Conditional A BAA is available on the Team and Enterprise plans, and only for projects with the paid HIPAA add-on enabled; the Free and Pro plans, and any project without the add-on, are excluded. Verified 2026-10-28.
Short answer
Supabase signs a BAA only on request. You submit its HIPAA request form, sign the BAA, and enable the paid HIPAA add-on on each project that will hold PHI. Supabase does not publish the add-on price. Free and Pro have no BAA.
Team is the lowest plan with a BAA, starting at $599/month plus the add-on. For other tools, see All vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | No | Not applicable | Not applicable |
| Pro | No | Not applicable | Not applicable |
| Team | Yes, with the HIPAA add-on | Request through the Supabase HIPAA form, sign the BAA, enable the add-on | HIPAA add-on: not published by the vendor |
| Enterprise | Yes, with the HIPAA add-on | Request through the Supabase HIPAA form, sign the BAA, enable the add-on | HIPAA add-on: not published by the vendor |
The pricing page lists HIPAA as a paid add-on, not as part of the Team price.
What the BAA covers and what it excludes
Covered
- Hosted Supabase platform projects with the HIPAA add-on enabled, under a signed BAA.
Excluded
- Projects on the Free plan.
- Projects on the Pro plan.
- Any project without the HIPAA add-on enabled, including on Team or Enterprise.
The last exclusion matters in practice. A clinic software vendor might run a production project and a staging project under one Team organization. Signing the BAA does not extend coverage to a project where the add-on is off. Supabase's HIPAA Projects page states: "Organizations must have a signed BAA with Supabase."
Supabase describes its role toward customers that are covered entities as that of a business associate:.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
Per Supabase's SOC 2 page, the SOC 2 Type 2 report is available to Team and Enterprise customers. A security officer who needs the encryption details above should ask Supabase for them in writing before approving PHI use.
How to use Supabase with PHI
The BAA is one piece of the arrangement. Responsibility is shared:
- Sign the BAA before any PHI enters Supabase.
- Enable the HIPAA add-on on every project that will hold PHI.
- Keep PHI out of Free and Pro projects and out of any project without the add-on, including test data copied from a patient intake system.
- Configure access for your team and use SSO.
- Review the audit log on a schedule your policy defines.
- Train staff and write policies covering who may access PHI and how offboarding works.
- Cover any third-party service connected to a project, such as an analytics tool, an email sender or an automation platform, with its own BAA. Supabase's BAA does not extend to them.
Compliance depends on the signed BAA, your configuration and your organization's own policies. For terms such as business associate, see the HIPAA glossary.
Alternatives with a BAA
Verdicts follow each vendor's own page on this site and rest on that vendor's published BAA terms. The list is not ranked.
- AWS: conditional. Is AWS HIPAA compliant?
- Microsoft Azure: conditional. Is Microsoft Azure HIPAA compliant?
- Firebase: conditional. Is Firebase HIPAA compliant?
- Google Cloud Platform: yes. Is Google Cloud HIPAA compliant?
- Heroku: conditional. Is Heroku HIPAA compliant?
More options are in HIPAA-compliant software development tools.
Sources
- Supabase Pricing — Pricing page, checked 2026-10-28. "HIPAA available as paid add-on"
- HIPAA Projects — Help article, checked 2026-10-28. "Organizations must have a signed BAA with Supabase."
- HIPAA Compliance and Supabase — Trust center, checked 2026-10-28. "Supabase acts as a business associate for customers (the covered entity) who wish to provide healthcare related services."
- SOC 2 Compliance and Supabase — Trust center, checked 2026-10-28. "Supabase makes the SOC 2 Type 2 report available to Enterprise and Team Plan customers."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification on 2026-10-28.
Does Supabase sign a BAA on the Free or Pro plan?
No. A BAA is available only on the Team and Enterprise plans. Do not store PHI in Free or Pro projects.
How do I get a BAA from Supabase?
Submit Supabase's HIPAA request form, sign the BAA, and enable the paid HIPAA add-on on the projects that will hold PHI.
Is the HIPAA add-on included in the Team plan price?
No. The pricing page lists HIPAA as a paid add-on. The add-on price is not published by the vendor. Team starts at $599/month.
Does a BAA cover every Supabase project in my organization?
No. The BAA applies to projects with the HIPAA add-on enabled. A project without the add-on is outside it, even in an organization that has signed the BAA.