Integration · Cloud & infrastructure

Supabase integration for continuous SOC 2, ISO 27001 & PCI DSS compliance

CATAAM connects to Supabase with read-only access and runs 7 automated checks against your real configuration. The results map to 12 controls across 8 frameworks, including SOC 2, ISO 27001, PCI DSS, NIST CSF, SOC 1, Essential Eight.

automated checks: 7
controls mapped: 12
frameworks: 8

What happens when you connect Supabase

Connect with read-only access
Add a read-only role, OAuth scope or API token for Supabase. The credential is encrypted at rest.
Discover assets
CATAAM pulls the accounts, users, repositories or devices it finds into one asset inventory.
Run 7 automated checks
Every check runs against your real configuration, then keeps running on a schedule.
Map results to 12 controls
Each result lands on the controls it proves — and counts for every framework that shares them.
Store evidence and raise issues
Passing checks become audit evidence. Failures show up for the control owner and can open a Jira issue.

The 7 checks CATAAM runs on Supabase

Each check runs against your real Supabase configuration and keeps running on a schedule. Check names are shown as they appear in the CATAAM platform.

Supabase Auth session & password policy hardened
Supabase Point-in-Time Recovery / backups enabled
Supabase Row Level Security (RLS) enabled on public tables
Supabase dashboard users have MFA enabled
Supabase database network restrictions (IP allow-list) configured
Supabase enforces SSL/TLS on database connections
Supabase workforce SSO (SAML) configured

Controls these checks support (12)

A passing check becomes evidence for each control below, and counts for every framework that shares the control.

Control	Requirement	Frameworks
BCD-1	Continuity and Disaster Recovery plans established	SOC 2, ISO 27001, NIST CSF, Essential Eight, COBIT 5 +1
CRY-2	Encryption key access restricted	SOC 2, ISO 27001, SOC 1
CRY-5	Unique account authentication enforced	SOC 2
GOV-5	Backup processes established	SOC 2, ISO 27001, NIST CSF, SOC 1, Essential Eight +2
IAC-3	Production database access restricted	SOC 2, ISO 27001, SOC 1
IAC-4	Firewall access restricted	SOC 2, SOC 1
IAC-6	Production network access restricted	SOC 2, ISO 27001, SOC 1
IAC-11	Password policy enforced	SOC 2, PCI DSS, SOC 1
IAC-12	Remote access MFA enforced	SOC 2, ISO 27001, PCI DSS, NIST CSF, SOC 1 +1
NET-1	Data transmission encrypted	SOC 2, PCI DSS, NIST CSF, SOC 1
ORG-13	Authentication Information	ISO 27001
TECH-05	Secure Authentication	ISO 27001

Supabase integration: frequently asked questions

What does CATAAM check in Supabase?

CATAAM runs 7 automated checks on Supabase, for example: Supabase Auth session & password policy hardened; Supabase Point-in-Time Recovery / backups enabled; Supabase Row Level Security (RLS) enabled on public tables; Supabase dashboard users have MFA enabled. The full list is on this page.

Which compliance frameworks does the Supabase integration support?

The Supabase checks map to 12 controls and count toward SOC 2, ISO 27001, PCI DSS, NIST CSF, SOC 1, Essential Eight.

Does CATAAM need write access to Supabase?

No. Connectors use read-only roles, scopes or API tokens, and credentials are encrypted at rest. The only optional write anywhere in CATAAM is opening Jira issues for failed checks.

How do I connect Supabase to CATAAM?

Add a read-only role, OAuth scope or API token for Supabase in CATAAM. CATAAM then discovers your assets, runs the checks and keeps running them on a schedule, storing each result as audit evidence.