Skip to content

Do I Need a Data Processing Agreement (DPA) With Supabase, Stripe, or OpenAI?

6 min read

Yes. If GDPR applies to your app, you need a Data Processing Agreement (DPA) with every service that handles your users' personal data on your behalf, and that includes Supabase, Stripe, and OpenAI. The good news is you almost never have to write or negotiate one. Each of these companies already publishes a standard DPA, and accepting it is usually a checkbox or a click in your account settings.

Why this happens

Under GDPR, you are the data controller: you decide what user data is collected and why. Every vendor that processes that data for you (stores it, runs payments through it, sends it to a model) is a data processor. The law requires a written contract between controller and processor setting out what the processor may do with the data. That contract is the DPA.

Your AI agent wired up Supabase for storage, Stripe for payments, and maybe OpenAI for a chat feature. It made all of that work, and it was right to. What it did not do, because you did not ask and it does not sign contracts, is put the paperwork in place that GDPR expects behind each of those integrations. The code runs fine without the DPA. The compliance gap is invisible until someone asks.

How to check

Work out which vendors actually touch personal data, then confirm you have a DPA with each one.

  1. List your data processors. Go through your .env file and your integrations. Anything that stores, sees, or receives user data is a processor: Supabase, Stripe, OpenAI, your email sender (Resend, Postmark), analytics (PostHog), error tracking (Sentry), hosting (Vercel).
  2. A rough test: if a vendor could see a user's email, name, message, or payment, it is a processor and you need a DPA with it. A pure font CDN with no user data is not.
  3. Check whether you have already accepted each DPA. Most are auto-accepted in the terms of service, but some need an explicit action in the dashboard.

The fix

For the three in the title, here is exactly where the DPA lives.

  1. Supabase. Supabase's DPA is part of its standard terms and applies automatically to paid projects. You can view and countersign it from the dashboard under Organization settings, Legal, or Compliance. Download the signed copy for your records.
  2. Stripe. Stripe's DPA is incorporated into the Stripe Services Agreement, so by using Stripe you have already accepted it. You do not sign anything extra. Keep a link to Stripe's published DPA with your compliance notes.
  3. OpenAI. For API usage, OpenAI's DPA is part of its Business Terms and applies automatically. If you want the signed PDF, OpenAI provides a form or a click-through to execute it. Do this if you send any user content to the API.
  4. Everyone else on your list. Search "[vendor name] DPA". Reputable SaaS vendors publish one. Accept or sign it, then save a copy.
  5. Note the subprocessors. Each vendor's DPA links a list of subprocessors (the companies it in turn relies on, like AWS). You do not contract with them directly, but your privacy policy should tell users these vendors exist.

The trap to avoid

Do not assume "we are pre-launch, so this does not count," and do not try to draft your own DPA from a template. The relationship that needs a DPA starts the moment real personal data flows to a vendor, which is your first real beta user, not your public launch. And a homemade DPA a vendor never signed is worthless. Use the vendor's own published agreement every time. It already reflects how they actually handle data.

Where this fits

Missing DPAs will not crash your app, so they are easy to skip and expensive to explain later. First confirm the rules even apply to you in does GDPR apply to my small app, and if you use a model, read is it legal to send user data to OpenAI. Your privacy policy then names these vendors so users know where their data goes. The free Readiness Report inventories which third parties your app actually sends data to, so you know exactly which DPAs to line up before your first users, and the Finishing Pass walks you through closing each one.