Supabase
Security and trust center evidence
Build in a weekend. Scale to millions.
Summary
Supabase has 5 vendor-stated rows in the CertReports index, last verified 21 Sep 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
As of 21 Sep 2026, CertReports holds 5 vendor-stated rows for Supabase, drawn from custom. Supabase states on its trust centre that it holds that it will sign a business associate agreement, a SOC 2 Type II report, a data processing agreement, a PCI DSS attestation of compliance and an ISO/IEC 27001 certificate, captured 21 Sep 2026; these are vendor statements, not independent confirmations. No public evidence was found for FedRAMP as of 21 Sep 2026; that is a gap in the public record, not a finding of non-coverage, and the vendor can supply it under NDA.
- HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured), vendor-stated as of 21 Sep 2026
- SOC 2: Vendor states SOC 2 Type 2 on its trust centre, vendor-stated as of 21 Sep 2026
Facts only, each dated; nothing here is inferred, scored or advised.
Among developer tools vendors
0verified rows
Category median 0, across 220 indexed developer tools vendors. Supabase has no registry-verified row yet, like 64 percent of them; its evidence is vendor-stated or reported.
Compare with similar vendors
Pick your own comparisonCompliance grid
- HIPAAVendor-stated
Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)
as of 21 Sep 20261 source
SOC 2Vendor-statedVendor states SOC 2 Type 2 on its trust centre
as of 21 Sep 20261 source- GDPRVendor-stated
Vendor states GDPR on its trust centre
as of 21 Sep 20261 source
PCI DSSVendor-statedVendor states PCI DSS on its trust centre
as of 21 Sep 20261 source
ISO/IEC 27001Vendor-statedVendor states ISO/IEC 27001:2022 on its trust centre
as of 21 Sep 20261 source
No public evidence yet for FedRAMP, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.
Legal artefacts
No DPA, BAA or subprocessor list has been captured from a public page yet. Registry rows above do not depend on this. Check the vendor trust centre.
Subprocessors
No subprocessor list captured yet.
Change history
- 22 Sep 2026First indexed by CertReports5 evidence rows across 5 frameworks entered the index.
Similar vendors with evidence
Related by product tags and the Developer tools category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
Postman
Developer tools
Postman is an API platform for building and using
Prisma Data
Developer tools
Prisma gives TypeScript and Node.js teams Prisma ORM, Prisma Postgres, and Prisma Compute: a type-safe ORM, managed Postgres, and Compute
Alpaca
Developer tools
API-first stock and crypto brokerage platform
Netlify
Developer tools
Create with AI or code, deploy instantly on production
Evidence against regulations
All regulations for SupabaseHow much of each regulation’s vendor requirements Supabase’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read