Australian data residency – does Supabase Sydney cover Auth, backups and logs?

[LearningEFexHQ]

Hi everyone,

I am new to Supabase and am working on a SaaS application for Australian businesses and am considering Supabase Pro, with the project hosted in the Sydney (ap-southeast-2) region.

One of my requirements is that customer data must remain within Australia, including backups and logs containing customer information.

I understand that selecting Sydney determines where the primary database is hosted, but I'm trying to clarify whether this extends to all Supabase services and associated data.

Specifically, I'm hoping someone can help confirm:

1. Database and authentication: Are PostgreSQL data, Supabase Auth records and associated authentication information stored and processed within Australia?
2. Backups: Are automated database backups and any disaster-recovery copies stored exclusively within Australia?
3. Logs: Can application, database and authentication logs containing customer information be kept entirely within Australia?
4. Other processing: Are there any circumstances where customer data might be transferred, replicated, accessed or processed outside Australia, including by subprocessors or support personnel?
5. Formal confirmation: Has anyone obtained written confirmation from Supabase about these requirements, or can point me towards official documentation that addresses them?

I'm particularly interested in whether this is achievable on the Pro plan, or whether it requires an Enterprise arrangement.

I've already submitted a support enquiry, but with a free account I may not get an answer, so I thought I'd ask the community in case others have encountered similar Australian data-residency requirements.

I'm not looking for general GDPR compliance information. I'm specifically trying to establish whether Supabase can meet an Australian-only data residency requirement before committing to it for production.

Thanks in advance for any guidance!
Jayne,

[GaryAustin1]

The backups would stay in the same data center. Unless you generate logs with user info they would not be any in the logs (not sure the logs are regional or not as SB uses providers for log storage). Auth runs on your server instance with your database so that is fine also. Don't think there is other processing involving user data involved except s3 storage files which also should be in same data center.

No idea if Supabase has given formal notice of this or not and you won't likely get an official response here.

[LearningEFexHQ]

Thanks very much for your response. That's helpful and reassuring regarding the database, authentication and backups.
The uncertainty around log storage is particularly relevant to my requirements.

Do you happen to know whether Supabase offers any configuration options to ensure that logs containing personal or customer information remain within the selected region, or whether this is something that would need to be discussed directly with Supabase?

I'm also interested in whether anyone has obtained formal written confirmation of Australian-only data residency, including backups and any overseas support access.

Thanks again for taking the time to help!

[GaryAustin1]

The logs contain NO data from DB operations or Auth operations. REST logs only have user ids. Look at the Gateway logs and the Auth logs.

Only you could decide to log info from functions or turning on full Postgres logging (which they warn is also a major performance and very soon billing issue).

[GaryAustin1]

If you decided to include user info in the logs then you would need to discuss with SB as to where that is stored. Last I checked they were using BigQuery for that service and no idea about colocation.