Is Supabase HIPAA Compliant? Which Plan, the BAA, and What It Costs in 2026

TL;DR: Yes, with conditions. As of November 2026, Supabase will sign a HIPAA Business Associate Agreement (BAA) and let you store patient data on its hosted platform, but only on the Team plan ($599 a month) or Enterprise, and only with its paid HIPAA add-on, whose price Supabase doesn't publish. Free and Pro can't get a BAA at all. Add the Point-in-Time Recovery that HIPAA projects must turn on, about $100 a month, and the floor is near $700 a month before the add-on quote.

I've been a CTO at an AI startup and shipped 50+ products, and the question I keep seeing is from founders building a health app on Lovable or Bolt with Supabase underneath: "is this HIPAA compliant?" The answer that ranks today, "yes, Team plan, $600 a month, BAA included," is wrong twice. The BAA comes with a separate add-on, and $599 is the plan before the extras HIPAA requires.

Is Supabase HIPAA compliant? What "yes" actually means

Same rule as every post in this series: no software is HIPAA compliant by itself. HIPAA compliance for a vendor means it signs a BAA, a contract saying it will safeguard protected health information (PHI) it handles for you. I walk through that idea for AI tools in HIPAA compliant AI.

Supabase signs one. Its security page says: "You can store Protected Health Information (PHI) on our hosted platform once you enter into a Business Associate Agreement (BAA) with us and fulfill your HIPAA obligations under our shared responsibility model." Its docs add the second gate: organizations "must have a signed BAA with Supabase and have the HIPAA add-on enabled when dealing with PHI." Supabase also has its own BAAs with the vendors that touch your data, such as AWS, and audits its HIPAA controls every year alongside SOC 2.

So Supabase is a real option for health apps, which is more than some tools in this series can say. The "yes" just starts at a specific plan.

Supabase plans vs HIPAA

Supabase's shared responsibility model says it directly: "You will need to be at least on the Team Plan to sign a BAA with us." Team and Enterprise customers request the BAA from the dashboard and submit a HIPAA add-on request through Supabase's form.

What Supabase HIPAA really costs per month

Here's the math with only the numbers Supabase publishes, read from supabase.com/pricing on November 3, 2026:

Longer retention costs more: 14 days of PITR is about $200 a month and 28 days about $400. For comparison, a non-HIPAA app on Pro starts at $25. If you're a two-person health startup, that jump is the real decision, and it's worth making before you've built on Pro for six months. The platform security side, including how Row Level Security works, is in is Supabase secure.

How the BAA and the shared responsibility split work

A BAA is a contract about who does what. Supabase's half: it acts as your business associate, safeguards the PHI it stores, reports breaches to you, keeps BAAs with its own vendors, and runs ongoing checks so HIPAA settings aren't quietly turned off between audits. Once your organization has the add-on, you can mark a project High Compliance in its General settings, and Supabase starts checking that project continuously. Anything out of line shows up as a warning in the Security Advisor.

Your half is longer, and Supabase lists it. The BAA doesn't switch any of it on. The advisor warns you; fixing the warning is yours. And none of the platform settings decide which user can see which patient's record. That's Row Level Security, the rules on each table, and it's the same RLS that leaks data on ordinary vibe-coded apps. A HIPAA project with an RLS policy that lets everyone read everything is a breach with a signed contract attached.

Every HIPAA requirement, and who owns it

The Lovable and Bolt trap

The person searching this most often, judging by the threads ranking for it, is building a telehealth or patient app with an AI builder. Three things catch them.

The plan. Builders spin up a Supabase project on Free or Pro, where a BAA doesn't exist. Test data is fine there. Real patient data is not.

Whose account it is. The BAA gets signed by the organization that owns the database. If your builder created and hosts the database and you've never logged into that Supabase organization, you can't upgrade it or sign anything. Ask the builder in writing whether it signs a BAA for your data, and get the answer before launch.

The rules. AI-generated apps often ship with tables where RLS is off or policies let anyone read. Supabase's own advisor calls a table with RLS off "Table publicly accessible." On a health app, that's every patient record.

What to do today

Open your Supabase dashboard and check two things. First, the plan name on your organization's Billing page: if it says Free or Pro, no PHI goes in until you're on Team with the add-on. Second, Advisors, then Security Advisor: every "Table publicly accessible" error is a table anyone could read. Then work through RLS and keys with my free vibe coding security checklist, which covers 20 checks.

This is a technology explainer, not legal advice. HIPAA turns on your workflows and your risk analysis, so take the table above to your compliance counsel. If you want help deciding whether to move to Team now, stay off PHI for the MVP, or pick a different backend, book a free strategy call. The same contract-first read for AI tools is in is Claude HIPAA compliant.

Sources

• Supabase, Security: HIPAA statement, BAA request for Team and Enterprise, SOC 2 Type 2, ISO 27001, encryption. Read November 3, 2026.
• Supabase Docs, HIPAA Projects (updated October 30, 2026): BAA plus add-on required, High Compliance projects, required settings. Read November 3, 2026.
• Supabase Docs, Shared responsibility model, Managing healthcare data: Team plan minimum and the full customer list. Read November 3, 2026.
• Supabase Docs, HIPAA compliance and Supabase: business associate role, vendor BAAs, annual audits. Read November 3, 2026.
• Supabase pricing: Free, Pro $25, Team $599, Enterprise; HIPAA as a paid add-on on Team and Enterprise; $10 compute credits. Read November 3, 2026.
• Supabase Docs, Point-in-Time Recovery usage: ~$100, ~$200, ~$400 a month for 7, 14, 28 days. Read November 3, 2026.
• Supabase Docs, Security Advisor lint 0013: "Table publicly accessible". Read November 3, 2026.