Supabase provides what GDPR Article 28 requires of a processor: a data processing addendum at supabase.com/legal/dpa that binds when you accept the terms, a published subprocessor list, and Standard Contractual Clauses covering transfers. That makes Supabase usable inside a compliant product. It does not make your product compliant, because most of what a regulator would ask about is your configuration rather than theirs.
This article covers where the addendum lives and whether you need to sign anything, what role Supabase occupies in your data chain, how its subprocessor notifications and region controls actually behave, the deletion and retention terms you inherit, and the obligations that stay with you regardless.
Where The DPA Is, And Whether You Have To Sign It
The addendum sits at https://supabase.com/legal/dpa. The version published when we checked, on 7 August 2026, is marked Version 1, dated 1 August 2026. Every clause cited below is from that version — a processor's terms are a moving target, so check the version number against your own records rather than assuming this article is current.
You do not sign it separately. Clause 12.2 states that accepting the agreement has the same effect as signing the Standard Contractual Clauses, which means your existing acceptance of Supabase's terms carries the Article 28 contract with it. This is normal for self-serve infrastructure and it is legally sufficient, but it has a practical consequence: there is no countersigned PDF sitting in your files. When a customer's security reviewer asks for your DPA with Supabase, you are pointing at a public page and a date, not producing a signed document. Screenshot the version and date, and record them in your processor inventory.
One detail worth noticing, because it is unusual. The contracting entity is Supabase Pte. Ltd, registered in Singapore, and it is Supabase Pte. Ltd that is named as the data importer under the Clauses. The addendum sets Irish law as governing law and the courts of Ireland as the forum. If you had assumed you were contracting with a US company under a US framework, you were not.
What Supabase Is In Your Data Chain
Clause 2 puts it plainly. Supabase is the processor, you are the controller. If you are yourself processing on behalf of your own customers, Supabase steps down a rung and acts as your subprocessor.
That second case is the one small SaaS teams get wrong. If you sell to businesses and your customers' end users are the people whose data lands in your Postgres tables, then your customers are controllers, you are their processor, and Supabase is a subprocessor you have engaged on their behalf. Your customers are entitled to know that. Supabase appearing on your own published subprocessor list is not a courtesy; it is the disclosure that makes your chain legible. Our guide to subprocessors under GDPR covers what that list needs to contain.
The addendum also constrains Supabase in ways worth quoting in a security questionnaire. Clause 3.3 prohibits it from selling your data, from sharing it for cross-context behavioural advertising, and from combining it with personal data it holds from other sources.
Subprocessors And Where Your Data Actually Sits
Supabase publishes its subprocessor list at https://supabase.com/legal/customer-resources/subprocessor-list as a dated PDF. The version live on 7 August 2026 was dated 1 June 2026.
The notification mechanism has a catch that matters. Under clause 6.3, Supabase gives at least thirty days' notice of a proposed subprocessor change — but only to customers who have subscribed to the notification form on that page. Subscribing is a thirty-second job and almost nobody does it. If you have not, the list changes and you find out when you next look. Your objection window is five days from notice, after which the parties work toward a resolution for up to thirty days, and if none is reached you may terminate the affected portion of the agreement.
On location, clause 6.1 says Supabase may process data anywhere it or its subprocessors maintain facilities. Where you direct a specific geographical region, it will store and primarily process the data in that region. Read the qualifier. Choosing an EU region at project creation is the right move if you have EU users, and it is meaningful, but "primarily" is not "exclusively" — the clause preserves room for processing elsewhere where needed to deliver the service or follow your other instructions. If a customer asks you to warrant that no data ever leaves the EEA, that is a warranty you cannot give on the strength of this clause alone.
Deletion, Retention And Breach Terms You Inherit
Three terms are worth knowing before someone asks.
On deletion, clause 11.2 gives you a thirty-day retention period after the agreement expires, during which you may request a copy of your data or export it yourself. After that window, Supabase deletes all copies held by it and its subprocessors. Thirty days is short if the person who knew about the export left.
On breach, clause 10 commits Supabase to notifying you without undue delay and, where feasible, within forty-eight hours of becoming aware of a security incident. That is faster than the standard requires of it and slower than the seventy-two hours you get for notifying a supervisory authority — so your own clock is already running when theirs stops.
On audit, clause 9.2 lets Supabase satisfy most diligence requests with certifications rather than a site visit. Its footer advertises SOC 2 Type 2, ISO 27001 and HIPAA. A physical audit is available at most once per calendar year, on thirty days' notice, at your expense.
One restriction to catch early: under Schedule 3, you may not submit data that would count as protected health information under HIPAA without first signing a separate business associate agreement with Supabase.
What Is Still Entirely Yours
Nothing above touches the questions a regulator would actually put to you.
Supabase does not decide your lawful basis, and Row Level Security policies are not a lawful basis — they are a security control. It does not set your retention periods. Schedule 3 records the retention period as the duration of your agreement unless you request earlier deletion, so nothing ages out on its own — the deleting is yours to do. It does not answer data subject requests. Under clause 7, if a data subject contacts Supabase directly, Supabase will forward the request to you and tell the person it has done so, and nothing further. Building the export and deletion paths across your tables, your storage buckets, your auth records and your logs is your engineering work.
It also does not write your Article 30 record. Supabase belongs in that record as a named processor with a purpose, a location and a retention period beside it, and keeping your record of processing activities current is a controller obligation no vendor discharges for you.
Common Mistakes When Relying On Supabase For GDPR
Treating the click-through addendum as nothing. It is a real Article 28 contract and it is enough. The failure is not signing it — it is having no record of which version you accepted when a reviewer asks.
Never subscribing to subprocessor notifications. Thirty days' notice is contractual but conditional. Without subscribing, the change happens and you learn about it later, which is exactly the gap your own customers will ask you about.
Reading region selection as a residency guarantee. The clause promises storage and primary processing in your chosen region. Warranting more than that to a customer puts you on the hook for a commitment your processor never made.
Assuming a Singapore entity is a US entity. The importer is Supabase Pte. Ltd, under Irish governing law. Any transfer impact assessment you write against the wrong jurisdiction is wasted work.
Believing deletion in your app equals deletion at rest. Soft deletes leave rows in place, and Supabase takes daily backups by default. A deletion path that ignores backups and logs is not an erasure path. Read our guide to data processing agreements for what the contract does and does not cover here.
FAQ
Does Supabase sign a DPA?
Not individually. Its data processing addendum is published at supabase.com/legal/dpa and takes effect when you accept Supabase's terms, with clause 12.2 confirming that acceptance carries the same effect as signing the Standard Contractual Clauses. Because nothing is countersigned, record the version number and the date you accepted it.
Where does Supabase store my data?
Its addendum permits processing anywhere Supabase or its subprocessors maintain facilities, and commits to storing and primarily processing in a specific region where you direct one. You choose a region when you create a project. Treat that as a strong default rather than an absolute guarantee of EEA-only processing.
Does Supabase use Standard Contractual Clauses?
Yes. Its addendum incorporates the EU Clauses from Commission Implementing Decision (EU) 2021/914, applying Module Two where you are a controller and Module Three where you are a processor, along with the UK International Data Transfer Addendum and a Swiss addendum naming the FDPIC as supervisory authority.
Who handles a deletion request from one of my users?
You do. Supabase forwards any request it receives to you and confirms to the data subject only that it has been forwarded. Building deletion across your tables, storage, auth records and backups is your work, and the thirty-day post-termination window is for your own data, not your users' requests.
Closing Thought
The interesting thing about reading a processor's addendum properly is how much of it turns out to be about you. Four clauses in, the document stops describing what Supabase will do and starts describing what it assumes you have already decided — your lawful basis, your retention periods, your consent for anything sensitive, your handling of requests. The vendor's contract is a mirror. Most teams read it looking for reassurance and find a task list.
That task list is also what your own customers will send you, in the form of a questionnaire, roughly one enterprise deal from now. ComplyDog hosts a compliance portal on your own domain carrying your DPA, your subprocessor list — Supabase included — your data subject request intake and your security page. It will not choose your lawful basis or write your deletion job. It will mean that when a buyer asks who processes their data and where, you send a link rather than starting a document.
