Skip to main content
BAA Directory

Is Supabase HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, with its HIPAA add-on. Supabase signs a BAA with customers, and its pricing page offers HIPAA as an add-on on the Team and Enterprise plans.

Automation and workspace. Checked on the vendor's own pages on .

Using Supabase on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Supabase says

“If you want to start developing healthcare apps on Supabase, reach out to the Supabase team here to sign the Business Associate Agreement (BAA).”

Source: Supabase Docs, HIPAA Projects, checked .

“Organizations must have a signed BAA with Supabase and have the Health Insurance Portability and Accountability Act (HIPAA) add-on enabled when dealing with PHI.”

Source: Supabase Docs, HIPAA Projects, checked .

“Supabase acts as a business associate for customers (the covered entity) who wish to provide healthcare related services.”

Source: Supabase Docs, HIPAA Compliance and Supabase, checked .

What the BAA covers and excludes

Excludes or limits, in Supabase's words:

  • "These controls are not supported out of the box in self-hosted Supabase."

What this means for ad tracking

Supabase is a database platform for building apps, so in a healthcare app it can hold patient records. Supabase's pricing page lists HIPAA as an add-on on its Team and Enterprise plans (Supabase pricing). With the add-on enabled, projects can be configured as High Compliance, and Supabase then runs extra security checks against them (Supabase).

A BAA binds only the vendor that signs it. The ad pixels on your app's web pages send data to the ad platforms, and this directory lists Meta and Google Ads as not signing one. Our guides to HIPAA compliant website hosting and removing the Meta Pixel from a healthcare website cover the rest.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Supabase for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Supabase HIPAA compliant?

Yes, with its HIPAA add-on. Supabase signs a BAA with customers, and its pricing page offers HIPAA as an add-on on the Team and Enterprise plans. With a signed BAA, Supabase can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Supabase sign a BAA?

Yes. Supabase says “Organizations must have a signed BAA with Supabase and have the Health Insurance Portability and Accountability Act (HIPAA) add-on enabled when dealing with PHI” (Supabase). We checked Supabase's own pages on October 26, 2026.

Which Supabase plans support HIPAA?

Supabase's pricing page lists HIPAA as an add-on on the Team and Enterprise plans (Supabase pricing). To start, Supabase asks you to reach out to its team to sign the BAA (Supabase).

Is self-hosted Supabase HIPAA compliant?

Supabase says the hosted platform has the needed controls, and “These controls are not supported out of the box in self-hosted Supabase.” It calls HIPAA compliance with self-hosted Supabase out of scope for its documentation (Supabase).

What settings does a Supabase HIPAA project need?

Supabase lists Point in Time Recovery, SSL Enforcement, Network Restrictions and Postgres connection logging among the required settings for a High Compliance project (Supabase).

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Supabase before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call