diff --git a/apps/docs/app/guides/security/[[...slug]]/page.tsx b/apps/docs/app/guides/security/[[...slug]]/page.tsx new file mode 100644 index 00000000000..8b7d4805aa5 --- /dev/null +++ b/apps/docs/app/guides/security/[[...slug]]/page.tsx @@ -0,0 +1,25 @@ +import { + getGuidesMarkdown, + genGuideMeta, + genGuidesStaticParams, +} from '~/features/docs/GuidesMdx.utils' +import { GuideTemplate } from '~/features/docs/GuidesMdx.template' + +export const dynamicParams = false + +type Params = { slug?: string[] } + +const SecurityGuidePage = async ({ params }: { params: Params }) => { + const slug = ['security', ...(params.slug ?? [])] + const data = await getGuidesMarkdown(slug) + + return +} + +const generateStaticParams = genGuidesStaticParams('security') +const generateMetadata = genGuideMeta((params: { slug?: string[] }) => + getGuidesMarkdown(['security', ...(params.slug ?? [])]) +) + +export default SecurityGuidePage +export { generateStaticParams, generateMetadata } diff --git a/apps/docs/app/guides/security/layout.tsx b/apps/docs/app/guides/security/layout.tsx new file mode 100644 index 00000000000..de720133147 --- /dev/null +++ b/apps/docs/app/guides/security/layout.tsx @@ -0,0 +1,5 @@ +import Layout from '~/layouts/guides' + +export default async function SecurityLayout({ children }: { children: React.ReactNode }) { + return {children} +} diff --git a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts index bfc1249afdc..adf4351fc0a 100644 --- a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts +++ b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts @@ -2030,6 +2030,20 @@ export const MIGRATION_PAGES: Partial { return MenuId.Realtime case pathname.startsWith('resources'): return MenuId.Resources + case pathname.startsWith('security'): + return MenuId.Security case pathname.startsWith('self-hosting'): return MenuId.SelfHosting case pathname.startsWith('storage'): diff --git a/apps/docs/content/guides/deployment/shared-responsibility-model.mdx b/apps/docs/content/guides/deployment/shared-responsibility-model.mdx index 3ac7b533989..c68cf9107ce 100644 --- a/apps/docs/content/guides/deployment/shared-responsibility-model.mdx +++ b/apps/docs/content/guides/deployment/shared-responsibility-model.mdx @@ -81,6 +81,10 @@ You are responsible of provisioning enough compute to run the workload that your We recommend reviewing and applying the recommendations offered in our [Production Checklist](/docs/guides/platform/going-into-prod). This checklist covers the responsibilities discussed here and a few additional general production readiness best practices. +## SOC 2 and compliance + +Supabase provides a SOC 2 compliant environment for hosting and managing sensitive data. We recommend reviewing the [SOC 2 compliance responsibilities document](/docs/guides/security/soc-2-compliance) alongside the aforementioned production checklist. + ## Managing healthcare data You can use Supabase to store and process Protected Health Information (PHI). You are responsible for the following diff --git a/apps/docs/content/guides/security.mdx b/apps/docs/content/guides/security.mdx new file mode 100644 index 00000000000..5f7654be047 --- /dev/null +++ b/apps/docs/content/guides/security.mdx @@ -0,0 +1,16 @@ +--- +id: 'security' +title: 'Supabase Security' +description: 'Security and compliance on the Supabase platform.' +sidebar_label: 'Overview' +hideToc: true +--- + +Supabase is a hosted platform which makes it very simple to get started without needing to manage any infrastructure. The hosted platform comes with many security and compliance controls managed by Supabase. + +# Compliance + +Supabase is SOC 2 Type 2 compliant and regularly audited. All projects at Supabase are governed by the same set of compliance controls. +The [SOC 2 Compliance Guide](/docs/guides/security/soc-2-compliance) explains Supabase's SOC 2 responsibilities and controls in more detail. + +Additional [security and compliance controls](/docs/guides/deployment/shared-responsibility-model#managing-healthcare-data) for projects that deal with electronic Protected Health Information (ePHI) and require HIPAA compliance are available through the HIPAA add-on. diff --git a/apps/docs/content/guides/security/soc-2-compliance.mdx b/apps/docs/content/guides/security/soc-2-compliance.mdx new file mode 100644 index 00000000000..ebf0142e548 --- /dev/null +++ b/apps/docs/content/guides/security/soc-2-compliance.mdx @@ -0,0 +1,60 @@ +--- +id: 'soc-2-compliance' +title: 'SOC 2 Compliance and Supabase' +description: 'Supabase is SOC 2 compliant and helps you meet your compliance controls.' +--- + +Supabase is Systems and Organization Controls 2 (SOC 2) Type 2 compliant and is assessed annually to ensure continued adherence to the SOC 2 security framework. SOC 2 assesses Supabase’s adherence to, and implementation of, controls governing the security, availability, processing integrity, confidentiality, and privacy on the Supabase platform. These controls define requirements for the management and storage of customer data on the platform. These controls applied to Supabase, as a service provider, serve two customer data environments. + +The first environment is the customer relationship with Supabase, this refers to the data Supabase has on a customer of the platform. All billing, contact, usage and contract information is managed and stored according to SOC 2 requirements. + +The second environment is the backend as a service (the product) that Supabase provides to customers. Supabase implements the controls from the SOC 2 framework to ensure the security of the platform, which hosts the backend as a service (the product), including the Postgres Database, Storage, Authentication, Realtime, Edge Functions and Data API features. Supabase can assert that the environment hosting customer data, stored within the product, adheres to SOC 2 requirements. And the management and storage of data within this environment (the product) is strictly controlled and kept secure. + +Supabase’s SOC 2 compliance does not transfer to environments outside of the Supabase product or Supabase’s control. This is known as the security or compliance boundary and forms part of the Shared Responsibility Model that Supabase and their customers enter into. + +# Meeting compliance requirements + +SOC 2 compliance is a critical aspect of data security for Supabase and our customers. Being fully SOC 2 compliant is a shared responsibility and here’s a breakdown of the responsibilities for both parties: + +### Supabase responsibilities + +1. **Security Measures**: Supabase implements robust security controls to protect customer data. These includes measures to prevent data breaches and ensure the confidentiality and integrity of the information managed and stored by the platform. Supabase is obliged to be vigilant about security risks and must demonstrate that our security measures meet industry standards through regular audits. +2. **Compliance Audits**: Supabase undergoes SOC 2 audits yearly to verify that our data management practices comply with the Trust Services Criteria (TSC), which include security, availability, processing integrity, confidentiality, and privacy. These audits are conducted by an independent third party. +3. **Incident Response**: Supabase has an incident response plan in place to handle data breaches efficiently. This plan outlines how the organization detects issues, responds to incidents, and manages system vulnerabilities. +4. **Reporting**: Upon a successful audit, Supabase receive a SOC 2 report that details our compliance status. This report is available to customers as a SOC 2 Type 2 report, and allows customers and stakeholders to assure that Supabase has implemented adequate and the requisite safeguards to protect sensitive information. + +### Customer responsibilities + +1. **Compliance Requirements**: Understand your own compliance requirements. While SOC 2 compliance is not a legal requirement, many enterprise customers require their providers to have a SOC 2 report. This is because it provides assurance that the provider has implemented robust controls to protect customer data. +2. **Due Diligence**: Customers must perform due diligence when selecting Supabase as a provider. This includes reviewing the SOC 2 Type 2 report to ensure that Supabase meets the expected security standards. Customers should also understand the division of responsibilities between themselves and Supabase to avoid duplication of effort. +3. **Monitoring and Review**: Customers should regularly monitor and review Supabase’s compliance status. +4. **Control Compliance**: If a customer needs to be SOC 2 compliant, they should themselves implement the requisite controls and undergo a SOC 2 audit. + +### Shared responsibilities + +1. **Data Security**: Both customers and Supabase share the responsibility of ensuring data security. While the Supabase, as the provider, implements the security controls, the customer must ensure that their use of the Supabase platform does not compromise these controls. +2. **Control Compliance**: Supabase asserts through our SOC 2 that all requisite security controls are met. Customers wishing to also be SOC 2 compliant need to go through their own SOC 2 audit, verifying that security controls are met on the customer's side. + +In summary, SOC 2 compliance involves a shared responsibility between Supabase and our customers to ensure the security and integrity of data. Supabase, as a provider, must implement and maintain robust security measures, customers must perform due diligence and monitor Supabase's compliance status, while also implement their own compliance controls to protect their sensitive information. + +## Frequently asked questions + +**How often is Supabase SOC 2 audited?** + +Supabase has obtained SOC 2 Type 2 certification, which means Supabase's controls are fully audited annually. The auditor's reports on these examinations are issued as soon as they are ready after the audit. Supabase makes the SOC 2 Type 2 report available to [Enterprise and Team Plan](https://supabase.com/pricing) customers. The audit report covers a rolling 12-month window, known as the audit period, and runs from 1 March to 28 February of the next calendar year. + +**How to obtain Supabase's SOC 2 Type 2 report?** + +To access the SOC 2 Type 2 report, you must be a Enterprise or Team Plan Supabase customer. The report is downloadable from the [Legal Documents](https://supabase.com/dashboard/org/_/documents) section in the organization dashboard. + +**Why does it matter that Supabase is SOC 2 Compliant?** + +SOC 2 is used to assert that controls are in place to ensure the proper management and storage of data. SOC 2 provides a framework for measuring how secure a service provider is and re-evaluates the provider on an annual basis. This provides the confidence and assurance that data stored within the Supabase platform is correctly secured and managed. + +**If Supabase’s SOC 2 does not transfer to the customer, why does it matter that Supabase has SOC 2?** + +Even though Supabase’s SOC 2 compliance does not transfer outside of the product, it does provide the assurance that all data within the product is correctly managed and stored. Supabase can assert that only authorized persons have access to the data, and security controls are in place to prevent, detect and respond to data intrusions. This forms part of a customer’s own adherence to the SOC 2 framework and relieves part of the burden of data management and storage on the customer. In many organizations' security and risk departments require all vendors or sub-processors to be SOC 2 compliant. + +**What is the security or compliance boundary?** + +This defines the boundary or border between Supabase and customer responsibility for data security within the Shared Responsibility Model. Customer data stored within the Supabase product, on the Supabase side of the security boundary, is managed and secured by Supabase. Supabase ensures the safe handling and storage of data within this environment. This includes controls for preventing unauthorized access, monitoring data access, alerting, data backups and redundancy. Data on the customer side of the boundary, the data that enters and leaves the Supabase product, is the responsibility of the customer. Management and possible storage of such data outside of Supabase should be performed by the customer, and any security and compliance controls are the responsibility of the customer. diff --git a/apps/docs/features/docs/GuidesMdx.utils.tsx b/apps/docs/features/docs/GuidesMdx.utils.tsx index d3720f0e0cf..9814c5c5fbb 100644 --- a/apps/docs/features/docs/GuidesMdx.utils.tsx +++ b/apps/docs/features/docs/GuidesMdx.utils.tsx @@ -31,6 +31,7 @@ const PUBLISHED_SECTIONS = [ 'queues', 'realtime', 'resources', + 'security', 'self-hosting', 'storage', 'telemetry', diff --git a/apps/docs/layouts/MainSkeleton.tsx b/apps/docs/layouts/MainSkeleton.tsx index 73ecb7902d3..a90c0d3dec3 100644 --- a/apps/docs/layouts/MainSkeleton.tsx +++ b/apps/docs/layouts/MainSkeleton.tsx @@ -78,6 +78,10 @@ const levelsData = { icon: 'reference-cli', name: 'Local Development', }, + security: { + icon: 'platform', + name: 'Security', + }, platform: { icon: 'platform', name: 'Platform', diff --git a/apps/www/data/features.tsx b/apps/www/data/features.tsx index 0afa7a28de8..a75f004ddbe 100644 --- a/apps/www/data/features.tsx +++ b/apps/www/data/features.tsx @@ -1663,7 +1663,7 @@ By building on Supabase's SOC 2 compliant platform, you gain a significant advan icon: ShieldCheck, products: [ADDITIONAL_PRODUCTS.PLATFORM], heroImage: '', - docsUrl: 'https://supabase.com/docs/guides/security/compliance', + docsUrl: 'https://supabase.com/docs/guides/security/soc-2-compliance', slug: 'soc-2-compliance', status: { stage: PRODUCT_STAGES.GA, diff --git a/apps/www/pages/security.mdx b/apps/www/pages/security.mdx index 470c011a2c5..4c44b153fe2 100644 --- a/apps/www/pages/security.mdx +++ b/apps/www/pages/security.mdx @@ -59,9 +59,9 @@ MFA adds an additional layer of security to your user account, by requiring a se ### SOC 2 -Supabase is SOC2 Type 2 compliant. This is an important security policy when handling sensitive customer data. +Supabase is SOC 2 Type 2 compliant. This is an important security policy when [handling sensitive customer data](/docs/guides/security/soc-2-compliance). -Enterprise and Team customers can access our SOC2 report [on the dashboard](/dashboard/org/_/documents). +Enterprise and Team customers can access our SOC 2 Type 2 report [on the dashboard](/dashboard/org/_/documents).
diff --git a/supa-mdx-lint/Rule003Spelling.toml b/supa-mdx-lint/Rule003Spelling.toml index eb261d1af02..e0d9af98b42 100644 --- a/supa-mdx-lint/Rule003Spelling.toml +++ b/supa-mdx-lint/Rule003Spelling.toml @@ -135,6 +135,7 @@ allow_list = [ "Drizzle", "EnterpriseDB", "Entra", + "ePHI", "Erlang", "Figma", "Firestore",