GDPR 合规和 Supabase

Supabase 支持构建符合 GDPR 的应用。构建合规应用是一种共同责任：Supabase 负责保护底层基础设施，而你则负责应用的数据处理活动、用户同意流程和访问控制。

🌐 Supabase supports building GDPR-compliant applications. Building a compliant application is a shared responsibility: Supabase secures the underlying infrastructure, while you're responsible for your application's data processing activities, consent flows, and access controls.

数据驻留 #

🌐 Data residency

每个 Supabase 项目都会部署到一个主要区域，你项目的主要 Postgres 数据库、认证服务和存储对象都会托管在该区域。在欧盟选择一个特定区域会将这些服务固定到那个具体的 AWS 区域。

🌐 Each Supabase project is deployed to a single primary region, and your project's primary Postgres database, Auth service, and Storage objects are hosted in that region. Choosing a specific region within the EU pins these services to that exact AWS region.

请注意，“欧洲”这一通用地区分类也包括伦敦（英国）和苏黎世（瑞士）——两地都有符合 GDPR 的数据保护制度，但都不是欧盟成员国。如果你的合规要求是数据必须留在欧盟境内，建议选择具体的欧盟地区，而不是通用的欧洲分类。完整列表请参见 可用地区 。

🌐 Note that the "Europe" general region grouping also includes London (UK) and Zurich (Switzerland) — both have GDPR-adequacy data protection regimes, but neither is an EU member state. If your compliance requirements call for data to stay within the EU specifically, choose a specific EU region rather than the general Europe grouping. See available regions for the full list.

选择一个区域是数据位置的控制措施，本身并不能让你的应用符合 GDPR。备份、日志、导出到外部系统的数据、Edge Functions 的执行以及子处理器都会影响你的数据驻留和国际传输分析。

🌐 Choosing a region is a data-location control and does not make your application GDPR compliant on its own. Backups, logs, data exported to external systems, Edge Function execution, and sub-processors can affect your data residency and international transfer analysis.

数据处理协议 (DPA) #

🌐 Data processing agreement (DPA)

如果你需要一份符合 GDPR 的正式数据处理合同，Supabase 提供了数据处理协议（DPA）。请求或查看 DPA。

🌐 If you need a formal data processing contract under GDPR, Supabase provides a Data Processing Agreement (DPA). Request or view the DPA.