Free tool
What would a leak cost you? Do the maths with your own numbers.
A plain calculator: the people whose records were exposed, times what it costs you to tell them and answer their questions, plus the time to fix it. No industry averages, no scare statistics. Replace every starting value with your own.
Calculator
The maths
Six lines, all visible.
Every figure is something you can check against your own costs. Here it is with the starting values.
notify = people × cost to notify one person
support = people × share who contact you × cost per contact
goodwill = people × credit per person
engineer = hours × cost per hour
total = notify + support + goodwill + engineer
+ legal advice + anything else| Line | Working | Amount |
|---|---|---|
| Notifying people | 1,000 × £0.50 | £500 |
| Answering questions | 1,000 × 10% × £8 | £800 |
| Goodwill credits | 1,000 × £0 | £0 |
| Engineering time | 16 h × £75 | £1,200 |
| Legal or privacy advice | as entered | £1,500 |
| Anything else | as entered | £0 |
| Total | £4.00 per person | £4,000 |
Placeholders, not research. Your numbers will differ, maybe by a lot.
If it happens in the UK
The 72-hour rule.
Under UK GDPR, you must report certain personal data breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of them.
Which breaches, and what to do. The duty applies when a breach is likely to put people’s rights and freedoms at risk. If the risk is high, you must usually tell the affected people too, without undue delay. The ICO has a self-assessment and the reporting form.
- Write down what you know and when you found out. The clock starts when you become aware.
- Close the leak first. Then work out which records were readable, and by whom.
- Outside the UK, check your own regulator’s rules: deadlines and thresholds differ.
- This page is general information, not legal advice. For a real incident, talk to a lawyer or your data protection officer.
Before it happens
The cheapest leak is the one you close first.
Find out which of your tables a stranger can read, then fix it with a change you’ve watched work.
Free RLS check
Scan your migrations for the eight patterns behind most Supabase leaks. No sign-up.
Full lab check
We rebuild your database, read it as a stranger, write the fix and prove it. Never touches your live app.
Sample report
See exactly what you get: the leak, the exposed columns, the fix and the proof as three identities.