Are Supabase's AI features covered by the BAA?

Supabase AI Assistant (dashboard SQL/policy helper): coverage not stated. Third-party AI APIs called from Edge Functions or Postgres (e.g., OpenAI, Hugging Face): excluded from the baa.

Does Supabase sign a BAA?

Q: Does Supabase sign a HIPAA BAA?

Only on some plans or setups. Supabase signs BAAs for its hosted platform for organizations on at least the Team plan with the paid HIPAA add-on, and projects must be set to High Compliance. Supabase's HIPAA pages do not say whether the dashboard AI Assistant is covered.

Only on some plans or setups

Supabase signs BAAs for its hosted platform for organizations on at least the Team plan with the paid HIPAA add-on, and projects must be set to High Compliance. Supabase's HIPAA pages do not say whether the dashboard AI Assistant is covered.

Based on 4 sources, all from Supabase unless marked.

Not fully covered by the BAA: Third-party AI APIs called from Edge Functions or Postgres (e.g., OpenAI, Hugging Face).

Business associate: Supabase
Tool: Supabase
Plans with a BAA: Team / Enterprise with HIPAA add-on
Checked: Oct 11, 2026

Some plans only

Supabase signs only for the plans listed.

By plan

Plan	BAA	How to get it	Conditions
Free / Pro	No BAA	Not offered	The pricing page shows HIPAA as not included on Free or Pro.[1]
Team / Enterprise with HIPAA add-on	Signs a BAA	Request by emailRequest page	Submit the HIPAA add-on request form to sign a BAA, enable the paid add-on, and mark projects High Compliance. Also required: Point in Time Recovery (needs at least a small compute add-on), SSL enforcement, network restrictions and MFA, with no PHI in public Storage buckets. The add-on price is not published.[2],[3],[1]
Self-hosted Supabase	No BAA	Not offered	Supabase says HIPAA controls are not supported out of the box when self-hosted, and that self-hosted HIPAA is out of scope.[4]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Supabase says about each one.

AI feature	Under the BAA	Details
Supabase AI Assistant (dashboard SQL/policy helper)Team / Enterprise with HIPAA add-on	Not stated	Supabase's HIPAA and shared-responsibility pages do not mention the AI Assistant.[2],[4]
Third-party AI APIs called from Edge Functions or Postgres (e.g., OpenAI, Hugging Face)Team / Enterprise with HIPAA add-on	Excluded	Supabase makes customers responsible for third-party services they integrate. Those providers need their own arrangements and are not covered by Supabase's BAA.[2]

Cloud AI platforms that offer a BAA

Amazon BedrockBAA on: AWS accounts (standard AWS BAA)Signs a BAA
AWS HealthScribeBAA on: AWS accounts with the AWS BAA accepted (US East, N. Virginia)Signs a BAA
Google Cloud Vertex AI (Gemini Enterprise Agent Platform)BAA on: Google Cloud customers (Agent Platform / Vertex AI, GA services)Signs a BAA

All BAA-ready alternatives to Supabase

Sources

Supabase PricingSupabase, Documentation. Checked Oct 11, 2026.
Shared Responsibility Model | Supabase DocsSupabase, Documentation. Checked Oct 11, 2026.
HIPAA Projects | Supabase DocsSupabase, Documentation. Checked Oct 11, 2026.
HIPAA Compliance and Supabase | Supabase DocsSupabase, Documentation. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.