diff --git a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts index b3a88a149ea..7702b3e99b5 100644 --- a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts +++ b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts @@ -2621,6 +2621,7 @@ export const security: NavMenuConstant = { items: [ { name: 'SOC 2', url: '/guides/security/soc-2-compliance' }, { name: 'HIPAA', url: '/guides/security/hipaa-compliance' }, + { name: 'GDPR', url: '/guides/security/gdpr-compliance' }, ], }, { diff --git a/apps/docs/content/guides/platform/regions.mdx b/apps/docs/content/guides/platform/regions.mdx index fc46be89e6b..8662452218d 100644 --- a/apps/docs/content/guides/platform/regions.mdx +++ b/apps/docs/content/guides/platform/regions.mdx @@ -4,6 +4,12 @@ title: Available regions Each Supabase project is deployed to one primary region. Choose the location closest to your users for the best performance. +## Data residency + +The region you choose also determines where your primary project data is stored. If your data residency requirements call for data to stay within a specific jurisdiction, choose a [specific region](#specific-regions) rather than a general region grouping. + +General regions deploy to _an_ available AWS region within that broader area, which may not match a specific jurisdiction. For example, the "Europe" general region includes London and Zurich, which are not EU member states. Region selection is a data-location control, not proof of regulatory compliance. For GDPR considerations, see the [GDPR compliance guide](/docs/guides/security/gdpr-compliance). + ## General regions For most projects, we recommend choosing a general region. Supabase will deploy your project to an available AWS region within that area based on current infrastructure capacity. diff --git a/apps/docs/content/guides/security.mdx b/apps/docs/content/guides/security.mdx index 5f0e5c81049..af12a0b7e43 100644 --- a/apps/docs/content/guides/security.mdx +++ b/apps/docs/content/guides/security.mdx @@ -15,12 +15,18 @@ The [SOC 2 Compliance Guide](/docs/guides/security/soc-2-compliance) explains Su The [HIPAA Compliance Guide](/docs/guides/security/hipaa-compliance) explains Supabase's HIPAA responsibilities. Additional [security and compliance controls](/docs/guides/deployment/shared-responsibility-model#managing-healthcare-data) for projects that deal with electronic Protected Health Information (ePHI) and require HIPAA compliance are available through the HIPAA add-on. +Supabase is ISO 27001 certified. ISO 27001 is an internationally recognized standard for information security management systems (ISMS), confirming that we maintain rigorous controls to protect customer data. Enterprise and Team customers can access our ISO 27001 certificate [on the dashboard](/dashboard/org/_/documents). + +Supabase supports GDPR-related requirements with EU-region hosting for data residency and a Data Processing Agreement (DPA) for customers who need one. The [GDPR compliance guide](/docs/guides/security/gdpr-compliance) covers shared responsibility, residency scope, and the DPA. + ## Platform configuration As a hosted platform, Supabase provides additional security controls to further enhance the security posture depending on organizations' own requirements or obligations. These can be found under the [dedicated security page](/dashboard/org/_/security) under organization settings. And are described in greater detail [here](/docs/guides/security/platform-security). +Supabase protects against Distributed Denial of Service (DDoS) attacks at the edge via Cloudflare. At the infrastructure layer, fail2ban blocks IP addresses after repeated log-detected abuse, such as failed authentication attempts. + ## Product configuration Each product offered by Supabase comes with customizable security controls and these security controls help ensure that applications built on Supabase are secure, compliant, and resilient against various threats. diff --git a/apps/docs/content/guides/security/gdpr-compliance.mdx b/apps/docs/content/guides/security/gdpr-compliance.mdx new file mode 100644 index 00000000000..118b1445922 --- /dev/null +++ b/apps/docs/content/guides/security/gdpr-compliance.mdx @@ -0,0 +1,19 @@ +--- +id: 'gdpr-compliance' +title: 'GDPR compliance and Supabase' +description: 'How Supabase supports GDPR-compliant deployments, including data residency and the Data Processing Agreement (DPA).' +--- + +Supabase supports building GDPR-compliant applications. Building a compliant application is a [shared responsibility](/docs/guides/deployment/shared-responsibility-model): Supabase secures the underlying infrastructure, while you're responsible for your application's data processing activities, consent flows, and access controls. + +## Data residency + +Each Supabase project is deployed to a single primary region, and your project's primary Postgres database, Auth service, and Storage objects are hosted in that region. Choosing a [specific region](/docs/guides/platform/regions#specific-regions) within the EU pins these services to that exact AWS region. + +Note that the "Europe" general region grouping also includes London (UK) and Zurich (Switzerland) — both have GDPR-adequacy data protection regimes, but neither is an EU member state. If your compliance requirements call for data to stay within the EU specifically, choose a specific EU region rather than the general Europe grouping. See [available regions](/docs/guides/platform/regions) for the full list. + +Choosing a region is a data-location control and does not make your application GDPR compliant on its own. Backups, logs, data exported to external systems, Edge Function execution, and sub-processors can affect your data residency and international transfer analysis. + +## Data processing agreement (DPA) + +If you need a formal data processing contract under GDPR, Supabase provides a Data Processing Agreement (DPA). [Request or view the DPA](/legal/dpa).