Where is my data stored?
Your database and files live on your instance's VM in the region you picked, and backups go to a private bucket in the same region. Which regions exist and which services touch your data.
Your data lives on your own instance: a VM in the region you chose when you created it. Each project's Postgres database and its Storage files sit on that VM's disk, and daily database backups go to a private storage bucket in the same region. The region can't be changed after the instance is created, so choose it with your users and any data-residency rules in mind.
Regions
| Area | Regions |
|---|---|
| North America | US Central, US West, US East |
| Europe | Belgium, London, Frankfurt |
| Asia-Pacific | Singapore, Sydney, Tokyo |
The Instance page and each project's Overview show the region.
Where each kind of data is kept
| Data | Location |
|---|---|
| Database (tables, Auth users, policies) | Postgres on your instance's VM |
| Storage files | the VM's disk (not in the database backups) |
| Daily backups and WAL for point-in-time recovery | a private bucket in the instance's region |
| Project keys and JWT secret | Google Cloud Secret Manager |
| OAuth client secrets and function secrets | Vault, inside your project's database |
| Edge Function source | SupaHost's platform database and your instance's backup bucket |
| Exports you create | on the instance, behind a download link that lasts 24 hours |
SupaHost runs on Google Cloud: instances are Compute Engine VMs, each one used by a single customer.
Services that see some data in transit
- Auth emails (confirmations, magic links, password resets) go through Resend, sent from
[email protected]. They include the recipient's email address and the link or code. - Edge Functions you write can send data wherever your code sends it.
- The MCP
search_docstool sends the search text to Supabase's docs search; it doesn't send your data.
Example: checking from SQL
Everything for a project is in one database you can inspect:
select current_database(), -- p_app_one
pg_size_pretty(pg_database_size(current_database())) as size;
FAQ
Can I keep data in the EU?
Yes. Create the instance in Belgium, London or Frankfurt; the database, files and backups stay in that region. Auth emails are delivered by Resend, which is a separate service.
Can I move my instance to another region later?
No. An instance's region is fixed when it's created. See Changing an instance's region for your options.
Does SupaHost have SOC 2, ISO 27001 or HIPAA?
No, none of these. See Data protection and privacy for what is in place.