Is supabase GDPR compliant?

[wottpal]

Wondering if I can already try supabase for a EU-based project?

[ChronSyn]

You can choose to have Supabase hosted in an EU region such as eu-west-1. I believe you'll be compliant if you host in one of those regions.

You'll have to employ the other aspects of GDPR for your specific project manually (e.g. setting up a way for a user to request their data, request deletion of their data under 'right to be forgotten'). Both of those could probably be handled with some stored procedures to make it easier from your side should they ever be needed.

[eosCorp]

Good point!

[Clobbe]

A very good point. I'm looking for the same option- preferably if it's possible to have the data center in Sweden 🇸🇪

[samuba]

I'm by no means an expert on this but as I understand this, everything that @ChronSyn said is necessary PLUS a "data processing agreement" with the Supabase company. See: https://gdpr.eu/what-is-data-processing-agreement/
Without those agreements it looks like using hosted supabase (with user identifiable data) is not legally possible within EU.
I want to build my german based business with supabase, so it is very important to sort this out:
Does Supabase do those data processing agreements with individuals/companies?

[deliqs]

Does Supabase actually process any of our data, or is Supabase just providing the tools/interfaces and is our data only processed/hosted by AWS?

[wottpal]

Thanks for taking your time @samuba to get feedback from the support about this. The supabase team really should release an ETA for those data processing agreements + GDPR-compliance. (FYI @kiwicopple)

[flowni]

Because I just had a similar question about their location/servers @deliqs. I asked the support and they replied
"The actual user data, such as your customers authentication data which you may have when you migrate over to Supabase is only stored and processed in your database instance which is in the location your specify for the project and is not transferred to other countries/jurisdictions."

As I was confused about the data privacy Section 5, this handles only MY personal data (email, payment, etc.) that I share with supabase (so not the actual user data):
"If you are located in the European Union or other regions with laws governing data collection and use that may differ from U.S. law, please note that your personal information may be transferred to a country and jurisdiction that does not have the same data protection laws as your jurisdiction. When you register for use with Supabase you have the option of where you store your information and we will not transfer it without providing information to you in advance." (https://supabase.com/privacy).

[koryonik]

@flowni same questions. Did you shed a light on those points?

[aragornii]

Any updates on this topic?

[andrashann]

This is not just a problem with EU-based projects. It is problematic with any EU user accessing a Supabase project, as data from those people is subject to GDPR, regardless of where the project (or the company) is based. If I understand this correctly, it is almost impossible to legally run a project on hosted Supabase (unless EU users are forbidden from accessing it).

[roryw10]

Hi Folks,

We do actually have a DPA now which we know is essential for folks who need GDPR compliance. This took a little bit of time, working with lawyers generally does. You can open a ticket in your dashboard to request it, or email support@supabase.io. We will get these documents on the site in future too :)

[samuel-bach]

The DPA is now also available by self service, so you do not need to write a ticket/email: https://supabase.com/legal/dpa

[simpros]

Hi, I have a question regarding Sub-Processors in the DPA I want to send my customers:

How do I have to address supabase? I am not sure if it is a problem that the office seems to be in Singapore 🤔 Legal stuff blows my head 😢

[LlorenteTabor]

We are based in Europe and our client demands that we use software and services that are certified with the newly approved Data Privace Framework Program. I can see that Supabase is not listed on the participant list: https://www.dataprivacyframework.gov/s/participant-search
After this became available in July it has become a critical requirement to live up to for US-based companies if you want business in Europe. Are you currently looking into joining the program and become certified or what is the outlook?

[yaselmane]

Are there any plans to provide an update on this issue? We are interested in using Supabase. But, as Orbitaloop mentioned, we will not be able to go wih it without the certification 😢

[roryw10]

Thanks for being patient on this one. As always we are not legal advisors so you should check your situation with your own legal counsel. That said, the Data Privacy Framework is not the only way for companies in the US to receive personal data from companies in Europe or the UK. The UK Information Commissioner’s Office has some useful step by step guidance on how to approach this: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/.

Like many companies outside the EU and UK that aren’t registered to the Data Privacy Framework (and US companies that were doing business in Europe or the UK before the DPF was approved), our DPA incorporates Standard Contractual Clauses approved for international transfers by the European Commission, as well as the UK addendum to the SCCs approved by the UK ICO. We also have a Transfer Impact Assessment y’all can use which should get you unblocked here!

[hamanuha]

Where can we find the TIA?

[koryonik]

@hamanuha you can found the TIA in project>organization>Legal Documents. But I don't understand why in TIA the legal name of data importer is Supabase Inc (in USA) and Supabase Pte. Ltd (the head quarter in Singapore) is listed as sub processor @roryw10 ...

[Startouf]

Hello, the Data Privacy Framework Program is becoming a reference for Lawyers in France. Although only time will tell if it will become invalidated like the Privacy Shield, being registered under this framework would be a great help.

[404apps]

Hi, I'm not familiar with GDPR requirements so couldn't really follow all the discussion.
I saw that there is the DPA from supabase mentioned that I can download and sign.
There is also the comment mentioned supabase is not on the Data Privacy Framework Program.

Does that mean I couldn't use supabase to store the European user data?
I would like to build a game which store user name, email and game scores into supabase. Is that legal if I select Europe server in supabase?

I believe I need to sign and send the DPA as mentioned in the supabase link. Also, I need to state the usage of supabase in the privacy policy and provide ways to remove and get user's data if they request to compliant to GDPR.
Is there anything else I need to do on supabase, like settings or conifg, on top of this? Thanks in advance!
cc @roryw10