Supabase is now ISO 27001 certified

Summary

Supabase announces certification to ISO/IEC 27001:2022, covering its information security management system across Database, Auth, Storage, Realtime, Edge Functions, and the Data API. The post explains that ISO 27001 defines how an ISMS manages information risk through documented policies, processes, and controls, with certification awarded by an accredited third-party auditor after documentation review, interviews, evidence sampling, and control testing. Preparation included formalizing informal policies, documenting risk assessments, running internal audits, selecting an auditor, and mapping existing SOC 2 controls to ISO 27001 Annex A to avoid duplicate evidence collection. The certificate is valid for three years with annual surveillance audits, and Team or Enterprise customers can request it from their dashboard; the certification is presented alongside existing SOC 2 and HIPAA support.

Takeaways

1. 1

   SOC 2 is an auditor’s report describing control operation over a period, while ISO 27001 is a certificate confirming that an ISMS meets an international standard.

2. 2

   Stage one reviews policies, risk assessments, and the statement of applicability; stage two tests controls through interviews, evidence samples, and other audit procedures.

3. 3

   Team and Enterprise customers can request the ISO 27001 certificate from their dashboard for procurement and security reviews.