This is a print-friendly report. Click Print and choose “Save as PDF” in the destination dropdown to download.
SaaSGuard Risk Report
Supabase
supabase.com
Generated May 4, 2026
Grade C
Score: 55 / 100
Executive summary
We analyzed Supabase’s Terms of Service across 8 risk dimensions and found 7 flagged clauses across 7 categories.
Flagged clauses by category
AI training on your data (1)
Severity 4 · material
“Supabase acknowledges that, as between Supabase and Customer, Customer owns all right, title, and interest, including all intellectual property rights, in and to the Customer Data. Customer hereby grants to Supabase a non-exclusive, royalty-free, worldwide license to reproduce, distribute, and otherwise use and display the Customer Data and perform all acts with respect to the Customer Data as may be necessary for Supabase to provide the Services to Customer, and a non-exclusive, perpetual, irrevocable, royalty-free, worldwide license to reproduce, distribute, modify, and otherwise use and display Customer Data incorporated within the Aggregated Data.”
Supabase uses Customer Data to provide and improve its Services. Supabase has a perpetual, irrevocable license to use Customer Data incorporated into Aggregated Data.
Supabase can use your data indefinitely for its own purposes, even after you stop using the service.
Auto-renewal traps (1)
Severity 2 · minor
“This Agreement will automatically renew for additional successive terms equal to the length of the Initial Subscription Period unless earlier terminated pursuant to this Agreement's express provisions or either Party gives the other Party written notice of non-renewal at least thirty (30) days prior to the expiration of the then-current term (each a "Renewal Subscription Period" and together with the Initial Subscription Period, the "Subscription Period").”
Your Supabase subscription automatically renews for the same term length unless you provide 30 days' written notice before the current term ends.
You will be automatically charged for renewal unless you remember to cancel in advance.
Surprise price hikes (1)
Severity 3 · notable
“Supabase may change this Agreement (except for any Orders) from time to time at its discretion. The date on which the Agreement was last modified will be updated at the top of this Agreement. Supabase will provide Customer with reasonable notice prior to any amendments or modifications taking effect, either by emailing the email address associated with Customer's account on the Services or by another method reasonably designed to provide notice to Customer.”
Supabase can change the agreement terms at its discretion and will notify you via email or another reasonable method before changes take effect.
Supabase can unilaterally change the terms of service, potentially impacting your costs or usage.
Termination friction (1)
Severity 3 · notable
“Upon expiration or earlier termination of this Agreement, Customer shall immediately discontinue use of the Supabase IP and, without limiting Customer's obligations under Section 6, Customer shall delete, destroy, or return all copies of the Supabase IP and certify in writing to the Supabase that the Supabase IP has been deleted or destroyed.”
When your Supabase agreement ends, you must immediately stop using Supabase's intellectual property and destroy or return all copies.
You must cease all use of Supabase's platform and materials upon termination, or face potential legal action.
Liability caps (1)
Severity 4 · material
“EXCEPT FOR: (I) A PARTY’S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS; (II) A PARTY’S INDEMNITY OBLIGATIONS; OR (III) A PARTY’S GROSS NEGLIGENCE, FRAUD, OR WILLFUL MISCONDUCT (“EXCLUDED LIABILITIES”), (A) IN NO EVENT WILL EITHER PARTY BE LIABLE UNDER OR IN CONNECTION WITH THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE, FOR ANY: (1) CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, SPECIAL, ENHANCED, OR PUNITIVE DAMAGES; (2) INCREASED COSTS, DIMINUTION IN VALUE OR LOST BUSINESS, PRODUCTION, REVENUES, OR PROFITS; (3) LOSS OF GOODWILL OR REPUTATION; (4) USE, INABILITY TO USE, LOSS, INTERRUPTION, DELAY OR RECOVERY OF ANY DATA, OR BREACH OF DATA OR SYSTEM SECURITY; OR (5) COST OF REPLACEMENT GOODS OR SERVICES, IN EACH CASE REGARDLESS OF WHETHER SUCH PARTY WAS ADVISED OF THE POSSIBILITY OF SUCH LOSSES OR DAMAGES OR SUCH LOSSES OR DAMAGES WERE OTHERWISE FORESEEABLE; AND (B) IN NO EVENT WILL EITHER PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE EXCEED THE TOTAL AMOUNTS PAID AND/OR PAYABLE TO SUPABASE UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE CLAIM; PROVIDED THAT, NOTWITHSTANDING THE FOREGOING, SUPABASE’S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO ANY EXCLUDED LIABILITIES WILL NOT EXCEED THREE TIMES (3X) THE TOTAL AMOUNTS PAID AND/OR PAYABLE TO SUPABASE BY CUSTOMER UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE CLAIM.”
Supabase's total liability is capped at the amount paid in the 12 months before a claim, except for excluded liabilities which are capped at 3x that amount.
Your ability to recover damages from Supabase for most issues is limited to the fees you have paid.
Indemnification (1)
Severity 3 · notable
“Customer shall indemnify, hold harmless, and, at Supabase’s option, defend Supabase from and against any Losses resulting from any Third-Party Claim that the Customer Data, or any use of the Customer Data in accordance with this Agreement, infringes or misappropriates such third party’s US intellectual property or other rights and any Third-Party Claims based on Customer’s or any Authorized User’s (i) negligence or willful misconduct; (ii) use of the Services in a manner not authorized by this Agreement; or (iii) use of the Services in combination with data, software, hardware, equipment or technology not provided by Supabase or authorized by Supabase in writing; in each case provided that Customer may not settle any Third-Party Claim against Supabase unless Supabase consents to such settlement, and further provided that Supabase will have the right, at its option, to defend itself against any such Third-Party Claim or to participate in the defense thereof by counsel of its own choice.”
You will defend Supabase against third-party claims that your data infringes intellectual property rights or arises from your negligence or misuse of the services.
You are responsible for defending Supabase if your data or actions lead to a lawsuit from a third party.
Right to silently change terms (1)
Severity 3 · notable
“Supabase may change this Agreement (except for any Orders) from time to time at its discretion. The date on which the Agreement was last modified will be updated at the top of this Agreement. Supabase will provide Customer with reasonable notice prior to any amendments or modifications taking effect, either by emailing the email address associated with Customer's account on the Services or by another method reasonably designed to provide notice to Customer.”
Supabase can change the agreement terms at its discretion and will notify you via email or another reasonable method before changes take effect.
Supabase can unilaterally change the terms of service, potentially impacting your costs or usage.
Methodology
SaaSGuard uses an automated pipeline: a daily Playwright crawler captures each vendor’s public Terms of Service, Privacy Policy, and DPA. Google’s Gemini 2.5 Flash classifies each clause into one of 8 risk categories with a severity score (1–5). Clauses are cross-referenced against a curated database of real lawsuits and FTC actions via embedding-based similarity matching. Grades are computed from per-category max severity; full source code is available on request.