Trust & security

Row-level security on every table

Access is decided in the database, not in the application. The browser only ever holds a publishable key, so a bug in the interface cannot widen what an account can reach. Four SECURITY DEFINER predicates hold the whole definition of who may do what.

Where to look: supabase/migrations/ — and tests/schema-billing.test.ts, which executes them

Content Security Policy with a per-request nonce

script-src carries a nonce and 'strict-dynamic' rather than 'unsafe-inline', so an injected script does not run. Every page is rendered per request to make that possible, at the cost of CDN caching.

Where to look: proxy.ts

Encryption in transit and at rest

TLS everywhere, HSTS, and upgrade-insecure-requests. Data at rest is encrypted by Supabase, and passwords are stored as hashes we never see.

Nobody here can open your files without a code from you

A design system you have not published cannot be read from the operator console at all. To help with something only visible inside your account, we have to ask you for a code you generate in Settings — that opens a window of sixty minutes, single-use, on your account and nobody else's. Every file opened inside it is recorded against that code, you can see the count while it is happening, and you can end it in one click without asking us. The database refuses the read without a live grant; it is not a policy about how we behave.

Where to look: supabase/migrations/20260101000006_support_grants.sql — and tests/support-grants.test.ts, which tries it without one

Least privilege for operators, with two factors

The operator console authenticates a named person against a server-side allowlist — never a shared password — requires a second factor on top of it, and refuses to perform any action it cannot first write to an append-only audit log.

Where to look: lib/admin/guard.ts

An audit log that detects its own gaps

Every row is hash-chained to the one before it, so removing a line, editing one or reordering two breaks every link after it and names the row where it broke. The table already refuses updates and deletes to everybody including the service key; the chain is what covers the two people a database trigger cannot bind — whoever owns the database, and whoever can restore a snapshot over it.

Where to look: supabase/migrations/20260101000005_audit_chain.sql

Customer-visible audit log

An organization's own administrators can read what was done inside it. The table is append-only, enforced by a trigger, and has no client-writable path.

Where to look: supabase/migrations/20260101000003_billing.sql §18

Data export and erasure, self-service

Accounts can export their data and request deletion in Settings. Paid-account deletion confirms subscription cancellation before removing data; interrupted requests can be retried. Owners of shared teams must transfer ownership first.

Where to look: lib/account.ts

Backup and restore procedure

The operations guide defines database and asset backups and restoration into an isolated project. Provider backup configuration and completed restore drills must be verified before recovery commitments are made.

Where to look: docs/OPERATIONS.md

Dependency and supply-chain checks in CI

Every push runs the full test suite, a typecheck, a production build and an audit of every dependency. A known vulnerability fails the build rather than waiting to be noticed.

Where to look: .github/workflows/ci.yml

No SOC 2 or ISO 27001 report

Neither audit has been performed. If your procurement process requires one, say so early — we would rather tell you now than at the end of a trial.

No third-party penetration test yet

The controls above are real and testable, and none of them have been examined by an outside firm. Responsible disclosure is welcome in the meantime and is covered by a published policy.

Your session token is readable by JavaScript in your own browser

Supabase keeps it in localStorage, which is what lets the app talk to the database directly and collaborate in real time. It also means a script injected into a page could read it. The Content-Security-Policy above exists to stop such a script running at all, and it is a strong mitigation rather than a fix. Moving the token to a cookie the page cannot read would mean routing every database call through our servers, which is a rebuild rather than a setting.

The consent barrier does not bind whoever runs the deployment

Support codes are stored only as a hash taken with a secret the database does not hold, so anybody with database access — a backup, the service key, a psql session — cannot forge one. Somebody who can read the deployment's environment as well can, and that is whoever runs it. No cryptography makes a system's owner unable to defeat their own system. What does apply to them is the hash chain: forging consent leaves rows, and removing the rows breaks the chain.

Single-region data residency

Your data sits in the region the Supabase project is configured for. Choosing a region per customer, or pinning one contractually, is an enterprise conversation rather than a setting.

SSO and SCIM are planned enterprise capabilities

Organization configuration is present, but end-to-end identity-provider sign-in and SCIM provisioning are not yet available. Contact us to discuss requirements; these capabilities are not included as a working beta feature.