
# Compliance

Supabase is SOC 2 Type 2 compliant and regularly audited. All projects at Supabase are governed by the same set of compliance controls. The [SOC 2 Compliance Guide](soc-2-compliance/index.md) explains Supabase's SOC 2 responsibilities and controls in more detail.

The [HIPAA Compliance Guide](hipaa-compliance/index.md) explains Supabase's HIPAA responsibilities. Additional [security and compliance controls](../deployment/shared-responsibility-model/index.md#managing-healthcare-data) for projects that deal with electronic Protected Health Information (ePHI) and require HIPAA compliance are available through the HIPAA add-on.

# Platform configuration

As a hosted platform, Supabase provides additional security controls to further enhance the security posture depending on organizations' own requirements or obligations.

These can be found under the [dedicated security page](/dashboard/org/_/security) under organization settings. And are described in greater detail [here](platform-security/index.md).

# Product configuration

Each product offered by Supabase comes with customizable security controls and these security controls help ensure that applications built on Supabase are secure, compliant, and resilient against various threats.

The [security configuration guides](product-security/index.md) provide detailed information for configuring individual products.
