---
title: "Supabase is now ISO 27001 certified"
description: "Supabase announces certification to ISO/IEC 27001:2022, covering its information security management system across Database, Auth, Storage, Realtime, Edge Functions, and the Data API. The post explains that ISO 27001 defines how an ISMS manages information risk through documented policies, processes, and controls, with certification awarded by an accredited third-party auditor after documentation review, interviews, evidence sampling, and control testing. Preparation included formalizing informal policies, documenting risk assessments, running internal audits, selecting an auditor, and mapping existing SOC 2 controls to ISO 27001 Annex A to avoid duplicate evidence collection. The certificate is valid for three years with annual surveillance audits, and Team or Enterprise customers can request it from their dashboard; the certification is presented alongside existing SOC 2 and HIPAA support."
---

# Supabase is now ISO 27001 certified

[Supabase](https://yomu.fyi/company/supabase) · stephen\_morgan · Apr 22, 2026

**Type:** Announcement

## Summary

Supabase announces certification to ISO/IEC 27001:2022, covering its information security management system across Database, Auth, Storage, Realtime, Edge Functions, and the Data API. The post explains that ISO 27001 defines how an ISMS manages information risk through documented policies, processes, and controls, with certification awarded by an accredited third-party auditor after documentation review, interviews, evidence sampling, and control testing. Preparation included formalizing informal policies, documenting risk assessments, running internal audits, selecting an auditor, and mapping existing SOC 2 controls to ISO 27001 Annex A to avoid duplicate evidence collection. The certificate is valid for three years with annual surveillance audits, and Team or Enterprise customers can request it from their dashboard; the certification is presented alongside existing SOC 2 and HIPAA support.

## Context

The post describes ISO 27001 as relevant to vendor reviews and procurement, noting that some teams need ISO 27001, SOC 2, or both depending on their location and requirements.

## Approach / What changed

Supabase completed a two-stage certification process involving documentation review, staff interviews, evidence sampling, and control testing. Preparation included formalizing policies, documenting risk assessments, conducting internal audits, selecting an auditor, and mapping SOC 2 controls to the ISO 27001 Annex A list.

## Takeaways

- SOC 2 is an auditor’s report describing control operation over a period, while ISO 27001 is a certificate confirming that an ISMS meets an international standard.
- Stage one reviews policies, risk assessments, and the statement of applicability; stage two tests controls through interviews, evidence samples, and other audit procedures.
- Team and Enterprise customers can request the ISO 27001 certificate from their dashboard for procurement and security reviews.

**Tags:** [Privacy](https://yomu.fyi/topic/privacy)

- Source: [Supabase](https://supabase.com/blog/supabase-is-now-iso-27001-certified)
- Source URL: https://supabase.com/blog/supabase-is-now-iso-27001-certified
- Ingested by Yomu: 2026-08-29T20:00:53.565Z

[Read original post](https://supabase.com/blog/supabase-is-now-iso-27001-certified)