Is Supabase HIPAA - Compliant and How Do You Meet the Requirements?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• Supabase is a Business Associate and can host ePHI only when the paid HIPAA add - on is enabled on a Team or Enterprise plan.
• A signed Business Associate Agreement (BAA) must be in place before any PHI touches Supabase.
• You must mark each PHI - handling project as High Compliance and enable four mandatory controls: Point - in - Time Recovery, TLS enforcement, IP allow - list, and Postgres connection logging.
• Security Advisor continuously monitors those settings and alerts you to drift.
• The shared - responsibility model still requires you to implement RLS, RBAC, MFA, audit - log review, and your own risk - management processes.

Does Supabase qualify as a HIPAA Business Associate?

Yes, Supabase can act as a Business Associate for customers that store PHI, but only after a signed Business Associate Agreement (BAA) is in place.

Which Supabase plans support HIPAA compliance?

Only the Team (or higher) subscription can enable the HIPAA add - on; it is unavailable on Free or Pro plans and incurs a separate fee disclosed on request.

What technical controls must be enabled for a HIPAA - ready project?

When the HIPAA add - on is active, each project that will store PHI must be marked High Compliance and must satisfy four mandatory controls:

1. Point - in - Time Recovery (PITR) - requires at least a Small compute add - on.
2. SSL/TLS enforcement for all PostgreSQL connections (TLS 1.2+).
3. Network restrictions - configure an IP allow - list.
4. Postgres connection logging - set log_connections=on. Security Advisor verifies these settings and warns on drift.

How does Supabase protect data at rest and in transit?

Supabase relies on AWS - approved HIPAA - eligible services. Data - at - rest is encrypted with AES - 256 managed by AWS, and all network traffic uses TLS 1.2 or higher.

What logging and audit requirements are met?

Supabase logs all database activity, authentication events, and configuration changes. Connection logging is forced on for HIPAA projects, and logs are retained for at least six years.

Which access - control features must you configure?

You need to enable Role - Based Access Control (RBAC) at the organization level and write Row - Level Security (RLS) policies on every table that stores PHI. Multi - Factor Authentication (MFA) is enforced for admin accounts.

What does the shared - responsibility model look like?

Supabase secures the underlying infrastructure (physical hosts, network, OS, and the PostgreSQL engine). You remain responsible for application - level safeguards: RLS policies, secret management, MFA, audit - log review, risk analyses, staff training, and incident - response planning.

How do you enable HIPAA compliance in practice?

1. Upgrade to a Team or Enterprise plan.
2. Request and sign the HIPAA add - on via the Supabase dashboard.
3. Execute a signed BAA before any ePHI is stored.
4. Mark each PHI - handling project as High Compliance.
5. Enable PITR, TLS enforcement, IP allow - list, and connection logging.
6. Implement RLS on all PHI tables, configure RBAC, and enforce MFA for admins.
7. Verify AES - 256 at rest and TLS 1.2+ in transit.
8. Retain audit logs for at least six years and monitor them with Security Advisor.
9. Document your own HIPAA policies, risk analysis, and incident - response procedures.

What are the limitations of Supabase’s HIPAA offering?

The HIPAA controls apply only to Supabase’s hosted service. Self - hosted deployments are not covered by Supabase’s BAA, and the add - on incurs extra cost and is unavailable on lower - tier plans.

How does this compare to other managed back - end platforms?

Supabase offers a built - in compliance path, but you still need to implement application - level safeguards that many other platforms leave entirely to the developer.

When should you consider an alternative?

If you need HIPAA compliance for a self - hosted environment, require custom encryption keys, or must avoid any additional third - party fees, a pure AWS or Azure deployment with your own BAA may be more appropriate. Supabase is ideal when you want a rapid back - end with built - in HIPAA controls and are comfortable with the shared - responsibility model.

Final checklist before going live

• Team or Enterprise plan with HIPAA add - on active
• Signed BAA in place
• All PHI projects marked High Compliance
• PITR enabled and tested
• TLS 1.2+ enforced for every DB connection
• IP allow - list configured
• log_connections=on verified
• RLS policies applied to every PHI table
• Admin MFA enforced
• Audit logs retained ≥ 6 years and monitored
• Internal HIPAA policies, risk analysis, and IR plan documented

How Decloak can help you stay HIPAA - ready

Decloak’s free scan runs core checks in about 15 seconds and returns a graded report. It can detect publicly readable database tables, missing Row - Level Security, and insecure TLS configurations - issues that would violate your Supabase HIPAA controls. Running a Decloak scan before launch gives you concrete evidence of any exposure and a clear remediation plan, helping you keep the required controls in place without extra cost.