# Ensure Realtime channels respect table RLS policies

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103910696593-ensure-realtime-channels-respect-table-rls-policies
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Realtime is configured so that data is only sent to users who are allowed to see it. Public channel access should be disabled so clients must use private channels controlled by RLS policies on realtime.messages, and every table streamed through Postgres Changes should have RLS enabled.

**Rationale**

Realtime can push database changes and messages to connected clients as they happen. If public channels are allowed, or if tables streamed through Postgres Changes do not have RLS, any client may receive messages or data changes intended for other users. Requiring private channels and RLS makes sure Realtime follows the same access rules as the rest of the API.

**Impact**

-   Only authorized users receive Realtime messages
    
-   Prevents data leaks through live updates
    
-   Clients must use private channels and valid user tokens
    

**Default Value**

By default, Realtime allows public channels. Postgres Changes respects RLS only on tables where RLS is enabled.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   Application changes to use private channels
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Realtime in the sidebar and select Settings.
    
4.  Verify that Allow public access is disabled.
    
5.  Open Database in the sidebar, select Publications, and check which tables are in supabase\_realtime.
    
6.  Verify that each of those tables has RLS enabled.
    
7.  If public access is allowed or a table lacks RLS, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  In the SQL Editor, create RLS policies on realtime.messages that allow only the right users to join each channel.
    
4.  Update the application to create channels with the private: true option.
    
5.  Open Realtime in the sidebar, select Settings, and disable Allow public access.
    
6.  Enable RLS on every table in the supabase\_realtime publication.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Realtime in the sidebar and select Settings.
    
4.  Enable Allow public access and save.
    

**Reference**

-   [https://supabase.com/docs/guides/realtime/authorization](https://supabase.com/docs/guides/realtime/authorization)
    
-   [https://supabase.com/docs/guides/realtime/settings](https://supabase.com/docs/guides/realtime/settings)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.