Supabase: DPA, subprocessors and data location
Where to find the Supabase DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: database hosting and authentication. The table is the short version; the sections below add detail.
Supabase at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | |
| Objection window and remedy | Window: 5 days Details on objecting |
| Data regions |
You can choose the region. |
| Transfer mechanism |
|
| Vendor role | Processor: it handles your customers' data on your instructions. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Supabase
The DPA forms part of the Agreement (Terms of Service), and the page describes no separate signature step. It names Supabase Pte. Ltd. as the contracting entity.
The subprocessor list is published as dated PDFs; the newest one we saw is dated October 12, 2026. Subscribe through the form on that page if you want an email when it changes. The 30 days' notice of proposed changes applies only if you subscribe, and you then have 5 days to object (clause 6.3).
You choose the region per project, and it decides where primary project data is stored. The DPA says data is stored and primarily processed in the region you direct, subject to listed exceptions (clause 6.1).
Supabase DPA: where to find it and how it is accepted
Read the DPA on supabase.com. Forms part of the Agreement (Terms of Service); the page describes no separate signature step.
Source: supabase.com, checked 2026-10-16Not stated in the source we checked (2026-10-16).
The DPA applies to the Agreement and the text we read states no plan limits.
Source: supabase.com, checked 2026-10-16Supabase subprocessors: the list and how change notices reach you
Source: supabase.com, checked 2026-10-16How changes are announced: Email subscription form on the subprocessor list page.
Source: supabase.com, checked 2026-10-16Notice before a new subprocessor starts: 30 days.
Clause 6.3: at least 30 days' notice of proposed changes, but only if you subscribe to updates.
Source: supabase.com, checked 2026-10-16You can object within 5 days. The parties work in good faith toward a resolution. If there is none within a reasonable time of at most 30 days, you may terminate the part of the agreement for the affected services (clause 6.3).
Clause 6.3: you can object within 5 days after Supabase gives notice.
Source: supabase.com, checked 2026-10-16Source: supabase.com, checked 2026-10-16Where Supabase stores data
- EU (Ireland)
- EU (Paris)
- EU (Frankfurt)
- EU (Stockholm)
- UK (London)
- Switzerland (Zurich)
You can choose the region.
Each project is deployed to one primary region that you choose, and the docs say the region determines where primary project data is stored. Only the European regions are listed here; the docs page also lists regions in North America, Asia-Pacific and South America. The general "Europe" grouping includes London and Zurich, so the docs advise choosing a specific region. DPA clause 6.1: stored and primarily processed in the region you direct, subject to listed exceptions.
Source: supabase.com, checked 2026-10-16How Supabase moves data outside the EU and UK
- SCCs
- UK Addendum
- Swiss Addendum
Not stated in the source we checked (2026-10-17).
A search of the Data Privacy Framework participant list on 2026-10-17 returned no organisation under this name. That can also mean a different legal name, so we record no value; check the list yourself. The DPA does not mention the DPF either.
Source: www.dataprivacyframework.gov, checked 2026-10-17Is Supabase a processor or a controller?
Processor: it handles your customers' data on your instructions.
Clause 2 of the DPA: Supabase acts as processor (service provider) and you as controller. Where you act for your own controller, Supabase acts as a subprocessor.
Source: supabase.com, checked 2026-10-16Is Supabase GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Supabase's own documents say:
- A DPA is published: Forms part of the Agreement (Terms of Service); the page describes no separate signature step.
- A subprocessor list is published.
- Notice of new subprocessors: 30 days. Clause 6.3: at least 30 days' notice of proposed changes, but only if you subscribe to updates.
- Transfer mechanisms named: SCCs, UK Addendum, Swiss Addendum.
- Data locations named: EU (Ireland), EU (Paris), EU (Frankfurt), EU (Stockholm), UK (London), Switzerland (Zurich).
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Supabase to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Supabase, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Supabase | Database hosting and authentication | EU (Ireland); EU (Paris); EU (Frankfurt); EU (Stockholm); UK (London); Switzerland (Zurich) | SCCs; UK Addendum; Swiss Addendum | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Supabase | Database hosting and authentication | EU (Ireland); EU (Paris); EU (Frankfurt); EU (Stockholm); UK (London); Switzerland (Zurich) | SCCs; UK Addendum; Swiss Addendum | [DPA](https://supabase.com/legal/dpa) | [Subprocessors](https://supabase.com/legal/customer-resources/subprocessor-list) |
If you add or replace Supabase: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
Supabase states 30 days of notice before it adds a subprocessor. Clause 6.3: at least 30 days' notice of proposed changes, but only if you subscribe to updates. If your own customers were promised a longer notice, you have a gap to plan for.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- Searched the Data Privacy Framework list for "Supabase" (active and inactive): no organisation found. dpf_listed set to false.
- First check: facts recorded from Supabase's own pages.
- Re-checked the DPA (Version 1, August 1, 2026) and regions page; added the London and Zurich regions.
Related vendors
Sources and method
- https://supabase.com/legal/dpa checked 2026-10-16
- https://supabase.com/legal/customer-resources/subprocessor-list checked 2026-10-16
- https://supabase.com/docs/guides/platform/regions checked 2026-10-16
- https://www.dataprivacyframework.gov/list checked 2026-10-17
Facts come from Supabase's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: supabase.com.