Supabase Cloud HIPAA add-on vs self-hosted Supabase

The Security Rule requires a documented risk analysis of the risks to electronic protected health information, followed by risk management measures that reduce those risks to a reasonable and appropriate level. For a self-hosted Supabase stack, the analysis should cover every component you run: Postgres, the Auth and PostgREST services, Realtime, Storage, the API gateway, Studio, the connection pooler, and any logging or analytics services you enable. Keep the analysis current, record who approved it, and log each decision to accept, mitigate or transfer a risk. Auditors will compare the register against the running configuration, so the two must match. The specific requirements sit in 45 CFR 164.308, and the NIST guidance in SP 800-66 Rev. 2 is a practical reference for building the analysis.

Auditors will expect written policies that cover each administrative standard in 45 CFR 164.308, including security management, workforce security, information access management, security awareness and training, security incident procedures, contingency planning and evaluation. For a self-hosted backend, the operational policies carry most of the weight: who may deploy or change the Docker configuration, how secrets are generated and rotated, how incidents are escalated, and how backups are tested. Each policy should name an owner and a review date, and you should be able to show that staff were trained on it. HHS does not issue a template, so the mapping from policy to standard is your own document, and it should be reviewed by counsel or your compliance lead.

Unique user identification is a required implementation specification under the technical safeguards in 45 CFR 164.312, so every person and service account needs its own identifier. Produce periodic access review records that list each account with Studio access, database roles, Storage policies and the JWT-issuing Auth users, along with the reviewer's sign-off and the removal of leavers. Shared credentials are the usual finding here. Note that self-hosted Studio is protected by HTTP basic auth through DASHBOARD_PASSWORD, which is a single shared login on its own, so you will need to show how individual accountability is provided, such as through network controls or an identity layer in front of it. Confirm how your deployment handles this before the first review.

Keep dated samples that show access to ePHI, authentication events, configuration changes and administrative actions, and show that they can be reviewed. The self-hosting guide lists optional Logflare and Vector services for analytics and logs, so the first decision is whether those are enabled and where their output is stored. Retain samples from Postgres, the API gateway, Auth and Storage, and show that log integrity is protected, for example by writing them to a separate system that operators cannot silently edit. Record who reviews the logs and how often, and keep examples of a reviewed alert and its follow-up. The retention period and log content should be set in your risk analysis rather than copied from another organization.

Assessors will want evidence that backups exist, that they are protected, and that restores have been tested and succeeded. Self-hosted Supabase has no managed backups or point-in-time recovery, so the records are yours to produce: backup job logs for the database and Storage objects, the restore procedure, and dated results from test restores into a separate environment, including the time taken and the data checked. Keep a record of the Docker configuration version in use at each backup, because the changelog notes that some Storage migrations are one-way and require a database backup before updating. The contingency planning standards in 45 CFR 164.308 underpin these expectations.

If you are a covered entity or business associate, you need a written business associate contract with each vendor or subcontractor that creates, receives, maintains or transmits ePHI for you, as 45 CFR 164.314(a) requires. Self-hosting changes who holds that relationship: when you run the open-source stack in your own cloud account or data center, the question becomes which hosting provider, colocation operator or support firm can access ePHI, and each of them needs an agreement that meets the rule. Confirm with your legal team which parties apply, and ask any external provider whether it signs a business associate agreement. DeployOpen does not provide HIPAA certification, so the agreement terms are a matter for your counsel.

Keep a change record for every upgrade that shows the version moved from and to, the reason, the test results, the approver and the rollback plan. The self-hosted Supabase Docker configuration reached 0.8.3 on October 16, 2026, and its changelog flags security fixes for Storage and Realtime and one-way Storage database migrations. Each release also pins specific upstream services, such as Auth v2.197.0, PostgREST v14.18 and Realtime v2.143.3, so the record should list those pinned versions as well. Attach the backup taken before the change and the vulnerability note that justified it. Assessors often ask for this trail to show that security patches were applied within a time frame you set in your own policy.

HITRUST is optional. It is a private assurance framework, and HHS states that no Security Rule standard requires certification, so a HITRUST report does not replace the HIPAA evidence above. The current CSF version is v11.9.0, available from September 24, 2026, and it is organized into 14 control categories with 49 control objectives and 156 control specifications. Assessments carry different validity periods: e1 and i1 certifications last one year and r2 certifications two years. Buyers sometimes ask for it, and an independent assessor issues the report. Ask the assessor about scope, cost and timing before you commit, since the scope depends on which systems hold ePHI. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports or certifications.

Neither can be stated as a number from the sources available here, so ask for written figures for both. The add-on is a paid option on the Team plan, and no add-on price was supplied, so request it in writing from Supabase alongside the Team plan fee on the Supabase pricing page. Self-hosting costs recur in four places: servers and storage in your cloud account, backup tooling, log storage and retention, and the engineering hours for patching, upgrades and monitoring. Ask whether the add-on includes a business associate agreement and what it covers, then compare that with the internal and external hours your team would spend running the same controls.

The duration depends on scope, and no timeline was supplied for this work, so treat any number a vendor gives as a question to test. The main drivers are the target environment (an existing audited cloud account or a new one), how many services you keep from the Docker Compose stack, how complete your logging and backup design must be, and how much policy and evidence work your compliance team already has. Engagements at DeployOpen are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, so the written scope is where the timeline should appear.

Plan for named owners in four areas: infrastructure, security, database operations and compliance. Infrastructure staff run the hosts, networking and secrets handling. Security staff own the access model, the risk analysis and the review of the safeguards the HIPAA Security Rule assigns to the covered entity or business associate. Database staff own backups, restores and upgrades, since the self-hosted Docker configuration lists managed backups and point-in-time recovery as unavailable. Compliance staff keep the policies and evidence current. Expect each role to be a recurring commitment, not a one-off hand-off.

Yes, if your team already runs production Postgres, container platforms and identity controls in a HIPAA-aligned environment, and it has the capacity to keep those controls running. The open-source Docker configuration is public, and the self-hosting guide covers generating secrets and the JWT key pair. Gaps usually appear in backup design, tested restores, log retention and security patching on the upgrade cadence. Your team should also have the expertise to document the safeguards and show evidence for each. Outside help can cover any of those areas under a written, fixed scope, or on an ongoing retainer.

Usually not on its own, because Supabase's self-hosting documentation describes self-hosted Supabase as community-supported, through GitHub Discussions, GitHub Issues, Discord and Reddit. The documentation directs enterprises to contact Supabase's Growth Team, so ask in writing what that route includes and whether it covers incident response timing and contract terms. Community channels are useful for bugs and configuration questions, but they carry no response commitment. Decide early which party answers security incidents, and write that into your contracts and runbooks.

The biggest recurring drivers are the upgrade cadence, log retention and backup design. The self-hosted Docker configuration is released often, and version 0.8.3 on October 16, 2026 flagged security fixes for Storage and Realtime and one-way Storage database migrations that require a database backup before updating. A faster cadence means more test cycles and more change approvals. Longer log retention increases storage and review effort. Backup design, including how often you test restores, determines how much on-call time a recovery requires. Ask any vendor to price these three items separately so you can see which one moves the total.

The assessment is a separate cost that your organization pays to an independent assessor or certification body, and DeployOpen prepares systems, controls and evidence for that assessment but does not issue audit reports or certifications. HIPAA has no certification, and HHS states that no Security Rule standard requires certifying compliance, so the cost to plan for is the risk analysis, the evidence work and any voluntary third-party review you choose. If you use HITRUST as a framework, its assessment levels and renewal cycles differ, so confirm the scope and assessor fees directly with the assessor.