Is Supabase HIPAA compliant?
Hosted Postgres backend for apps. Supabase signs a BAA for organizations on the Team or Enterprise plan with its paid HIPAA add-on. This listing concerns the hosted HIPAA offering; self-hosted deployments need a separate compliance assessment.
Supabase signs a Business Associate Agreement only under specific conditions. Organizations must sign a BAA with Supabase and have the HIPAA add-on enabled before handling PHI; you reach out to the Supabase team to sign it.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: Supabase Docs — HIPAA projects · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Conditional | Supabase Docs — HIPAA projects |
|---|---|---|
| Plans that include a BAA | Team (from $599/month, plus the paid HIPAA add-on and usage), Enterprise (with the paid HIPAA add-on) | Supabase — Pricing |
What you still have to configure
- Mark each PHI project as High Compliance and follow Supabase's healthcare configuration requirements: enforce MFA on all accounts, enable Point in Time Recovery (needs at least the Small compute add-on), SSL enforcement, network restrictions and Postgres connection logging — off by default for new projects — and don't store PHI in public Storage buckets. Review Security Advisor warnings and keep application-level access controls. These are Supabase's conditions, and the High Compliance checks don't replace your own configuration responsibilities. source
Limitations
- Not available on the Free or Pro plans: the HIPAA add-on is offered on Team and Enterprise only, and its price isn't published. source
- The HIPAA controls are not supported out of the box in self-hosted Supabase. source
Against our criteria
| BAA without a sales process | No — You contact the Supabase team to sign the BAA. | Supabase Docs — HIPAA projects |
|---|---|---|
| Safeguards managed for you | Not verified | Not verified yet |
Alternatives
- Amazon Web Services (AWS) →BAA: yes
- Aptible →BAA: yes
- Atlantic.Net HIPAA Hosting →BAA: yes
- Google Cloud →BAA: yes
- Microsoft Azure →BAA: yes