共享责任模型
运行数据库是你和 Supabase 共同的责任。有些事情我们可以帮你处理，有些事情则由你负责。这是有意为之的：我们希望让你自由地使用数据库。虽然我们_可以_设置更多的限制来确保你不会出错，但你最终会发现这些限制反而束缚了你。
🌐 Running databases is a shared responsibility between you and Supabase. There are some things that we can take care of for you, and some things that you are responsible for. This is by design: we want to give you the freedom to use your database however you want. While we could put many more restrictions in place to ensure that you can’t do anything wrong, you will eventually find those restrictions prohibitive.
总的来说，你总是要负责以下内容：
🌐 To summarize, you are always responsible for:
- 你的 Supabase 账户
- 访问管理（Supabase 账户、数据库、表等）
- 数据
- 应用安全控制
一般来说，我们的目标是减少你在管理基础设施和了解 Postgres 内部细节上的负担，同时尽可能减少配置。以下是你应该了解的一些事项：
🌐 Generally, we aim to reduce your burden of managing infrastructure and knowing about Postgres internals, minimizing configuration as much as we can. Here are a few things that you should know:
你也要承担安全责任 #
🌐 You share the security responsibility
我们会给你完全访问数据库的权限。如果你把这个权限分享给其他人（无论是你团队里的成员，还是公众），那么你有责任确保你提供的访问权限得到正确管理。
🌐 We give you full access to the database. If you share that access with other people (either people on your team, or the public in general) then it is your responsibility to ensure that the access levels you provide are correctly managed.
如果你团队里有经验不足的成员，那么你可能不应该让他们接触生产环境。你应该为他们设定内部工作流程，明确他们能做什么和不能做什么，同时限制访问权限，以避免任何可能被认为危险的操作。
🌐 If you have an inexperienced member on your team, then you probably shouldn’t give them access to Production. You should set internal workflows around what they should and should not be able to do, with restricted access to avoid anything that might be deemed dangerous.
你还需要确保包含敏感数据的表有合适的访问权限。同时，你也需要管理好你的数据库密钥和 API 密钥，并把它们安全地存放在加密存储中。
🌐 You are also responsible for ensuring that tables with sensitive data have the right level of access. You are also responsible for managing your database secrets and API keys, storing them safely in an encrypted store.
Supabase 提供了用于保护你的数据的控制，建议你始终启用行级安全（RLS）。
🌐 Supabase provides controls for securing your data, and it is recommended that you always apply Row Level Security (RLS).
我们也会通过 安全顾问 提供安全警报，但是否采纳建议由你自己负责。
🌐 We will also provide you with security alerts through Security Advisor and applying the recommendations are your responsibility.
你自己决定工作流程 #
🌐 You decide your own workflow
有很多种方法可以使用 Supabase。
🌐 There are many ways to work with Supabase.
你可以使用我们的仪表板、客户端库、像 Prisma 和 Drizzle 这样的外部工具，或者像我们的 CLI、Flyway、Sqitch 这样的迁移工具，以及任何其他兼容 Postgres 的工具。在入门阶段，你可以直接在数据库上开发，从 本地到生产 运行迁移，或者使用 多个环境。
🌐 You can use our Dashboard, our client libraries, external tools like Prisma and Drizzle, or migration tools like our CLI, Flyway, Sqitch, and anything else that is Postgres-compatible. You can develop directly on your database while you're getting started, run migrations from local to production, or you can use multiple environments.
这些都没有对错之分。这取决于你项目的阶段。当你处于生产环境时，你_绝对_不应该直接在数据库上开发——但在你做原型、没有用户的时候，这完全没问题。
🌐 None of these are right or wrong. It depends on the stage of your project. You definitely shouldn’t be developing on your database directly when you’re in production - but that’s absolutely fine when you’re prototyping and don’t have users.
你要对你的应用架构负责 #
🌐 You are responsible for your application architecture
Supabase 并不是解决糟糕架构决策的灵丹妙药。一个设计不好的数据库无论托管在哪里，性能都会很差。
🌐 Supabase isn't a silver-bullet for bad architectural decisions. A poorly designed database will run poorly, no matter where it’s hosted.
你暂时可以通过增加计算资源来应付一个设计糟糕的数据库，但过一段时间，问题就会开始出现。数据库模式是你最应该花时间思考的部分。这就是 Supabase 的好处——你可以花更多时间设计一个可扩展的数据库系统，而不用太多精力去处理诸如实现 CRUD API 这样日常的任务。
🌐 You can get away with a poorly-designed database for a while by adding compute. After a while, things will start to break. The database schema is the area you want to spend the most time thinking about. That’s the benefit of Supabase - you can spend more time designing a scalable database system and less time thinking about the mundane tasks like implementing CRUD APIs.
如果你不想在数据库里实现逻辑，那完全没问题。你可以使用任何适用于 Postgres 的工具。
🌐 If you don’t want to implement logic inside your database, that is 100% fine. You can use any tools which work with Postgres.
你要对第三方服务负责 #
🌐 You are responsible for third-party services
Supabase 提供了很多与第三方服务灵活集成的机会，比如：
🌐 Supabase offers a lot of opportunities for flexibly integrating with third-party services, such as:
- OAuth 和 SAML 登录提供者
- SMTP 和短信发送 API
- 在 Postgres 函数或触发器中调用外部 API
- 在 Edge Functions 中调用外部 API
你可以自由使用和整合任何服务，但你也需要确保你使用的服务在性能、可用性和安全性上符合你应用的要求。我们不会监控与第三方服务整合中的中断或性能问题。根据具体实现，这类整合出现问题也可能会导致你的 Supabase 项目性能下降或中断。
🌐 You are free to use and integrate with any service, but you're also responsible for ensuring that the performance, availability, and security of the services you use match up with your application's requirements. We do not monitor for outages or performance issues within integrations with third-party services. Depending on the implementation, an issue with such an integration could also result in performance degradation or an outage for your Supabase project.
如果你的应用架构依赖这种集成，你应该监控相关的日志和指标，以确保性能最佳。
🌐 If your application architecture relies on such integrations, you should monitor the relevant logs and metrics to ensure optimal performance.
你可以选择自己对 Postgres 的熟悉程度 #
🌐 You choose your level of comfort with Postgres
我们在 Supabase 的目标是让 所有 的 Postgres 都易于使用。这并不意味着你必须全部使用它。如果你是 Postgres 老手，你可能会喜欢我们提供的工具。如果你以前从未使用过 Postgres，那就先从小做起，然后逐渐深入。如果你只想把 Postgres 当作一个基础的表存储，那也完全没问题。
🌐 Our goal at Supabase is to make all of Postgres easy to use. That doesn’t mean you have to use all of it. If you’re a Postgres veteran, you’ll probably love the tools that we offer. If you’ve never used Postgres before, then start smaller and grow into it. If you want to treat Postgres like a basic table-store, that’s perfectly fine.
你可以掌控你的数据库 #
🌐 You are in control of your database
Supabase 对你的数据库几乎没有设置任何保护措施。这给了你很大的控制权，但也意味着你可能会搞砸。这里的“搞砸”用得很宽松，它指的是任何由于你使用数据库的方式而影响到应用的情况。
🌐 Supabase places very few guard-rails around your database. That gives you a lot of control, but it also means you can break things. ”Break” is used liberally here. It refers to any situation that affects your application because of the way you're using the database.
你负责使用最佳实践来优化和管理你的数据库：添加索引、在大查询上添加筛选器、使用缓存策略、优化数据库查询，以及管理与数据库的连接。
🌐 You are responsible for using best-practices to optimize and manage your database: adding indexes, adding filters on large queries, using caching strategies, optimizing your database queries, and managing connections to the database.
你负责提供足够的计算资源来运行你的应用所需的工作负载。Supabase 控制面板提供了可观察性工具来帮助你完成这项工作。
🌐 You are responsible of provisioning enough compute to run the workload that your application requires. The Supabase Dashboard provides observability tooling to help with this.
在投入生产之前 #
🌐 Before going to production
我们建议查看并应用我们在生产清单中提供的建议。该清单涵盖了这里讨论的职责以及一些其他通用的生产准备最佳实践。
🌐 We recommend reviewing and applying the recommendations offered in our Production Checklist. This checklist covers the responsibilities discussed here and a few additional general production readiness best practices.
SOC 2 和合规 #
🌐 SOC 2 and compliance
Supabase 提供一个符合 SOC 2 标准的环境来托管和管理敏感数据。我们建议在查看上述生产检查清单的同时，也查看 SOC 2 合规责任文档。
🌐 Supabase provides a SOC 2 compliant environment for hosting and managing sensitive data. We recommend reviewing the SOC 2 compliance responsibilities document alongside the aforementioned production checklist.
管理医疗数据 #
🌐 Managing healthcare data
你可以使用 Supabase 来存储和处理受保护的健康信息（PHI）。你需要负责以下内容
🌐 You can use Supabase to store and process Protected Health Information (PHI). You are responsible for the following
- 与 Supabase 签署业务伙伴协议 (BAA)。提交一个 HIPAA 附加请求 开始操作。你至少需要在 团队计划 才能与我们签署 BAA。
- 将特定项目标记为 HIPAA 项目 并解决顾问提出的安全问题。
- 确保所有 Supabase 账户都启用了多因素认证（MFA）。
- 强制使用多因素认证 作为访问组织的要求
- 启用 时间点恢复 需要至少一个 小型计算附加组件。
- 开启 SSL 强制。
- 启用网络限制。
- 保持Postgres连接日志开启。Supabase 默认在新项目中将
log_connections关闭。需要符合 HIPAA 的项目应保持连接日志开启以便审计，安全顾问会在它被禁用时发出警告。 - 遵守 HIPAA 安全规则中的加密要求。Supabase 会对静态数据和传输中的数据进行加密。你也可以考虑在应用层对数据进行加密。
- 不在 公共存储桶 中存储 PHI。
- 不把项目转移到非HIPAA组织。
想了解更多关于 HIPAA 下的共同责任和规则的信息，请查看 HIPAA 合规责任文档。
🌐 For more information on the shared responsibilities and rules under HIPAA, review the HIPAA compliance responsibilities document.