Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.
In this guide
- Key takeaways
- What does SOC 2 Type 2 certification mean for Supabase?
- Which security controls are covered by Supabase’s SOC 2 audit?
- How does the shared - responsibility model affect me?
- Where can I get the actual SOC 2 report?
- How to verify Supabase’s compliance during a security review?
- What additional steps should I take beyond Supabase’s SOC 2 coverage?
- How does Decloak help you verify Supabase configurations?
- When should I consider a higher - tier Decloak scan?
- Bottom line
Key takeaways
- Supabase is SOC 2 Type 2 compliant and audited annually covering all five Trust Services Criteria.
- Encryption is AES - 256 at rest and TLS 1.2+ in transit; MFA and RBAC protect dashboard access.
- The audit covers only data stored inside Supabase - you remain responsible for anything that exits the platform.
- Full SOC 2 reports are available only to Team and Enterprise customers via the dashboard.
What does SOC 2 Type 2 certification mean for Supabase?
Supabase’s SOC 2 Type 2 certification proves that an independent CPA firm has verified the platform’s controls over a rolling 12 - month period (March 1 → Feb 28). The audit evaluates security, availability, processing integrity, confidentiality, and privacy, giving you documented evidence that Supabase meets industry - wide standards.
Which security controls are covered by Supabase’s SOC 2 audit?
Supabase’s audit includes:
- Data - at - rest encryption: All stored customer data is encrypted with AES - 256.
- Data - in - transit encryption: Every request to Supabase services uses TLS 1.2 or higher.
- Identity and access management: Dashboard accounts require multi - factor authentication and use role - based access control for organization members.
- Monitoring and alerting: Continuous logging, Cloudflare DDoS protection, and fail2ban for brute - force mitigation are in place, with optional log - drains to external SIEMs.
- Backup and recovery: Paid databases are backed up daily; Pro customers can enable point - in - time recovery.
- Third - party audit: An independent CPA firm performs the audit each year, ensuring unbiased verification.
How does the shared - responsibility model affect me?
Supabase secures the platform boundary - its databases, authentication service, storage, and edge functions. Anything that leaves Supabase (e.g., API responses, client - side code, exported data) is outside the SOC 2 scope. You must implement Row Level Security, protect service_role keys, and enforce proper CORS policies in your own application code.
Where can I get the actual SOC 2 report?
Only customers on the Team or Enterprise plans can download the full SOC 2 Type 2 report from the Supabase dashboard or Trust Center. The report is gated behind the entitlement key security.soc2_report and is not publicly published.
How to verify Supabase’s compliance during a security review?
- Request the SOC 2 Type 2 report from your Supabase account manager.
- Check the audit period (Mar 1 → Feb 28) to ensure it covers the time frame of your project.
- Confirm that the report lists the five Trust Services Criteria.
- Validate that encryption, MFA, RBAC, monitoring, and backup controls are documented.
- Map any additional compliance requirements (HIPAA, ISO 27001) to the same control set, as Supabase claims those controls satisfy those frameworks as well.
What additional steps should I take beyond Supabase’s SOC 2 coverage?
- Enable Row Level Security on all tables you expose via the API.
- Keep service_role or anon keys out of client - side JavaScript; use server - side proxies instead.
- Configure strict CORS headers instead of
*. - Export logs to your own SIEM for long - term retention and correlation.
- Regularly rotate API keys and review audit logs for anomalous activity.
How does Decloak help you verify Supabase configurations?
Decloak’s free scan runs eight core layers, including JavaScript CVE scanning (layer 4) and vibe - coded platform security (layer 7). Layer 7 fingerprints Supabase deployments and can detect misconfigurations such as a publicly readable table or an accidentally exposed service_role key. Running a Decloak scan on your Supabase - backed frontend gives you an independent, evidence - backed view of the exposure surface.
When should I consider a higher - tier Decloak scan?
If you need deeper insight - such as multi - page crawling, tag - manager analysis, or evidence packages for auditors - upgrade to a Starter or Pro plan. These tiers add DNS/TLS deep analysis (layer 9) and provide downloadable evidence bundles that can complement Supabase’s SOC 2 report during compliance audits.
Bottom line
Supabase’s SOC 2 Type 2 audit provides strong, independently verified controls for the platform itself, but you remain responsible for securing data that leaves Supabase. Use the SOC 2 report for auditor evidence, apply best - practice configurations in your application, and run a Decloak scan to catch any misconfigurations that fall outside the audit’s scope.
Related guides
What is NIST in cybersecurity and why should you care?
NIST is the U.S. agency that creates the Cybersecurity Framework and a suite of standards like SP 800 - 53 that guide risk management for both government and private organizations.
Which NIST Cybersecurity Standards Should My Organization Adopt in 2024 - 2025?
Learn the core NIST publications that form a practical, layered security program, how they map together, and concrete steps to start using them today.
Does the EU AI Act apply to U.S. companies?
Yes - the EU AI Act has extraterritorial reach and can bind U.S. AI providers, deployers, importers or distributors whenever their systems are placed on the EU market, used by an EU entity, or produce output that is used in the Union.