Security
The marks in the footer are static graphics drawn on this site. They attribute published audits to Supabase, the infrastructure provider. They are not a DS BUREAU certification, and they do not load a third-party tracker.
- InfrastructureSOC 2 Type IISupabase publishes a SOC 2 Type II report for its own platform. That report is not a DS BUREAU audit.
- InfrastructureISO 27001Supabase is ISO/IEC 27001 certified for its platform. That certificate belongs to Supabase.
- PrivacyHealth dataHealth information is accepted only when a written contract specifically allows it. This mark is not a certification.
The reality of badges
There is no official government HIPAA badge, seal, or logo. The Department of Health and Human Services (HHS) does not certify companies.
A HIPAA badge on a website is a marketing asset from a third-party compliance platform or a training provider. DS BUREAU does not display one.
A third-party compliance seal or a workforce training badge belongs on a site only after that vendor has actually issued it. We do not show either.
Badge scripts
Embedding a third-party snippet for a trust badge can load code that records visitor data, referral URLs, and IP addresses. Healthcare sites have faced penalties when that tracking ran without a Business Associate Agreement covering the vendor.
If a mark is used, it should be a static image. The footer marks on this site are static. They do not contact Accountable, Vanta, Compliancy Group, or any other badge host.
What the footer marks mean
SOC 2 Type II and ISO 27001 in the footer refer to Supabase. Client projects and DS BUREAU's internal services run on Supabase, and Supabase publishes a SOC 2 Type II report and an ISO/IEC 27001 certificate for its platform, including database, auth, storage, and related APIs. Website form messages are delivered by email through Resend and are not stored in Supabase.
Those documents stop at Supabase's boundary. They do not make DS BUREAU SOC 2 or ISO 27001 certified. A claim like that for this studio would require a separate independent audit of our own company and application.
The health-data mark is a limit, not a certification. DS BUREAU does not accept health information unless a written contract specifically allows that data and the safeguards that apply to it. The mark does not mean DS BUREAU is certified, audited, or ready to receive health records through the website.