
# 

Secure configuration of Supabase platform

* * *

The Supabase hosted platform provides a secure by default configuration. Some organizations may however require further security controls to meet their own security policies or compliance requirements.

Access to additional security controls can be found under the [security tab](/dashboard/org/_/security) for organizations.

## Available controls[#](#available-controls)

Additional security controls are under active development. Any changes will be published here and in our [changelog](/changelog).

### Enforce multi-factor authentication (MFA)[#](#enforce-multi-factor-authentication-mfa)

Organization owners can choose to enforce MFA for all team members.

For configuration information, see [Enforce MFA on Organization](../../platform/mfa/org-mfa-enforcement/index.md)

### SSO for organizations[#](#sso-for-organizations)

Supabase offers single sign-on (SSO) as a login option to provide additional account security for your team. This allows company administrators to enforce the use of an identity provider when logging into Supabase.

For configuration information, see [Enable SSO for Your Organization](../../platform/sso/index.md).

### Postgres SSL enforcement[#](#postgres-ssl-enforcement)

Supabase projects support connecting to the Postgres DB without SSL enforced to maximize client compatibility. For increased security, you can prevent clients from connecting if they're not using SSL.

For configuration information, see [Postgres SSL Enforcement](../../platform/ssl-enforcement/index.md)

Controlling this at the organization level is on our roadmap.

### Network restrictions[#](#network-restrictions)

Each Supabase project comes with configurable restrictions on the IP ranges that are allowed to connect to Postgres and its pooler ("your database"). These restrictions are enforced before traffic reaches the database. If a connection is not restricted by IP, it still needs to authenticate successfully with valid database credentials.

For configuration information, see [Network Restrictions](../../platform/network-restrictions/index.md)

Controlling this at the organization level is on our roadmap.

### PrivateLink[#](#privatelink)

PrivateLink provides enterprise-grade private network connectivity between your AWS VPC and your Supabase database using AWS VPC Lattice. This eliminates exposure to the public internet by creating a secure, private connection that keeps your database traffic within the AWS network backbone.

For configuration information, see [PrivateLink](../../platform/privatelink/index.md)

PrivateLink is currently in beta. To establish PrivateLink with a Read Replica, reach out to your account rep.
