--- title: Supabase is one part of your HIPAA compliance | daily.dev description: Supabase's platform covers encryption, the signed BAA and project settings, but your RLS policies, functions and audit tables remain your responsibility for a... canonical: https://daily.dev/posts/supabase-is-one-part-of-your-hipaa-compliance-gnjnxm6zy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Supabase is one part of your HIPAA compliance | daily.dev og:description: Supabase's platform covers encryption, the signed BAA and project settings, but your RLS policies, functions and audit tables remain your responsibility for a... og:url: https://daily.dev/posts/supabase-is-one-part-of-your-hipaa-compliance-gnjnxm6zy og:image: https://api.daily.dev/og/posts/gNjnXM6Zy.png og:image:alt: Supabase is one part of your HIPAA compliance og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Supabase is one part of your HIPAA compliance **[Planet PostgreSQL](https://daily.dev/sources/planet-postgresql)** · 5 min read · 0 upvotes · 0 comments ## Summary Supabase's platform covers encryption, the signed BAA and project settings, but your RLS policies, functions and audit tables remain your responsibility for a HIPAA review. The post maps these gaps to specific Security Rule sections: access control (164.312(a)(1)), audit controls (164.312(b)), integrity (164.312(c)(1)) and authentication (164.312(d)). It introduces a CLI tool, unitautogen hipaa, that runs against your local Supabase stack, tests which functions leak data across tenants, checks whether inserts/updates/deletes left an audit trail, and checks whether audit tables can be tampered with. It outputs an HTML/JSON report hashed with SHA-256, stored at supabase/tests/seccover/hipaa/public/. The tool is part of the Enterprise edition of UnitAutogen for PostgreSQL, with a startup rate and free trial available. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does Supabase's HIPAA compliance cover my row level security policies? No. Supabase's shared responsibility model covers encryption at rest and in transit, the signed BAA, and project settings like Point in Time Recovery, SSL enforcement and connection logging. It explicitly tells you to 'always apply Row Level Security (RLS)' yourself, leaving access rules on sensitive tables, your functions, and audit logging as your responsibility. _Teams proving HIPAA coverage on Supabase can track these shared-responsibility gaps via daily.dev._ ### How can I test whether a SECURITY DEFINER function in Postgres leaks data across tenants? Call the function as two different tenants with data on both sides and check whether it returns or exposes rows outside the caller's scope. Functions, views and triggers that run as their owner bypass row level security policies, so each one needs to be tested individually for holding or leaking data, along with checking row policies, column grants and whether error messages expose personal data. _Developers hardening multi-tenant Postgres access control follow tooling and techniques like this on daily.dev._ ### Which HIPAA Security Rule sections apply to database access control and audit logging? Access control falls under 164.312(a)(1), requiring access go 'only to those persons or software programs that have been granted access rights'. Audit controls are 164.312(b), integrity protecting data 'from improper alteration or destruction' is 164.312(c)(1), authentication is 164.312(d), and periodic evaluation is required under 164.308(a)(8). _Engineers mapping database controls to HIPAA requirements can keep up with guidance like this on daily.dev._ ## Similar posts on daily.dev - [Prepare for a HIPAA Audit Like It’s a Production Launch](https://daily.dev/posts/prepare-for-a-hipaa-audit-like-it-s-a-production-launch-lkcngb4up) · Atomic Spin · 0 upvotes · 0 comments - [The Default SaaS Starter Pack Is the Least Secure Way to Ship an App](https://daily.dev/posts/the-default-saas-starter-pack-is-the-least-secure-way-to-ship-an-app-w6mw2xewx) · Medium · 0 upvotes · 0 comments - [How to Implement HIPAA Technical Safeguards on AWS \[Full Handbook\]](https://daily.dev/posts/how-to-implement-hipaa-technical-safeguards-on-aws-full-handbook--kitnfdbrp) · freeCodeCamp · 2 upvotes · 0 comments - [Your Supabase Is Public](https://daily.dev/posts/your-supabase-is-public-btizbexg3) · Hacker News · 3 upvotes · 0 comments - [Supaguard : Scan, Detect & Protect Your Supabase Data](https://daily.dev/posts/supaguard-scan-detect-protect-your-supabase-data-6gz35nc3a) · Product Hunt · 0 upvotes · 0 comments --- Tags: [#postgresql](https://daily.dev/tags/postgresql), [#data-privacy](https://daily.dev/tags/data-privacy), [#compliance](https://daily.dev/tags/compliance), [#supabase](https://daily.dev/tags/supabase) [View this post on daily.dev](https://daily.dev/posts/supabase-is-one-part-of-your-hipaa-compliance-gnjnxm6zy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Supabase is one part of your HIPAA compliance","url":"https://daily.dev/posts/supabase-is-one-part-of-your-hipaa-compliance-gnjnxm6zy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/supabase-is-one-part-of-your-hipaa-compliance-gnjnxm6zy"},"datePublished":"2026-10-29T17:33:23.620Z","dateModified":"2026-10-29T17:43:21.419Z","description":"Supabase's platform covers encryption, the signed BAA and project settings, but your RLS policies, functions and audit tables remain your responsibility for a...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"Planet PostgreSQL","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Planet PostgreSQL","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/planet-postgresql"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/supabase-is-one-part-of-your-hipaa-compliance-gnjnxm6zy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"postgresql,data-privacy,compliance,supabase","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Planet PostgreSQL","item":"https://daily.dev/sources/planet-postgresql"},{"@type":"ListItem","position":3,"name":"Supabase is one part of your HIPAA compliance"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/supabase-is-one-part-of-your-hipaa-compliance-gnjnxm6zy#faq","mainEntity":[{"@type":"Question","name":"Does Supabase's HIPAA compliance cover my row level security policies?","acceptedAnswer":{"@type":"Answer","text":"No. Supabase's shared responsibility model covers encryption at rest and in transit, the signed BAA, and project settings like Point in Time Recovery, SSL enforcement and connection logging. It explicitly tells you to 'always apply Row Level Security (RLS)' yourself, leaving access rules on sensitive tables, your functions, and audit logging as your responsibility. Teams proving HIPAA coverage on Supabase can track these shared-responsibility gaps via daily.dev."}},{"@type":"Question","name":"How can I test whether a SECURITY DEFINER function in Postgres leaks data across tenants?","acceptedAnswer":{"@type":"Answer","text":"Call the function as two different tenants with data on both sides and check whether it returns or exposes rows outside the caller's scope. Functions, views and triggers that run as their owner bypass row level security policies, so each one needs to be tested individually for holding or leaking data, along with checking row policies, column grants and whether error messages expose personal data. Developers hardening multi-tenant Postgres access control follow tooling and techniques like this on daily.dev."}},{"@type":"Question","name":"Which HIPAA Security Rule sections apply to database access control and audit logging?","acceptedAnswer":{"@type":"Answer","text":"Access control falls under 164.312(a)(1), requiring access go 'only to those persons or software programs that have been granted access rights'. Audit controls are 164.312(b), integrity protecting data 'from improper alteration or destruction' is 164.312(c)(1), authentication is 164.312(d), and periodic evaluation is required under 164.308(a)(8). Engineers mapping database controls to HIPAA requirements can keep up with guidance like this on daily.dev."}}]} ```