored within the Supabase product is managed and secured by Supabase. Data that enters and leaves the Supabase product is the customer's responsibility.
SOC 2 does not cover HIPAA requirements
SOC 2 does not cover nor is it a substitute for compliance with the Health Insurance Portability and Accountability Act (HIPAA). Organizations must have a signed Business Associate Agreement (BAA) with Supabase and have the HIPAA add-on enabled when dealing with Protected Health Information (PHI).
How to obtain Supabase SOC 2 Type 2 report
The SOC 2 Type 2 report is available only to Enterprise and Team Plan Supabase customers. The report is downloadable from the Legal Documents section in the organization dashboard.
Postgres connection logging default and SOC 2 audit requirements
Supabase sets Postgres connection logging to off by default for new projects. If a customer's SOC 2 program requires connection audit evidence, they must enable connection logging and define how to retain and review those logs.
Customer responsibility for data residency compliance
SOC 2 itself does not mandate specific data residency requirements. Customers must ensure projects are deployed in the correct region to comply with other regulatory frameworks such as GDPR. Each Supabase project is deployed into the region specified by the customer at creation time, and all data remains within the chosen region. When creating read replicas for multi-region availability, customers must ensure chosen regions comply with any additional regulatory requirements.
Supabase SOC 2 responsibilities as service provider
Supabase responsibilities include: implementing robust security controls to protect customer data and prevent data breaches; undergoing yearly SOC 2 audits by independent third party to verify compliance with Trust Services Criteria; maintaining an incident response plan to handle data breaches efficiently; and providing SOC 2 Type 2 reports to customers and stakeholders.
Customer SOC 2 compliance responsibilities
Customer responsibilities include: understanding their own compliance requirements; performing due diligence when selecting Supabase by reviewing the SOC 2 Type 2 report and understanding division of responsibilities; regularly monitoring and reviewing Supabase's compliance status; implementing requisite controls and undergoing their own SOC 2 audit if they need to be SOC 2 compliant; and enabling Postgres connection logging if their SOC 2 program requires connection audit evidence.
Supabase SOC 2 Type 2 compliance
Supabase is Systems and Organization Controls 2 (SOC 2) Type 2 compliant. The platform is assessed annually to ensure continued adherence to the SOC 2 security framework. SOC 2 assesses Supabase's adherence to and implementation of controls governing security, availability, processing integrity, confidentiality, and privacy. All projects on the Supabase platform are governed by the same set of compliance controls. Detailed information about Supabase's SOC 2 responsibilities and controls is available in the SOC 2 Compliance Guide.