[ralusek]

Just to be clear, this seems to suggest that Supabase the company/product is SOC compliant, not that any product/service that you build on Supabase is automatically SOC compliant. Is that correct?

[atonse]

Yes. If you built a product on top of supabase and your company wanted to get soc2 compliant, it helps that supabase, one of your vendors, is also compliant.

[NoPicklez]

It's generally accepted that a SOC2 report of a SaaS provider covers the controls that are the responsibility of the company to manage.