Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.
In this guide
- Key takeaways
- What does a SOC 2 Type 2 attestation mean for Supabase?
- Which security controls are covered by Supabase’s SOC 2 audit?
- How does the shared - responsibility model affect me?
- Where can I get the actual SOC 2 report?
- How to verify Supabase’s compliance during a security review?
- What additional steps should I take beyond Supabase’s SOC 2 coverage?
- How does Decloak help you verify Supabase configurations?
- When should I consider a higher - tier Decloak scan?
- Bottom line
Key takeaways
- Supabase is SOC 2 Type 2 compliant and audited annually covering all five Trust Services Criteria.
- Encryption is AES - 256 at rest and TLS 1.2+ in transit; MFA and RBAC protect dashboard access.
- The audit covers only data stored inside Supabase - you remain responsible for anything that exits the platform.
- Full SOC 2 reports are available only to Team and Enterprise customers via the dashboard.
What does a SOC 2 Type 2 attestation mean for Supabase?
Supabase's SOC 2 Type 2 report - an attestation from an independent CPA firm, not a certificate - proves the firm verified the platform's controls over an extended observation period. The audit evaluates security, availability, processing integrity, confidentiality, and privacy, giving you documented evidence that Supabase meets industry - wide standards.
Which security controls are covered by Supabase’s SOC 2 audit?
Supabase’s audit includes:
- Data - at - rest encryption: All stored customer data is encrypted with AES - 256.
- Data - in - transit encryption: Every request to Supabase services uses TLS 1.2 or higher.
- Identity and access management: Dashboard accounts require multi - factor authentication and use role - based access control for organization members.
- Monitoring and alerting: Continuous logging, Cloudflare DDoS protection, and fail2ban for brute - force mitigation are in place, with optional log - drains to external SIEMs.
- Backup and recovery: Paid databases are backed up daily; Pro customers can enable point - in - time recovery.
- Third - party audit: An independent CPA firm performs the audit each year, ensuring unbiased verification.
How does the shared - responsibility model affect me?
Supabase secures the platform boundary - its databases, authentication service, storage, and edge functions. Anything that leaves Supabase (e.g., API responses, client - side code, exported data) is outside the SOC 2 scope. You must implement Row Level Security, protect service_role keys, and enforce proper CORS policies in your own application code.
Where can I get the actual SOC 2 report?
Only customers on the Team or Enterprise plans can download the full SOC 2 Type 2 report from the Supabase dashboard or Trust Center. The report isn't publicly published - it's shared under NDA to customers on qualifying plans.
How to verify Supabase’s compliance during a security review?
- Request the SOC 2 Type 2 report from your Supabase account manager.
- Check the audit period stated in the report itself to ensure it covers the time frame of your project.
- Confirm that the report lists the five Trust Services Criteria.
- Validate that encryption, MFA, RBAC, monitoring, and backup controls are documented.
- Map any additional compliance requirements (HIPAA, ISO 27001) to the same control set, as Supabase claims those controls satisfy those frameworks as well.
What additional steps should I take beyond Supabase’s SOC 2 coverage?
- Enable Row Level Security on all tables you expose via the API.
- Keep service_role or anon keys out of client - side JavaScript; use server - side proxies instead.
- Configure strict CORS headers instead of
*. - Export logs to your own SIEM for long - term retention and correlation.
- Regularly rotate API keys and review audit logs for anomalous activity.
How does Decloak help you verify Supabase configurations?
Decloak’s free scan runs eight core layers, including JavaScript CVE scanning (layer 4) and vibe - coded platform security (layer 10). Layer 10 fingerprints Supabase deployments and can detect misconfigurations such as a publicly readable table or an accidentally exposed service_role key. Running a Decloak scan on your Supabase - backed frontend gives you an independent, evidence - backed view of the exposure surface.
When should I consider a higher - tier Decloak scan?
If you need deeper insight - such as multi - page crawling, tag - manager analysis, or evidence packages for auditors - upgrade to a Starter or Pro plan. These tiers add DNS/TLS deep analysis (layer 9) and provide downloadable evidence bundles that can complement Supabase’s SOC 2 report during compliance audits.
Bottom line
Supabase’s SOC 2 Type 2 audit provides strong, independently verified controls for the platform itself, but you remain responsible for securing data that leaves Supabase. Use the SOC 2 report for auditor evidence, apply best - practice configurations in your application, and run a Decloak scan to catch any misconfigurations that fall outside the audit’s scope.
Related guides
How to Build Continuous Web - Security Scans with Scheduled Decloak Checks and Ticket Automation
Learn how to schedule Decloak scans via the REST API, compare results across runs, and push new or regressed findings to Jira or Linear automatically.
How can Decloak give auditor - ready proof for SOC 2 and ISO 27001 without weeks of manual work?
Decloak’s free and paid scans generate evidence packages and framework mappings that satisfy SOC 2 and ISO 27001 auditors quickly and automatically.
How can I quickly scan my single-page app for exposed secrets and vulnerable third - party scripts?
Use Decloak’s free 15 - second scan to detect hard - coded keys, outdated libraries, missing SRI and mixed content in a single - page app before a formal audit.