Base44 is an AI website and app builder for people with no coding skills. It handles design, databases, sign-ups, permissions and hosting. Wix bought it in June 2025, and your contract is with Wix.com Ltd.
We aren’t connected with Base44 or Wix. Everything below comes from their public documentation, terms and published reporting, as we read them on 6 November 2026. The legal points are our reading, not legal advice.
Who holds the keys
If you read one thing on this page, read this. Base44’s documentation says:
It says it will co-operate with a court order. Its terms add something a little different: in a dispute, Wix may decide ownership on its reasonable judgement, or suspend the account until the parties sort it out. It says it may take into account who has access to the email address, the billing details, who registered a connected domain, and whether the email address belongs to a business domain.
In practical terms, an app built on someone’s personal Gmail and paid for with their card is in the weakest position. An account on a company email address, paid by a company card, with a domain registered to the company, is in the strongest. How to work out where you stand.
- Each workspace has one owner, and we couldn’t find a documented way to transfer that role.
- A second administrator needs an Enterprise plan. The Admin role is only available on Business and Enterprise.
- You can’t change your account email yourself. You’d create a new account and move your apps, and your plan doesn’t come with them.
- Normal transfers need the current owner to act. Only the current app owner can make someone else the owner.
- A legacy contact covers death only, and has to be appointed in advance, through Customer Care. We saw nothing about someone who has simply left.
So get this right now, while everybody’s still around. Why it matters.
What Base44 says is your job
Base44 holds SOC 2 Type II and ISO 27001, by its own account, and offers a security scan on all plans. It’s still clear about where responsibility lies:
Note that the scan warns you, but it doesn’t stop you publishing, and fixes aren’t automatic. Issues marked as Acknowledged drop out of later scans, so it’s worth looking at what’s been dismissed. The terms also warn that default settings “may not be suitable” for your use, and that you’re solely responsible for any setting that may permit public access. Private apps are only available on paid plans.
Getting your things out
Base44 says what you build belongs to you. But owning something and being able to move it are different, and Base44 is candid about this:
- To leave, you’d rebuild the backend: the database, login system and integrations.
- Data comes out as CSV, one table at a time. The zip contains no data, secrets or users.
- Your customers’ logins don’t move. App users aren’t copied when you clone an app, and they can’t be imported, so they’d have to sign up again.
- Self-service backups need a higher plan: Elite, Business or Enterprise.
- Deleted apps are gone after 30 days, “even by Customer Care”.
- If you cancel, the Free plan allows five apps, and the rest are unpublished.
None of this makes Base44 a bad choice. It’s the price of having everything done for you. But it means you should take regular copies of your data, and go in with your eyes open about what leaving would involve.
Your data, and UK GDPR
If your app holds customer details, three things are worth checking against your privacy notice:
- Location. “By default, your app data is stored in the United States.” EU, UK or Australian storage needs an Enterprise plan, and it covers where data is stored, not where it’s processed.
- AI training. On all plans except Enterprise, Base44 says “your data can be used to train AI models”, and “there is no opt-out setting”. Think about whether that sits comfortably with personal data you hold, and take advice.
- Other companies involved. Base44’s list of subprocessors includes US-based database, hosting and AI providers.
What has gone wrong publicly
- Private apps, July 2025. Wiz Research reported a flaw that let an attacker create a verified account on private apps using only a non-secret app ID. It was reported on 9 July and fixed in under 24 hours. Wix said it had so far found no evidence that any customer was affected. This was a platform flaw that owners couldn’t have prevented.
- Account takeover routes, August 2025. Imperva published several flaws it had reported from March 2025, including token leaks. It said the vendor moved quickly to fix them.
- Exposed apps across platforms, May 2026. WIRED reported RedAccess’s finding of more than 5,000 exposed apps across Lovable, Replit, Base44 and Netlify, with no split by platform. Wix said public access reflected a user’s configuration choice and not a platform vulnerability, and questioned whether the data was real. RedAccess disputed part of that, and WIRED couldn’t confirm how real or sensitive the data was.
What you can check today
These are the menu names in Base44’s documentation, which can change.
Whose account is it?
The workspace name, bottom left, shows your email above Account preferences. Is it personal or the company’s?
Who’s the owner, and who else is in?
Workspace name, Settings, Members and groups. Check roles and when each person was last active.
Is two-step sign-in on?
Account preferences, Two-factor authentication. Check Signed-in browsers while you’re there.
Is the app public?
Dashboard, Overview, App Visibility.
Run the scan
Dashboard, Security, Run Security Scan. It’s free. Look under Acknowledged too.
Who can see each table?
Dashboard, Data, a table, Permissions. Look for “Permission risks detected” and for All Users, which means anyone, even without signing in.
See it as a user
A table’s More actions, Test permissions in preview. Use sample people, since changes made while testing are saved.
Can strangers copy it?
Dashboard, Settings, Platform Badge. On a public app, the badge lets anyone copy your app into their account. Base44 notes that apps built on the Free plan before 3 November 2026 keep it after an upgrade until you turn it off.
Take a copy now
Dashboard, Data, a table, More actions, Export, for every table. Keep the copies somewhere the business controls.
How we can help
Our audit checks your permissions from the outside, maps the account, billing and domain position that Base44’s terms care about, and tells you plainly where you stand. See an example report.
Questions
Is Base44 safe for a business?
The platform makes security claims you can read on its own site, and the flaws reported in 2025 were fixed. Your app’s settings are your responsibility, and the ownership and portability points above matter at least as much as the security ones.
What happens if the person who built our Base44 app leaves?
While they’re still around, have them move ownership to a company account. Afterwards, the documentation says you’d need to resolve it with them, or obtain a court order, while the terms give Wix a discretion to decide or suspend. Don’t leave it until then. What to do when the builder leaves.
Sources
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
