How many subprocessors does Supabase use?

Supabase lists 24 subprocessors on its published list, including Supabase, Inc., Active Campaign, LLC d/b/a Postmark, Amazon Web Services, Inc, Atlassian Corporation Plc, and Braintrust Data, Inc and 19 more.

Does Supabase use customer data to train AI models?

According to its terms of service, Supabase uses customer data to train AI models unless customers opt out: “Supabase will not use, nor allow any third-party to use, Customer Data, Customer's AI Input, or any AI Output to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, without Customer's prior written consent.”

Which AI model providers does Supabase send customer data to?

Amazon Bedrock and OpenAI are named in Supabase's privacy policy: “We may share this information with the following service providers through the provision of the Service: OpenAI, LLC and its affiliates, Amazon Bedrock, Fly.io, and AWS.”

How quickly does Supabase report a personal data breach to customers?

According to its DPA, Supabase reports a personal data breach to customers within 48 hours: “Supabase shall notify Customer in writing without undue delay, and where feasible, within forty-eight (48) hours, after becoming aware of any Security Incident”

How much notice does Supabase give before adding a subprocessor?

Supabase's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Supabase will provide Customer with at least thirty (30) days' notice of any proposed changes to the Authorized Sub-processors.”

How does Supabase transfer personal data outside the EU?

Supabase's DPA relies on standard contractual clauses: “The Standard Contractual Clauses shall, as further set out in Schedule 2, apply to the transfer of any Covered Data from Customer to Supabase”

When was Supabase's subprocessor list last checked?

ClauseTrail last checked Supabase's subprocessor list on October 1, 2026. Lists are re-checked daily.

How do I find out when Supabase adds or removes a subprocessor?

ClauseTrail monitors Supabase's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Supabase Subprocessors List (October 2026): Changes and History

Supabase names 24 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked October 1, 2026 Official source ↗

Supabase subprocessors (October 2026)

#	Subprocessor	Purpose	Location
1	Supabase, Inc.	Provision of support services	—
2	Active Campaign, LLC d/b/a Postmark	Communication with Authorized Users in connection with the provision of the Services and support	—
3	Amazon Web Services, Inc	Provision of hosting services	—
4	Atlassian Corporation Plc	Provision of status page services	—
5	Braintrust Data, Inc	Provision of monitoring and tracing	—
6	Clay Labs Inc.	Provision of customer insight services	—
7	Clazar, Inc	Provision of marketplace services	—
8	Cloudflare, Inc	Provision of hosting services	—
9	ConfigCat Korlátolt Felelősségű Társaság	Feature flagging	—
10	Google, LLC	Provision of hosting services	—
11	Fly.io, Inc	Provision of hosting services	—
12	FrontApp, Inc	Communication with Authorized Users in connection with the provision of the Services and support	—
13	Functional Software, Inc d/b/a Sentry	Error monitoring and tracing	—
14	Github, Inc	Authorized Users account authentication	—
15	Hex Technologies, Inc	Provision of data analytics services	—
16	Hubspot, Inc	Communication with Authorized Users in connection with the provision of the Services and support	—
17	Notion Labs, Inc	Communication with Authorized Users in connection with the provision of the Services and support	—
18	Sublime Security Inc	Email Security	—
19	Latacora, LLC	Managed Security Service Provider	—
20	OpenAI, LLC	Provision of natural language processing and generation services	—
21	PandaDoc, Inc	Communication with Authorized Users in connection with the provision of the Services and support	—
22	Slack Technologies, LLC	Communication with Authorized Users in connection with the provision of the Services and support	—
23	Upstash, Inc	Provision of serverless data hosting services	—
24	Vercel, Inc	Provision of hosting services	—

Get an email when Supabase changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Supabase free

AI and customer data at Supabase

What Supabase's own documents say, with the sentence each answer comes from.

Trains AI models on customer data: Yes, unless you opt out

“Supabase will not use, nor allow any third-party to use, Customer Data, Customer's AI Input, or any AI Output to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, without Customer's prior written consent.”
Terms of service, supabase.com ↗
Sends customer data to AI model providers: Yes: Amazon Bedrock and OpenAI

“We may share this information with the following service providers through the provision of the Service: OpenAI, LLC and its affiliates, Amazon Bedrock, Fly.io, and AWS.”
Privacy policy, supabase.com ↗
How to opt out: Training on Customer Data requires the customer's prior written consent, and users can withdraw consent for sharing data with AI partners anytime via account settings.

“If you have provided consent to share certain data with third-party partners in relation to our AI-powered services, you can update your preferences or withdraw your consent at any time through your account settings.”
Privacy policy, supabase.com ↗

Key DPA terms at Supabase

What Supabase's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 48 hours

“Supabase shall notify Customer in writing without undue delay, and where feasible, within forty-eight (48) hours, after becoming aware of any Security Incident”
DPA, supabase.com ↗
Notice of a new subprocessor: 30 days ahead

“Supabase will provide Customer with at least thirty (30) days' notice of any proposed changes to the Authorized Sub-processors.”
DPA, supabase.com ↗
Transfers outside the EU: Standard contractual clauses

“The Standard Contractual Clauses shall, as further set out in Schedule 2, apply to the transfer of any Covered Data from Customer to Supabase”
DPA, supabase.com ↗
Customer data after the contract ends: Deleted within 30 days of the contract ending

“Supabase shall, if requested to do so by Customer within thirty (30) days of expiry of the Agreement (the "Retention Period"), provide a copy of all Covered Data”
DPA, supabase.com ↗
Audit rights: Once a year

“Customer may audit Supabase's compliance with this DPA no more than once per calendar year to the extent required by Applicable Data Protection Laws.”
DPA, supabase.com ↗

Documents we track for Supabase

DPA: checked September 30, 2026 supabase.com ↗
Privacy policy: checked September 30, 2026 supabase.com ↗
Subprocessor list: checked October 1, 2026 supabase.com ↗
Terms of service: checked September 30, 2026 supabase.com ↗

Change history

Tracking since October 1, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Supabase subprocessors FAQ

How many subprocessors does Supabase use?: Supabase lists 24 subprocessors on its published list, including Supabase, Inc., Active Campaign, LLC d/b/a Postmark, Amazon Web Services, Inc, Atlassian Corporation Plc, and Braintrust Data, Inc and 19 more.
Does Supabase use customer data to train AI models?: According to its terms of service, Supabase uses customer data to train AI models unless customers opt out: “Supabase will not use, nor allow any third-party to use, Customer Data, Customer's AI Input, or any AI Output to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, without Customer's prior written consent.”
Which AI model providers does Supabase send customer data to?: Amazon Bedrock and OpenAI are named in Supabase's privacy policy: “We may share this information with the following service providers through the provision of the Service: OpenAI, LLC and its affiliates, Amazon Bedrock, Fly.io, and AWS.”
How quickly does Supabase report a personal data breach to customers?: According to its DPA, Supabase reports a personal data breach to customers within 48 hours: “Supabase shall notify Customer in writing without undue delay, and where feasible, within forty-eight (48) hours, after becoming aware of any Security Incident”
How much notice does Supabase give before adding a subprocessor?: Supabase's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Supabase will provide Customer with at least thirty (30) days' notice of any proposed changes to the Authorized Sub-processors.”
How does Supabase transfer personal data outside the EU?: Supabase's DPA relies on standard contractual clauses: “The Standard Contractual Clauses shall, as further set out in Schedule 2, apply to the transfer of any Covered Data from Customer to Supabase”
When was Supabase's subprocessor list last checked?: ClauseTrail last checked Supabase's subprocessor list on October 1, 2026. Lists are re-checked daily.
How do I find out when Supabase adds or removes a subprocessor?: ClauseTrail monitors Supabase's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.