Security
How SupaHost isolates and protects your data, and a checklist for your app.
5 pages · start with Security at SupaHost
- 01Security at SupaHostHow SupaHost isolates customers and projects, locks down the network, handles secrets, TLS and backups, and what it doesn't offer yet: no SOC 2, ISO 27001, HIPAA or SLA.
- 02Shared responsibilityWhich parts of security SupaHost handles (servers, network, TLS, backups, updates) and which are yours (Row Level Security, keys, Auth settings, function code, your own backups).
- 03Production checklistWhat to check before launching an app on SupaHost: RLS on every exposed table, key handling, Auth redirect URLs and settings, function auth, tested backups, alerts and capacity.
- 04Keeping keys safeWhich SupaHost keys are safe to publish and which must stay on servers: anon, service_role, access tokens, SSH keys and function secrets. Plus what to do if one leaks.
- 05Data protection and privacyWho runs SupaHost, where your project data and backups are stored, which services handle emails and billing, and how to export or delete your users' data on request.