Yes, conditionally. Supabase will sign a BAA and allow Protected Health Information on its hosted platform, but only with the paid HIPAA add-on enabled and a plan of Team or above. Its marketing page mentions the BAA and omits the add-on. Bringing an existing AI-built Supabase app onto that footing typically runs $13K–$25K over 6–10 weeks.
| Fact | Value |
|---|---|
| Tool | Supabase |
| Verdict | Yes, with conditions |
| Sources checked | August 2026 |
| Typical range | $13,000–$25,000 |
| Typical timeline | 6–10 weeks |
| Last updated | August 2026 |
Supabase's marketing page and Supabase's docs do not say the same thing
What secondary sources say
Most "is Supabase HIPAA compliant" round-ups quote the security page and stop there: sign a BAA and you may store PHI. Some also print a dollar figure for the HIPAA add-on. Supabase publishes no such figure anywhere we could find, so every number in circulation comes from somewhere other than Supabase.
- Compliance-software blogs that quote supabase.com/security without opening the HIPAA Projects docs page
- Round-ups that print a dollar figure for the add-on price - Supabase publishes none
What the vendor's own documentation says
The docs add a second requirement the security page leaves out. HIPAA Projects: "Organizations must have a signed BAA with Supabase and have the Health Insurance Portability and Accountability Act (HIPAA) add-on enabled when dealing with PHI." The Shared Responsibility Model adds the plan floor: "You will need to be at least on the Team Plan to sign a BAA with us."
How we resolve it
Both pages are Supabase's own words, and the docs are the operative ones. Read together, the requirement is a plan of Team or above, a signed BAA, and the paid add-on switched on. If you signed a BAA and never enabled the add-on, you have met one of the two conditions the HIPAA Projects page sets out - and the Team plan floor sits underneath both of them. The cheapest way to tell which side of the line you are on is your invoice: Supabase's billing docs list "the fee for HIPAA" as an example of a line item, so if the add-on is on, it is on the bill.
Where PHI actually leaks in a Supabase project - six checks you run in your own dashboard
Tables with no Row Level Security policy
HighSupabase exposes your tables through an auto-generated API. A table holding patient records but no RLS policy is readable by anything that holds the project's public key - and that key is in your app's frontend by design. This is the most common finding in the AI-generated Supabase apps we open, because the builder creates the table and moves on before anyone writes the policy.
How to check
Dashboard, Table Editor. Look down the table list for anything marked unrestricted, then cross-check every table that holds names, dates of birth, diagnoses, or notes.
Postgres connection logging turned off
MediumSupabase's HIPAA docs state that log_connections is off by default for new projects, and that HIPAA and high-compliance projects should keep connection logging enabled. If your project was created and never touched, there is no record of who connected to the database or when. We have not found a competing write-up on Supabase and HIPAA that mentions it, which may be why it is so rarely switched on in the projects we open.
How to check
Dashboard, Advisors, Security tab. Supabase's Security Advisor raises a warning when connection logging is disabled - if the warning is there, it is off.
Storage buckets left public
HighA public bucket serves its files over a URL that needs no login. Intake photos, scanned insurance cards, uploaded PDFs and lab results all land in Storage in a typical patient-facing app, and a public bucket puts each one behind a guessable or shareable link.
How to check
Dashboard, Storage, Buckets. Every bucket shows whether it is public. Open one file's URL in a private browser window - if it loads while you are logged out, it is open to the internet.
Edge Function logs and console output
MediumWhatever a function prints while it runs is retained in the project's logs. A debug line that dumps a request body during development quietly copies whole patient records into a log stream that sits outside your database controls and outside your RLS policies.
How to check
Dashboard, Logs, Edge Functions. Search the last few days for a real patient's last name, or for a field name like diagnosis or dob. If it comes back with hits, PHI is in your logs.
The project's public API key shipped in your frontend
HighEvery Supabase browser app carries the project URL and the public key in its bundle. That is how the client library is meant to work, so the key is not the problem - the problem is that it defines your real attack surface. Anything reachable with that key is reachable by any visitor who opens developer tools, so your RLS policies are the only thing standing between the public and the table.
How to check
Open your live app, view page source or the network tab, and find the project URL and key. Then ask, for each table holding PHI: what would that key return if someone called it directly?
A second project holding a copy of the real data
HighThe BAA and the add-on apply to what you signed and enabled. The staging project someone spun up last spring, the demo copy made for an investor call, the prototype that came before the rewrite - each is a separate project, and each may hold a dump of production data that no agreement covers.
How to check
Dashboard, project list. For each project, open the Table Editor and look at ten rows of the largest table. You are looking for real names rather than test data.
Six things you can check before you call anyone
All six are yes-or-no and answerable from your Supabase dashboard and your billing email in about five minutes. Do them first. If they all come back clean, you do not need us.
01Is your Supabase organization on the Team plan or above?
02Do you have a copy of a BAA signed by Supabase that you could find in under a minute?
03Does your most recent Supabase invoice show a line item for HIPAA?
04In Advisors, Security tab, is there a warning that connection logging is disabled?
05In the Table Editor, does any table containing patient data show as unrestricted or have no policies listed?
06Do you have any other Supabase project - staging, demo, an abandoned prototype - that contains a copy of real patient data?
What we do about it
Typical range
$13,000–$25,000
Typical timeline
6–10 weeks
- 01
Evidence pass
3-5 daysA one-page inventory of every table, storage bucket, Edge Function and log stream that currently touches patient data, each recorded with the dashboard screen it was found on so your team can re-check it without us.
- 02
Contract and plan footing
1-2 weeks, plus Supabase's own turnaroundThe organization on Team or above, the HIPAA add-on enabled, the signed BAA filed where your team can find it, and a HIPAA line visible on the invoice. If you would rather do this part yourself, say so and we will skip it - Supabase's turnaround sets the pace either way.
- 03
Access boundary
2-3 weeksAn RLS policy on every table holding PHI, storage buckets made private with signed-URL access, and a written table showing which role can read which column.
- 04
Logging and recovery
1-2 weeksConnection logging on and the Security Advisor warning cleared, PHI stripped out of Edge Function logs, point-in-time recovery configured, and a written retention window.
- 05
Non-production cleanup
3-5 daysStaging, preview and prototype projects rebuilt on synthetic data, the real-data copies deleted, and the deletions recorded with dates.
- 06
Handover
3-5 daysA control map listing each requirement, where it lives in your project, and the exact dashboard screen your team re-checks it on, plus a recorded walkthrough so the next developer inherits it.
What moves the number
- How many tables and buckets actually hold PHI - ten is a different job from ninety.
- Whether real data has already spread into staging, preview or demo projects, and how many copies exist.
- Whether Edge Functions log request bodies, and how far back the logs go.
- Whether the app already has working authentication or whether roles have to be built before policies can reference them.
- Whether other vendors in your stack - hosting, email, analytics, LLM APIs - also need their own agreements. That work sits outside Supabase and outside this range.
When not to hire us
- You are still building on synthetic data. Nothing on this page applies until real patient information exists, and a prototype on fake records needs none of it.
- All you actually need is the BAA and the add-on. That is a self-serve path through your own dashboard and your account contact. Paying an agency to fill in a form is a waste of your money.
- Your gap is RLS on a handful of tables and nothing else. Our free Supabase guides walk through policies step by step - work through those first and see what is genuinely left over.
- You are looking for a certificate of compliance. No such thing exists for HIPAA - there is no government certification, only a signed BAA with each vendor that touches PHI and the controls you run on your own side. Anyone selling you a certificate is selling you a PDF.
- Your budget is below $13K. We would rather tell you that on this page than three calls in.
Worth knowing either way
There is no government HIPAA certification
No authority certifies software as HIPAA-compliant. What exists is a signed Business Associate Agreement with every vendor that touches protected health information, plus the administrative, physical and technical safeguards you implement and document yourself.
SOC 2 is not a substitute for a BAA
Supabase states it plainly in its own documentation: “SOC 2 does not cover, nor is it a substitute for, compliance with the Health Insurance Portability and Accountability Act (HIPAA).” The same holds for every vendor here.
An absence of documentation is not a vendor promise
Several answers here rest on what vendor documents do not say. We name which documents we read and when. A vendor that has never published a HIPAA position may still decline to sign, and one that publishes nothing today may publish something next quarter.
The same question, for the other fifteen tools
Firebase
NoOnly the Google Cloud equivalents are covered — no Firebase-branded service is
Supabase
Yes, with conditionsBAA plus a paid HIPAA add-on, on the Team plan or above
v0 by Vercel
PartiallyVercel hosting is covered; v0 itself is contractually off-limits for PHI
Lovable
NoIts terms prohibit uploading protected health information
Bubble
NoIts own documentation says apps built on Bubble won't achieve compliance
Replit
NoIts Terms, Commercial Agreement and DPA carry no HIPAA or BAA terms
Bolt.new
NoNo BAA in the StackBlitz and Bolt documents we read; HIPAA is named only for self-hosted
FlutterFlow
NoIts terms bar processing HIPAA-protected data outright
Claude Code
Yes, with conditionsCovered only with zero data retention, on accounts Anthropic qualifies
Codex
Yes, with conditionsCodex Local on a Regulated or Healthcare tier; Codex Cloud is excluded
Cursor
Yes, with conditionsEnterprise only, with Privacy Mode locked organisation-wide
GitHub Copilot
NoNo BAA offered; the Data Protection Agreement tells customers not to send PHI
Devin
NoPHI is Prohibited Data under the acceptable-use policy
Hermes Agent
Not the right questionSelf-hosted — the agreement you need is with your model provider
OpenClaw
Not the right questionSelf-hosted — but the vendor-run router still receives prompts
Base44
NoNo BAA; its terms ask customers to keep PHI off the platform
Sources, quoted verbatim
Every quote below is copied character-for-character from the source named. One - the pricing tooltip - is read from the pricing table's markup rather than from rendered body text, and is labelled as such. Supabase's documentation pages carry no human-visible revision date, so we print the date of our own check instead of inventing one.
A signed BAA and an enabled HIPAA add-on are both required when dealing with PHI
Organizations must have a signed BAA with Supabase and have the Health Insurance Portability and Accountability Act (HIPAA) add-on enabled when dealing with PHI.
Supabase Docs - HIPAA ProjectsSource dated: not shown (the page prints no revision date; its article:modified_time is a site build stamp, not a content date)Checked: August 2026Team is the minimum plan on which a BAA can be signed
You will need to be at least on the Team Plan to sign a BAA with us.
The add-on is paid and gated to Team and above, and Supabase publishes no price for it
Available as a paid add-on on Team Plan and above.
Supabase Pricing - HIPAA row tooltip (pricing-table markup)Source dated: not shownChecked: August 2026A HIPAA fee appears as a line item on the Supabase invoice
Examples are the subscription fee, the fee for HIPAA and for priority support.
Supabase states that its SOC 2 report is not a substitute for HIPAA compliance
SOC 2 does not cover, nor is it a substitute for, compliance with the Health Insurance Portability and Accountability Act (HIPAA).
Connection logging is off by default on new projects and should be enabled on HIPAA projects
Supabase sets Postgres log_connections to off by default for new projects. HIPAA and high-compliance projects should keep connection logging enabled. The Security Advisor warns if it is disabled.
The marketing page states the BAA condition but not the add-on condition
Supabase is HIPAA compliant. You can store Protected Health Information (PHI) on our hosted platform once you enter into a Business Associate Agreement (BAA) with us and fulfill your HIPAA obligations under our shared responsibility model.
Frequently asked questions
We're on Supabase Pro already. Doesn't that cover us?
No. Supabase's Shared Responsibility Model says you need to be at least on the Team Plan to sign a BAA, and its HIPAA Projects page says the add-on has to be enabled on top of that. Pro is a paid plan, but it is below the floor for the BAA, so neither condition is met.
How much does the HIPAA add-on cost?
Supabase does not publish a price. The HIPAA row on the pricing page carries no figure, and the tooltip only says "Available as a paid add-on on Team Plan and above." You have to ask Supabase directly. Ignore any dollar figure quoted online as the add-on price - none of them come from Supabase, which publishes no figure for the add-on anywhere. What is confirmed is that a fee exists: Supabase's billing docs list "the fee for HIPAA" as an example invoice line item.
Supabase has SOC 2. Isn't that basically the same thing?
Supabase answers this itself, in its own documentation: "SOC 2 does not cover, nor is it a substitute for, compliance with the Health Insurance Portability and Accountability Act (HIPAA)." They are separate frameworks. A SOC 2 report tells you a vendor's controls were examined; it does not create the business associate relationship a BAA creates.
Do we have to move off Supabase?
Nothing in Supabase's documents says you must. Its HIPAA Projects page describes storing PHI on the hosted platform under a signed BAA with the add-on enabled, which is the opposite of a prohibition - and it is what separates Supabase from several of the AI builders sitting above it in these stacks. Whether your particular system meets HIPAA depends on the whole system and your own processes, not on the database alone.
Our app was generated by an AI builder on top of Supabase. Does that change the answer?
The Supabase side is unchanged - same plan, same BAA, same add-on. What changes is everything around it. Generated apps regularly create tables without RLS policies and leave debug logging in Edge Functions, which is why the checks above are worth running rather than assuming. Separately, any patient information pasted into a builder's chat window has left Supabase's scope entirely and falls under whatever agreement you have with that tool. We cover those tools on their own pages.
We set all this up over a year ago. Is there anything that quietly drifts?
Two things worth re-checking. Connection logging is off by default on new projects, so any project created after your original setup starts without it - and Supabase's Security Advisor will be showing a warning if it is disabled. And RLS drifts with the schema: every table added after the original review starts life without a policy. Open Advisors and the Table Editor after each schema change rather than once a year.
This page reports what Supabase's own documents said when we checked them in August 2026; it is technical information rather than legal advice, HIPAA compliance is a property of your entire system and processes rather than of any single tool, and vendor terms change - verify the current terms with Supabase and confirm your own position with a qualified healthcare-privacy attorney before relying on any of it.
