supabase/apps/docs/content/guides/security.mdx

---
id: 'security'
title: 'Supabase Security'
description: 'Security and compliance on the Supabase platform.'
sidebar_label: 'Overview'
hideToc: true
---

Supabase is a hosted platform to get you started without needing to manage any infrastructure yourself. The hosted platform comes with many security and compliance controls managed by Supabase.

## Compliance

Supabase is SOC 2 Type 2 compliant and regularly audited. All projects at Supabase are governed by the same set of compliance controls.
The [SOC 2 Compliance Guide](/docs/guides/security/soc-2-compliance) explains Supabase's SOC 2 responsibilities and controls in more detail.

The [HIPAA Compliance Guide](/docs/guides/security/hipaa-compliance) explains Supabase's HIPAA responsibilities. Additional [security and compliance controls](/docs/guides/deployment/shared-responsibility-model#managing-healthcare-data) for projects that deal with electronic Protected Health Information (ePHI) and require HIPAA compliance are available through the HIPAA add-on.

Supabase is ISO 27001 certified. ISO 27001 is an internationally recognized standard for information security management systems (ISMS), confirming that we maintain rigorous controls to protect customer data. Enterprise and Team customers can access our ISO 27001 certificate [on the dashboard](/dashboard/org/_/documents).

Supabase supports GDPR-related requirements with EU-region hosting for data residency and a Data Processing Agreement (DPA) for customers who need one. The [GDPR compliance guide](/docs/guides/security/gdpr-compliance) covers shared responsibility, residency scope, and the DPA.

## Platform configuration

As a hosted platform, Supabase provides additional security controls to further enhance the security posture depending on organizations' own requirements or obligations.

These can be found under the [dedicated security page](/dashboard/org/_/security) under organization settings. And are described in greater detail [here](/docs/guides/security/platform-security).

Supabase protects against Distributed Denial of Service (DDoS) attacks at the edge via Cloudflare. At the infrastructure layer, fail2ban blocks IP addresses after repeated log-detected abuse, such as failed authentication attempts.

## Product configuration

Each product offered by Supabase comes with customizable security controls and these security controls help ensure that applications built on Supabase are secure, compliant, and resilient against various threats.

The [security configuration guides](/docs/guides/security/product-security) provide detailed information for configuring individual products.