# Is Supabase HIPAA Compliant? Yes, Under Three Conditions - Tool: Compliance - Last updated: August 2026 ## TL;DR Yes, conditionally. Supabase will sign a BAA and allow Protected Health Information on its hosted platform, but only with the paid HIPAA add-on enabled and a plan of Team or above. Its marketing page mentions the BAA and omits the add-on. Bringing an existing AI-built Supabase app onto that footing typically runs $13K–$25K over 6–10 weeks. ## Frequently asked questions ### We're on Supabase Pro already. Doesn't that cover us? No. Supabase's Shared Responsibility Model says you need to be at least on the Team Plan to sign a BAA, and its HIPAA Projects page says the add-on has to be enabled on top of that. Pro is a paid plan, but it is below the floor for the BAA, so neither condition is met. ### How much does the HIPAA add-on cost? Supabase does not publish a price. The HIPAA row on the pricing page carries no figure, and the tooltip only says "Available as a paid add-on on Team Plan and above." You have to ask Supabase directly. Ignore any dollar figure quoted online as the add-on price - none of them come from Supabase, which publishes no figure for the add-on anywhere. What is confirmed is that a fee exists: Supabase's billing docs list "the fee for HIPAA" as an example invoice line item. ### Supabase has SOC 2. Isn't that basically the same thing? Supabase answers this itself, in its own documentation: "SOC 2 does not cover, nor is it a substitute for, compliance with the Health Insurance Portability and Accountability Act (HIPAA)." They are separate frameworks. A SOC 2 report tells you a vendor's controls were examined; it does not create the business associate relationship a BAA creates. ### Do we have to move off Supabase? Nothing in Supabase's documents says you must. Its HIPAA Projects page describes storing PHI on the hosted platform under a signed BAA with the add-on enabled, which is the opposite of a prohibition - and it is what separates Supabase from several of the AI builders sitting above it in these stacks. Whether your particular system meets HIPAA depends on the whole system and your own processes, not on the database alone. ### Our app was generated by an AI builder on top of Supabase. Does that change the answer? The Supabase side is unchanged - same plan, same BAA, same add-on. What changes is everything around it. Generated apps regularly create tables without RLS policies and leave debug logging in Edge Functions, which is why the checks above are worth running rather than assuming. Separately, any patient information pasted into a builder's chat window has left Supabase's scope entirely and falls under whatever agreement you have with that tool. We cover those tools on their own pages. ### We set all this up over a year ago. Is there anything that quietly drifts? Two things worth re-checking. Connection logging is off by default on new projects, so any project created after your original setup starts without it - and Supabase's Security Advisor will be showing a warning if it is disabled. And RLS drifts with the schema: every table added after the original review starts life without a policy. Open Advisors and the Table Editor after each schema change rather than once a year. --- Source: https://www.rapidevelopers.com/compliance/is-supabase-hipaa-compliant © RapidDev — https://www.rapidevelopers.com/compliance/is-supabase-hipaa-compliant