Security
Your Base44 App
Overview
First you log in through Base44’s developer login: we get a read-only access token to your apps in order to migrate them. We use this access minimally, and outline exactly what we use this access for both before and during migration. You can revoke this access at any point, and nothing is stored on our servers. We have a signed NDA and a read-only access agreement on the bottom of this page; both apply even if you do not go through with migration.
Login Mechanism
The login on this website is Base44's own login. It's the same device-code their command line tool uses; developers use it to log in from their terminal. You never give us your password.
You can see Base44's official documentation on their command-line interface and the login command.
What we use it for, before migration
Even before migration, we need to:
- Give an accurate price estimate for your app
- Recommend relevant hosting providers
To do so, we look at meta-information about your app. For example, if your app uses websockets: we need to know not to show Vercel, since this provider does not support it. If you do not have files and assets, you don't need a storage provider. We look at the bare minimum needed, in order to give you a proper analysis.
We do read operations only. Your app is untouched.
- ✓How many GB of files you've uploaded
- ✓Whether you use these featuresAIAgentsAutomationsBackend functionsRealtimeFile uploadsConnectors
- ✓How many MB your data takes up
- ✓Which sign-in methods your app uses
- ✓Which outside services your app connects to
- ✕The contents of your code
- ✕The contents of your data
- ✕The contents of your files
- ✕Your users' names, emails or passwords
- ✕Your users' messages and AI chats
- ✕Your API keys and secret values
- ✕Your Base44 password
Even during migration: we do read-only operations.
We never write, update, or touch anything. Your Base44 app stays exactly the same. We download everything directly onto your new providers.
Revoke our access at any point
- Open your profile.
- Under API keys, click "View personal access tokens"
- Delete the token with "EscapeBase44" in the name
(If you revoke our access before migration, you'll need to log in again in order to migrate).
Your Hosting Providers
What you give us
You give us access tokens(also called API keys). They’re the standard way for developers to perform operations, the way you would by clicking around. If you'd rather we never have access to an account you already use, you can migrate onto new, empty ones.
What we do with the access
We require the access in order to set up your app onto them. We don’t do anything else.
Provider Quality
All the providers we offer are industry-standard and secure, with SOC 2 and ISO 27001 security certifications.
AWSSOC 2 · ISO 27001
Google CloudSOC 2 · ISO 27001
VercelSOC 2 · ISO 27001
HetznerISO 27001
MongoDB AtlasSOC 2 · ISO 27001
SupabaseSOC 2 · ISO 27001
CloudflareSOC 2 · ISO 27001Revoke Our Access
Any token can be revoked at any time.
Companies do this all the time: when a developer leaves, they rotate the tokens (delete them and make new ones) and that person's access is gone.
You can do the same to us, any time.
Each provider has its own steps. After migration we guide you through it, for your specific providers, step by step.
After migration
Our Platform
We use certified platforms only, and every one of them is independently audited for security. Everything we use is SOC II and ISO certified. All network transit is encrypted.
VercelSupabase
- We don't store your data
- We only set up your app using the access you give us
- Signed by us, personally
Base44 Terms of Service
Migrating is legal and does not violate Base44's terms of service. It's your app, and Base44 says so itself. The migration works on your own app, with your own login, onto your own accounts.
"You own everything you build on Base44: your code, your data, your users."
Read more: Do you actually own your Base44 app? →
"Escape base44 helped me take control of my app and move everything onto my own terms."
BigMike540, #reviews · Aug 7, 2026Read all the reviews →Will my migrated app be secure?
Yes, even more so than it was on Base44. The providers you migrate to are all industry standard, with SOC2 and ISO security certifications. Unlike Base44, their main focus is hosting; they are built to ensure apps run securely and reliably.
What data stays with EscapeBase44 after migration?
None of it. We don't store anything, and we have a signed NDA. After migration, we guide you step by step through revoking our access; then you're completely independent of EscapeBase44.
What happens to my Base44 app? Will it go down?
We don't touch your Base44 app at all; it stays exactly the same. The migrator works like "copy and paste" -- it duplicates everything directly onto your new providers. Your Base44 app continues running normally; there won't be any downtime.
You can point your users and domain at your new app whenever you're ready.
What if something goes wrong during the migration?
150 apps already migrated successfully. If something breaks, we fix it — or you get a full refund, protected by PayPal's money-back guarantee.
Can I talk to people who already migrated?
Yes, you can talk with others on our Discord; it's a community where people discuss leaving Base44. You can read reviews there from people who already migrated.
Is it legal?
Yes. Migrating doesn't violate Base44's terms of service. It's your app, and Base44 says so itself: "You own everything you build on Base44: your code, your data, your users."
Read more: Do you actually own your Base44 app? →