Are Base44's enterprise plans really enterprise-ready?

Your Base44 app has become something a company depends on. A department runs on it, or clients log into it every day, or you sell it to businesses. That's when the questions start. A client's IT team sends over a security questionnaire. Your own IT wants to see the data processing agreement, the contract that says what Base44 may do with the data. Procurement asks what uptime Base44 commits to in writing. Then someone asks where the data is kept, and who can see it.

Base44's answer is its Business and Enterprise plans, the two it sells “for enterprises”, with SSO, data residency, audit logs and priority support on the feature list. If you own the app, that looks like the upgrade that makes it serious. If your job is to get Base44 past IT, security and legal, those two plans are what you'll be judging.

But the questions aren't about the feature list. They're about where the app runs, who can reach its data, what happens to it when Base44 goes down, and whether you can ever leave with it. And on every one of them, Enterprise gives the same answer as the free plan.

What do Base44's Business and Enterprise plans include?

Business adds controls for running a team inside Base44, starting at $800 a month. Enterprise adds the items a security questionnaire asks about by name, at a price you only get from sales.

Business is bought inside the app, from $800 to $1,800 a month depending on the credits. You won't find it on the public pricing page, which stops at Elite and then shows one box for “enterprise solutions” that sends you to sales. Enterprise has no price anywhere. You talk to sales, and one owner who did was quoted $6,000 to $7,000 a year to start and told there was no smaller option.

At $800, Business gets you less than half the credits of Elite at the same price. Elite starts at $200 a month and goes up in $100 steps as you add credits, so there's an Elite plan at $800 too, with 5,400 message credits and 200,000 integration credits a month. Business at $800 comes with 2,400 and 96,000.

The team controls are sign-in through your company's identity provider (that's SSO), an allowlist so only your office's IP addresses can sign in, member roles, publishing controls and credit limits per member. Business also adds 30 days of backups and data residency, and it lists priority support, which Elite's feature list already has. Your app stays on the servers it shares with every other Base44 app.

Until October 1, SSO and data residency came with Elite, at $200. Since October 1, a new workspace needs Business for the same two features, at $800. Security people call this the SSO tax. SSO is a basic requirement for any company with more than a handful of employees, so a vendor that keeps it for its enterprise plans makes every one of those companies pay for the whole bundle to get it. Even before the price went up, an owner on Base44's own feedback board said Base44 belonged on sso.tax, the site that lists vendors who do this. Now it costs four times what it did on Elite.

Enterprise adds the rest of what the questionnaire asks for: no AI training on your data, audit logs, an encryption key of your own, a say in which AI companies your workspace uses, fixed IP addresses for the calls your app makes to other systems, automatic offboarding when someone leaves (SCIM), a written SLA and an account team.

Every item on both lists is a setting inside Base44's platform. Your app stays on Base44's servers, Base44's staff can still access its data, and the backend it runs on is still Base44's. That's true on every plan, and it's the first thing a reviewer checks.

Does Base44 have an SLA or an uptime guarantee?

No published one, on any plan. Business, the plan you can buy yourself, gets no SLA at all. Enterprise customers get one in their contract, behind the sales call, but an SLA only says what Base44 owes you after an outage. It doesn't put your app on different servers.

What the terms promise is the opposite of a guarantee. You get the platform and your app as is, with all faults, and with no promise that the service will be uninterrupted, error-free or secure. Base44 takes no liability for lost data or interruptions, and backing up your data is your job.

Every Base44 app, Enterprise included, sits behind the same hosting address (your custom domain points at base44.onrender.com, like everyone else's), on the same servers and the same database. Base44's docs call this private infrastructure. When Base44 goes down, an Enterprise app goes down with the free ones, and that happens about every ten days: 44 outages in the 14 months to October 2026. During the February outage an owner wrote “I have been down for two days. I am on the elite package”, and the day after the June one two Elite owners were still writing that they were stuck. Their plan didn't get them back up any sooner, and a bigger one wouldn't have: it runs on the same machines.

Does a bigger plan get you better support?

Base44 sells it that way. Business and Enterprise list priority support, described in the docs as a direct channel with guaranteed response times, and Enterprise adds a dedicated account team. What the docs never say is what the guaranteed time is. The support page says response times vary with ticket volume and urgency, and that's the only commitment in writing, on any plan. Elite's feature list already has priority support, so an Elite owner moving to Business pays $800 for a line they had at $200. Enterprise's account team is the one real addition: a person to ask. One Enterprise customer wrote on reddit that they do hear back within a couple of hours, and that the answer isn't always one you'll like. It doesn't change what support will do. On every plan it works in English only, and Base44's Customer Care team doesn't debug or fix your app's code, prompts or architecture.

Getting Enterprise sales to answer has been a problem of its own. One reddit thread is titled “Can't get a reply from Enterprise Sales”: the owner had tried LinkedIn, Discord and the contact form, and the replies under it came from people who'd been waiting for days too. And after waiting 48 hours on a critical issue, one Elite owner wrote on Base44's feedback board that Elite's priority “functions more like a billing upgrade than a service tier”.

Who at Base44 can read your app's data?

Base44's staff can read your app's data on every plan, whenever they decide they need to. Base44's own security FAQ says data isn't end-to-end encrypted, which means Base44 admins can access your data if needed. The IP allowlist that comes with Business and Enterprise has an exception in its docs: authorized Base44 support staff may bypass it as part of support operations. So the allowlist you pay for to keep everyone else out doesn't apply to Base44. When one owner's support tickets came back with screenshots of his app's dashboard, he asked on the feedback board for support to stop having access to app data at all. Another reports Base44 staff adding themselves as admins of his app without telling him.

On Enterprise, Base44 stops using your data to train AI models, and its staff can still read it. On every other plan, Business included, your data can be used to train AI, including what your users type into your app's forms, and there's no setting to opt out.

Below Enterprise, your app's secrets, the API keys and integration credentials, are encrypted with one key Base44 shares across its customers. Enterprise can have a key of its own for them. It doesn't cover your database: the records your users put in are encrypted at rest, not end to end, which is Base44's own explanation of why its admins can read them, on Enterprise like on every other plan.

Who else handles your data: 36 companies, one of them in China

A sub-processor is any company your vendor passes your data on to, and a reviewer asks for the list because each one is a company you never signed with. Base44's trust center lists 36: Render for the servers, MongoDB for the database, Cloudflare in front of every published app, AWS for storage, and then the AI companies. One of them is Z.ai, listed with China as its location, for calls to its AI models.

Z.ai is the international brand of Zhipu AI. In January 2025 the US Commerce Department put Zhipu and its subsidiaries on the Entity List, its trade blacklist, for AI work it said advances China's military modernization. On August 1, 2026, Base44 made Zhipu's model, GLM 5.2, the default for Superagents, its AI agents that read and write every app in a workspace. It switched every workspace below Enterprise overnight and left Enterprise on Anthropic's Claude, so it knew which customers would mind. On Enterprise, what that shows is who decides which company's model runs inside your workspace: Base44, by default, and its terms let it change that any time. Image generation goes through BytePlus in Singapore, the enterprise technology arm of ByteDance, which owns TikTok.

Since October 18, only Enterprise can choose which AI providers its workspace uses, so on Business there's no way to keep one out. And even on Enterprise, that choice doesn't reach the companies that hold your data: the ones running Base44's servers, its database, its file storage and its logs are the same for every customer, on every plan.

Base44 publishes three different lists of them. Its security page names 10, its trust center 36, and its page of AI providers 13, without Z.ai. On that page, the terms linked for Anthropic and xAI are those companies' consumer terms, the ones that cover a person using a chatbot, not the contracts a vendor signs. And when Base44 adds a new sub-processor, the data processing agreement gives you seven days to object, provided you subscribed to the email notice, and then names your remedy: stop using Base44.

Data residency covers storage only, and the audit log isn't a full record

Data residency, on Business and on Enterprise, stores your database and your user accounts in the EU or the UK. Base44's docs say it controls where data is stored, not where it's processed, so a request can still be handled by Base44's servers in the US on its way to that database. Uploaded files move only for apps created since October 12.

Audit logs, the record of who did what in your workspace, are Enterprise only. On the $800 plan, if someone deletes records or changes a permission, there's no audit log to show who it was. On Enterprise there is one, and its API returns what Base44 calls “sanitized audit events”. An owner wrote on the feedback board that deletions aren't captured.

What SOC 2 and ISO 27001 cover, and what they don't

Base44 holds both, and a plan doesn't change what they cover. The SOC 2 Type II report isn't public: you ask for it, a security specialist gets in touch, and you read it under a non-disclosure agreement. The ISO 27001 certificate was issued on December 25, 2025, and its scope line says what it covers: the IT operations behind a platform that lets users create applications through an AI chat, “without any prior programming knowledge”.

The certificate came after the two security holes made public in 2025. In July, a hole let anyone who knew a private app's id create an account on it, even on apps set to company sign-in only. In August, a second one came out: a crafted link could steal a user's login token.

Neither certificate says anything about the app you built. Base44's docs put your app's security settings on you. The terms go further. Before you use anything the AI generates, you agree to have a person review it independently for accuracy, legality, functionality and security, and you take on all liability for its errors, bugs and regulatory violations. That's the contract behind a platform sold as needing no coding background.

What the contract says when something goes wrong

Business runs on Base44's published terms and data processing agreement, the same ones the free plan runs on. Enterprise is the one plan with a contract you negotiate, and you start from these same terms:

• Base44's liability stops at a year of your fees. If a hole in its platform leaks your customers' data, the most it owes you is what you paid it in the twelve months before, or $100 if that's more, however many apps, workspaces or users you have.
• Base44 can change anything, any time. It can change or discontinue any feature, content or database, with or without notice, and change the terms themselves the same way. If you keep using the platform after a change, you've accepted it.
• Base44 can shut your account off for any reason. It can terminate or suspend your account, or just some of the apps in it, immediately and without notice.
• Base44 decides who owns the account. An account on your company's email domain may be treated as the company's, and Base44 makes that call at its sole discretion.
• A breach notice has no deadline and admits nothing. Base44 tells you “without undue delay”, with no number of hours, and the notice isn't an acknowledgement of fault.
• You can't audit Base44 yourself. You get a report at most once every twelve months, and there's no on-site audit.

On Enterprise, each of these is a line you'd have to get sales to strike, in writing. Nothing Base44 has published says any of them ever gets struck.

What the terms forbid, next to what the enterprise page sells

Base44's terms advise against using what its AI generates in medical, legal or financial work, and its enterprise page sells companies exactly those apps: a budget planner and a financial reporting dashboard for Finance, a contract generator, a contract review workspace and a case management system for Legal, a performance review manager for HR. Its hackathon pitch is that most companies leave with 5 to 15 apps live by the end of the day.

The terms also say the platform isn't for high-risk or regulated use without full compliance on your side. And without a separate written agreement, data protected by special laws, like patient records and payment card data, isn't allowed on the platform at all. So no patient data, which means no HIPAA, on any plan: Base44 signs no HIPAA agreement, Enterprise included.

What owners run into once a company is involved

Owners report that some banking and healthcare networks block Base44's domain outright, because their security tools classify it as an unapproved AI tool, so staff on those networks can't open the app at all. One owner's corporate security team rejected his app after reading the terms, over the line where Base44 waives responsibility for data security.

Other owners had their accounts switched off. For one, every published app showed “User is disabled” at once, and his paid plan was cancelled with no explanation. Others couldn't even open a support ticket, because tickets are opened from inside the account. The feedback board has a post titled “Operational Risks Associated with Unilateral Account Suspensions”, and r/Base44 had around ten account-disabled threads between May and October alone. One owner says his account was switched off right after he complained about Base44 on reddit. And Base44's support terms do say it can cut off support for “publicly lobbying against Base44 actions and policies”, with Base44 as the sole arbitrator.

A vendor whose deal keeps changing

Base44 was six months old and owned by one person when Wix bought it in June 2025, and your contract is with Wix. Since then the deal has kept changing under the people paying for it. On October 1, SSO and data residency moved from the $200 plan to the $800 one. On August 1, it switched the default model for its AI agents to the model of a company on the US trade blacklist, for every workspace below Enterprise, overnight. Credit top-ups were removed. New workspaces got “unified credits”, one pool that every data read and write, every function, every email and every AI call draws from, and support told one owner the feature can't be removed. So nobody can tell finance what next year's bill will be, and that alone is a problem for procurement. Enterprise was left out of the model switch by Base44's choice, and that's the point: the company that made every one of these moves decides the next one too, and it's the company you'd be negotiating your Enterprise contract with.

Why a bigger plan can't fix any of this

With Enterprise, your data isn't used to train Base44's AI, and Base44's staff can still read it. Your own encryption key covers your API keys and nothing of what your users put in. You get an audit log of your workspace, and an owner wrote that deletions aren't in it. You can switch AI providers off, and every other company on the list of 36 stays. The SLA says what Base44 owes you after an outage, and the outages still come about every ten days, on the same servers. The account team is a person to ask about a platform that works the same way. And the fixed IP addresses are for calls your app makes out, from those same servers.

Every one of them is a setting inside the platform, and none of them moves the app off it. So an enterprise plan from a vibecoding platform buys you the words an enterprise vendor uses, and the platform under them stays the same. The problem is relying on a vibecoding platform, and no plan it sells fixes that. When your IT team asks where the app runs and who controls it, no tier changes the answer.

Where companies run the apps they depend on

Most companies already run their software on a cloud provider like AWS or Google Cloud, under contracts their IT and legal teams know. Take AWS. Its uptime commitment is published on its own page for every customer, with no sales call: 99.99% a month for an app spread across two or more of a region's data centers, and AWS credits part of your bill back when it isn't met. The SOC reports and ISO certificates download from a page in your own AWS account, and the HIPAA agreement is accepted on the same page. Your data sits in the region you chose, under encryption keys you control. Every action on the account is logged, and your people sign in through the identity provider your company already runs. The data processing agreement you sign is AWS's own. Google Cloud works the same way.

An AWS outage is a news story, because it almost never happens, and when it does, a big chunk of the internet goes down with it. A Base44 outage happens about every ten days, and nobody outside r/Base44 hears about it.

So when an IT team says an app has to run on the company's own infrastructure, it means a standard cloud, in an account the company owns. The contract, the region, the keys and the logs are all on the company's side.

How to move your Base44 app onto your company's cloud account or network

Getting a Base44 app onto a cloud account of your own is hard because of Base44's backend. Your screens and your data are yours, but everything that makes them work runs on that backend: signing people in, saving and reading records, the logic behind each button, the files, the AI, the emails. It's one piece of server code Base44 runs for every app on the platform, and the export doesn't include it. So an app can't simply be moved. Someone has to build that whole backend again first.

I know that backend well, because I rebuilt it. My own app was stuck on Base44, and the only way out was to write all of that server code again myself. Once it worked, I turned the move into something that runs by itself, for any Base44 app. That's EscapeBase44.

You sign in with your Base44 account, pick the app, and pick where it runs: AWS, Google Cloud or another provider, in the region you need. The whole app moves onto accounts the company owns, with every record, every file, every user with their password, every backend function. The backend comes as code: the full server your app runs on, in a GitHub repository of yours, where your IT team can read every line before anything goes live. The app on Base44 keeps running as before while this happens, and you switch over once the new one is working.

From then on, that security questionnaire gets different answers. The SLA is AWS's or Google's, and it's published. The compliance reports come from your own cloud account. The region is the one you picked, the encryption keys are yours, and the audit trail is the cloud's log of your own account. The only companies that handle your data are the cloud and the services you chose yourself. Nobody at Base44 can read what your app holds, because your app doesn't run there anymore. The AI in your app runs on your own key, with the model you chose, and no company trains on what your users type. Nobody but you changes the code under your app, and there's no vendor whose terms let it switch your app off for any reason.

And you keep building the way you did. The move comes with an AI builder of its own, the same kind of chat you build in on Base44, and because the code is yours, backend included, your own developers can work on it directly too.

If the app has to run inside your company's network instead of on a cloud account, this can be done too: the same app, its backend and its database arrive as one package that installs on a Linux server of yours and goes live on an internal address, with nothing in it talking to Base44. And if your people need to sign in through your company's own Microsoft Entra ID, Okta or Active Directory, on either route, that's set up on request. Without it, people sign in after the move with email and password, Google or Microsoft. Both go in the request at the bottom of this page.

Base44 enterprise FAQ

• How much does Base44 Enterprise cost?

  There's no published price. Enterprise is sold through a sales call, and one owner who asked was quoted $6,000 to $7,000 a year to start, and told there was nothing lower. The Business plan, which you buy yourself inside the app, costs $800 to $1,800 a month and isn't on the public pricing page.

• What's the difference between Base44's Business and Elite plans?

  At $800 a month, Business comes with less than half the credits of the $800 Elite plan. What it adds is SSO, an IP allowlist, member roles, publishing controls, credit limits per member, data residency and 30 days of backups. The app runs on the same servers either way.

• Is Base44 SOC 2 compliant?

  Yes. Base44 holds SOC 2 Type II and ISO 27001, and the SOC 2 report is shared only on request, under an NDA. Both are about Base44's own processes, and neither covers the app you built: Base44's terms make its security your job.

• Does Base44 have an SLA?

  No, not a published one, on any plan. Enterprise customers get an SLA in their contract, behind the sales call, and it covers the same servers every plan runs on. They go down about every ten days, and Base44's terms say the platform comes as is, with no promise it won't be interrupted.

• Is Base44 enterprise-ready?

  No, not for an app a company depends on. On every plan, Enterprise included, the app runs on Base44's shared servers and on Base44's backend, which you can't take with you, and Base44's staff can access its data. Enterprise adds switches inside the platform, like no AI training on your data, your own key for secrets and a contract you negotiate, and none of them moves the app.

• Can Base44 employees access my app's data?

  Yes, on every plan. Base44's own documentation says data isn't end-to-end encrypted, which means Base44 admins can access it if needed, and its support staff may bypass the IP allowlist you pay for. The encryption key an Enterprise workspace can hold doesn't cover the records in its database, only its secrets, like API keys.

• Does Base44 train AI on my data on the Business plan?

  Yes. Base44's docs say that on every plan except Enterprise, Business included, your data can be used to train AI models, and there's no setting to opt out. That covers what your users submit through your app's forms. On Enterprise it isn't used for training, and Base44's staff can still read it.

• Is Base44 GDPR compliant?

  Base44 signs a data processing agreement, and on Business and Enterprise it stores your database and user accounts in the EU or the UK. Your data can still be processed on its servers in the US, older apps' uploaded files stay there, and Base44 can share your data with 36 sub-processors, one of them in China.

• Does Base44 have SSO?

  Yes, sign-in through Entra ID, Okta or Google (over OIDC). For workspaces created since October 1, 2026, it's on Business ($800 a month and up) and Enterprise only, and before that date it came with the $200 Elite plan. Automatic offboarding through SCIM is Enterprise only.

• What are the disadvantages of Base44 for a company?

  On every plan, Enterprise included, the app runs on shared servers with no published uptime commitment, Base44's staff can access your data, 36 sub-processors handle it (one of them on the US Entity List), and the backend can't leave the platform. Below Enterprise, your data can also be used to train AI and there's no audit log. Under the published terms, Base44's liability is capped at a year's fees or $100, it can change or end the service at any time, and nobody can forecast the bill.

• Can I move my Base44 app to AWS or Google Cloud without rebuilding it?

  Yes. EscapeBase44 moves the app as it is, with its records, files, users and backend functions, onto accounts your company owns, and hands over the full server code in your own GitHub repository. After the move, Base44 is involved only once per user: the first time an existing user signs in with a password, it's checked against the old app, so they keep it.