Base44 is an AI app builder operated by Wix.com Ltd. This page is for a founder deciding whether Base44’s paperwork covers the app they already shipped. Checked against Base44’s public materials on 5 August 2026.
Base44 documents SOC 2 Type II and ISO 27001 credentials and publishes a Data Processing Addendum (DPA). Those are useful vendor-review artifacts. They do not establish that an app built on Base44 complies with GDPR, UK GDPR, HIPAA, or a customer’s procurement requirements.
Quick answers:
- SOC 2 Type II: yes. Base44’s trust center says the platform is SOC 2 Type II compliant and makes the report available by request under NDA.
- ISO 27001: yes. Base44 says it is ISO 27001 certified and links a certificate, and your app does not inherit that certification.
- GDPR: partly. Base44 publishes a DPA, a subprocessor list and transfer terms, and your app’s compliance is still yours to prove.
- HIPAA: no. No public Base44 BAA or HIPAA program was located as of 2 August 2026, and the Terms gate protected health information behind Base44’s prior written agreement.
- EU or UK data residency: conditional. It is available on Elite and Enterprise plans, and only for apps created after 16 April 2026.
- Canadian and US state privacy law: not addressed. Base44’s public materials cover EU and UK data protection, so PIPEDA, Quebec Law 25 and CCPA analysis is yours to do.
The certificates are real. Here is what they do not reach. Across 21 AI-built apps AxonBuild audited in June and July 2026, at least 5 exposed personal or health data outright and 7 let a logged-in user read or write another customer’s records. One of them sold compliance reporting and had no authentication at all. Another wrote its HIPAA audit trail after the clinical record had already committed, in a step that swallowed its own errors, so a change could persist with nothing to show it happened. No Base44 app has been through that audit yet, so none of that is a Base44 rate.
The HIPAA answer needs particular care. Base44’s public Terms say protected health information may enter the platform only when Base44 has agreed in writing and “the appropriate agreement is in place.” I could not find a public Base44 HIPAA program or standard Business Associate Agreement (BAA) as of 2 August 2026. That evidence does not prove Base44 refuses BAAs privately. If real PHI is in scope, do not upload it until Base44 confirms the permitted services in writing, the necessary BAA is executed, and qualified US healthcare counsel confirms the arrangement.
This article is technical and procurement information, not legal advice. EU GDPR, UK GDPR, and US HIPAA have different territorial and data scopes. Your role, users, processing purposes, contracts, and jurisdiction decide which duties apply.
What each of these words actually promises
Four different things get called compliance in this conversation, and they bind different parties for different reasons. Read this before the status table below, because that table assumes you already know the difference.
| Framework | Who it binds | What it proves | What it never proves |
|---|---|---|---|
| SOC 2 Type II | Nobody. It is a voluntary audit a vendor buys. | An independent auditor tested how the vendor operated its stated controls over a stated period, and wrote down the exceptions. | That your app is secure, that your data is handled lawfully, or that anything outside the audited system boundary was looked at. |
| ISO 27001 | Nobody. It is a voluntary certification. | The vendor runs an information security management system that an accredited body certified against the standard, within a declared scope. | That the scope covers the services you use, or that any specific app behaves correctly. |
| GDPR (and UK GDPR) | You, by law, if you determine why and how personal data is processed for people in scope. | Nothing on its own. It is a set of duties, not a badge, and no vendor can hold it for you. | That signing a vendor’s DPA discharges your lawful basis, transparency, rights, retention or security duties. |
| HIPAA | You, by law, only if you are a covered entity or a business associate handling PHI. | Nothing on its own. A vendor’s role is to sign a BAA and meet the terms in it. | That a platform with SOC 2 and ISO 27001 may hold PHI. Those are different regimes with different requirements. |
Two of these you buy, and two of these you owe. A vendor can hand you evidence for the first two. Nobody can hand you the second two.
Base44 compliance status as of August 2026
| Framework | What Base44 currently publishes | What remains unresolved for your app |
|---|---|---|
| SOC 2 Type II | Base44’s trust center says it is SOC 2 Type II compliant and makes the report available by request under NDA. | Review the report period, system description, control scope, exceptions, and complementary customer controls. It does not test your app’s authorization or privacy workflow. |
| ISO 27001 | The same trust center says Base44 is ISO 27001 certified and provides a certificate link. | Verify the certificate, issuing body, validity period, and statement of applicability against the services you use. Your app does not inherit certification. |
| EU and UK data protection | Base44 publishes a DPA, security measures, subprocessors, and transfer terms. | Determine the parties’ real roles, lawful basis, Article 9 condition for special-category data, transparency, rights handling, retention, security, transfer assessment, and incident process. |
| US HIPAA | The Terms of Service condition PHI on prior written agreement and an appropriate agreement. No public standard BAA or HIPAA service scope was located. | Confirm whether you are a covered entity or business associate, obtain the required written agreement, verify each covered service and subcontractor, and complete the required risk analysis and safeguards before ePHI enters the platform. |
The public contract set also deserves a procurement check. The Terms name Wix.com Ltd. as the company operating Base44. The DPA page still opens by naming Base44, Inc., while the current subprocessor exhibit describes Wix.com Ltd. and its subsidiaries and affiliates as the company. That naming mismatch may be resolved in an order form or executed DPA, but the public pages alone do not settle which legal entity signs your data-processing commitments.
How Base44 and Lovable compare beyond the certificates, on ownership, export and what each hands back, is a comparison of its own.
What Base44’s trust center actually claims
Base44’s trust center lists twelve named controls. Most procurement questionnaires ask about these by name, so here they are with what each one settles and what it leaves open for the app you built.
| Control Base44 names | What it does and does not settle for your app |
|---|---|
| Secure software development lifecycle (SSDLC) | Base44 says security sits at the core of every stage of how it designs, builds and maintains its products. That is Base44’s process, not the code the AI generator wrote for you. |
| Penetration testing | Internal tests plus third-party penetration testing of Base44’s environment. Your app’s own endpoints, IDs and permission rules are not in that scope. |
| Bug bounty program | Independent researchers are invited to disclose platform vulnerabilities responsibly. Nobody is being paid to find the missing owner check in your app. |
| Third-party risk management | A vendor program covering Base44’s own suppliers. It says nothing about the integrations and API keys you added yourself. |
| Secure payments and anti-fraud | Payment processing runs through PCI DSS certified providers. Card or payment data your app touches outside that path is your problem. |
| Authentication and SSO | Google SSO for individual users, and customer-managed SSO identity providers for enterprise organizations. Who can log in is a different question from who can read which row. |
| Built-in security scans | A scan of your app’s code for vulnerabilities before production. A clean scan is not evidence that the permission rules match your data model. |
| Data access control (row-level security) | Each dataset carries its own rules for who can read, write, create and delete records. The rules only protect anything if someone set them to match how the app really works. |
| IP allowlist | Admins can restrict workspace and app access by client IP address. Network-level control, not record-level control. |
| App visibility and governance | Each app can be set to Private, Workspace-only or Public, with enterprise governance controls. A private app can still let one signed-in user read another’s records. |
| Extensible security (GitHub integration) | A two-way GitHub integration lets you export the code and run external security tooling on it. Useful, and only if somebody actually runs it. |
| Application Security Center | Scans each app and steers builders away from common pitfalls. Guidance ranked by the platform, not evidence ranked against your real data flows. |
Read the pattern in the right-hand column. Every one of these controls is real, and every one of them stops at the line where your app’s own logic begins.
Does Base44’s SOC 2 or ISO 27001 status cover your app?
No. A vendor’s report or certificate concerns the systems and controls inside its defined audit or certification boundary. Your Base44 app adds a separate layer: entities, roles, permissions, integrations, retention behavior, logs, and the claims made to users.
| Vendor evidence can support | Your app still has to prove |
|---|---|
| How Base44 describes and operates controls within the report or certificate scope | Whether user B can read, change, or delete user A’s records |
| How Base44 manages parts of infrastructure security, incidents, and vendor governance | Whether your app collects only necessary data and sends it only to approved recipients |
| A due-diligence review of the platform as a supplier | Whether your policies, contracts, product behavior, and evidence satisfy the requirements that apply to your organization |
A SOC 2 report says an auditor checked how Base44 runs its own systems. Nobody audited whether your app checks who owns the row it just returned.
Base44’s own security overview separates platform protections from application controls. Its documentation gives builders data permissions and an Application Security Center. Those features help only when their settings and findings match the app’s actual data flows. Whether Base44 is safe covers that technical boundary in more detail.
Is a Base44 app GDPR compliant by default?
No platform setting can establish GDPR compliance for every customer. The same answer covers the German phrasing: DSGVO is the German name for the GDPR rather than a separate regime, so a Base44 DSGVO question and a Base44 GDPR question resolve identically. The EU GDPR applies according to Article 3’s territorial rules, and the UK GDPR has its own territorial scope. The factual relationship decides whether each party is a controller, joint controller, or processor. A contract label is relevant evidence, but the European Data Protection Board’s controller and processor guidance explains that the parties’ actual roles follow what they do.
Base44’s DPA says a customer may be a controller or processor and says Base44 acts as that customer’s processor for covered personal data. The DPA provides processor terms, security commitments, subprocessors, incident notification to the customer, assistance with data-subject requests, and transfer mechanisms. The customer still has to map the arrangement to the requirements in the EU GDPR, including where applicable:
- A lawful basis under Article 6 for each processing purpose.
- An Article 9 condition when health or other special-category data is processed.
- Clear information about purposes, retention, rights, and recipients or categories of recipients under Articles 13 and 14.
- A processor contract meeting Article 28 and a documented review of subprocessors.
- Data protection by design, appropriate security, and a DPIA when the planned processing is likely to create high risk.
- A working process for access, correction, erasure, restriction, objection, and portability where the relevant right applies. These rights have conditions and exceptions.
- An incident process that lets a controller assess whether notification is required. Article 33 gives a controller up to 72 hours, where feasible, after awareness of a notifiable breach; a processor must notify its controller without undue delay.
The UK’s current breach guidance uses the same risk-based distinction. Not every incident is reportable, but every breach should be recorded and the decision should be supportable.
Deletion is the one that breaks most often in AI-built apps because data is copied into uploads, logs, analytics, and integrations after the first delete route was written. The right to erasure is not absolute, so the correct behavior depends on the request and any valid retention duty. What an export has to contain and how long you’re allowed to keep any of it also depend on the applicable right, purpose, legal obligation, and retention policy.
Does EU or UK data residency make a Base44 app GDPR compliant?
No. Base44’s privacy and security documentation says US storage is the default. It says Elite and Enterprise workspaces can select EU or UK storage for apps created after 16 April 2026, subject to rollout availability. Existing apps do not move when the workspace setting changes; Base44 documents a clone, export, and import procedure, and warns that app users are not copied.
The same page says residency controls storage location rather than every processing location, and it is narrower than most people assume. Base44 documents the setting as covering the data and users shown under the Data and Users sections of your app dashboard. Media files uploaded to your app stay in the United States regardless of the setting, alongside your Base44 account details and billing information. An app that stores documents, scans or photos therefore keeps the heaviest personal data outside the region you selected.
Base44 also documents where the service is not available at all: Iran, North Korea, Syria, Cuba, Crimea, the Donetsk People’s Republic and the Luhansk People’s Republic, with substantial limitations on activity from the Russian Federation. If your users are distributed, check that list before you promise anyone availability.
Base44’s trust center names its subprocessors outright, and on 16 August 2026 it lists ten: MongoDB for data storage and hosting, SendGrid for email, Render for server services, Google Cloud for analytics, OpenAI and Anthropic for the model calls, Wix.com Ltd. for providing and improving the service, and Datadog, Langfuse and Logfire for logging. All sit in the United States except Langfuse in Germany, Logfire in the United Kingdom and Wix in Israel. The subprocessor exhibit to the data processing agreement, checked the same day, prints a shorter roster: it leaves out Langfuse and Logfire and adds Supabase in the United States for media hosting, which is where those uploaded files sit. If your privacy policy does not mention that prompts and app content can reach model providers, that is the gap to close first.
Residency can satisfy one contractual or risk requirement. It does not replace an Article 28 contract, Chapter V transfer analysis, transparency, data minimization, retention, rights handling, or application security. Record which Base44 features and integrations actually receive personal data instead of treating every listed subprocessor as a confirmed recipient for every app.
Canada and US state privacy law
Base44’s public materials answer EU and UK data protection. They do not address Canadian or US state privacy law by name, so that analysis is entirely yours, and the default storage region is the United States.
For Canadian users, PIPEDA does not ban sending personal information abroad. It holds you accountable for comparable protection while a third party has it, and it expects you to tell people their information is processed outside Canada where foreign authorities may be able to reach it. Quebec’s Law 25 asks more of anyone with Quebec users. Section 17 requires a privacy impact assessment before personal information leaves Quebec. Section 3.1 makes the person with the highest authority responsible for protecting personal information unless that role is delegated. The Quebec privacy regulator’s Law 25 summary says confidentiality incidents that present a risk of serious injury must be reported. Base44 documents no Canadian storage region, so US default storage plus a US-heavy subprocessor list is the starting position for every one of those questions.
For California, the state attorney general’s CCPA summary covers notice at collection, an opt-out of sale or sharing, and limits on the use and disclosure of sensitive personal information. California Civil Code section 1798.100 sets contract requirements when a business gives personal information to a contractor, service provider or third party. Other US states run their own versions with their own thresholds and definitions of sensitive data. Health information that sits outside HIPAA, which is most of what a consumer wellness app collects, often lands here instead.
None of this appears on Base44’s trust center, DPA or docs by name. The DPA’s processor terms may still carry a good deal of the contractual weight for these regimes. Somebody has to read it and check, rather than assume that GDPR-shaped paperwork covers a Canadian or Californian duty.
Is Base44 HIPAA compliant, and can it hold PHI?
The public materials do not support an unconditional yes. They support a stop-and-confirm answer.
HIPAA is a US regime that applies to covered entities and business associates, not every company holding health-related information. HHS explains the scope in its covered entities and business associates guidance. When a cloud provider creates, receives, maintains, or transmits PHI for a covered entity or business associate, the relationship generally requires a written BAA with the terms described in HHS’s business associate contract guidance.
HIPAA is three rules, and most searches mean one of them without saying which. The Privacy Rule governs how PHI may be used and disclosed, and what rights individuals have over it. The Security Rule sets administrative, physical and technical safeguards for electronic PHI. The Breach Notification Rule covers what happens when it goes wrong: notify affected individuals without unreasonable delay and no later than 60 days after discovery, notify HHS on the same 60-day clock when a breach affects 500 or more individuals, report smaller breaches to HHS annually, and notify prominent media when more than 500 residents of one state or jurisdiction are affected. Set that next to the GDPR figure above. GDPR gives a controller up to 72 hours to tell a supervisory authority; HIPAA gives 60 days to tell the people affected. Different clocks, different recipients, and an app with real users in both regimes owes both.
Base44’s Terms create two separate gates, re-read on 16 August 2026:
- Section 4.3 says specially regulated sensitive data, including PHI, may be shared with the platform only if Base44 expressly agrees in prior writing and the appropriate agreement is in place.
- The Restricted Use section separately bars any high-risk or regulated product, service or use case that does not fully comply with applicable laws and regulations, and bars using the platform to provide a service requiring a license or permit, with medical advice among its named examples, without holding one.
Meanwhile Base44 runs a marketing page headed “Build your own medical records app with AI”, promising “a fully functional medical records app in minutes” that “tracks medical history, schedules appointments, and provides reminders for follow-up care.” That page mentions no compliance regime at all. The platform sells the use case, and Section 4.3 puts the regulated version of it behind a door you have to knock on first. Platforms with a public HIPAA path publish the terms: as of July 2026, Supabase signs a BAA on its Team plan with a paid add-on, which is the shape of the thing Base44’s public materials do not show.
Platforms that do publish a HIPAA path. Supabase is not the only one. Caspio sells a HIPAA Edition that includes a signed BAA. Knack puts a signed BAA on its named HIPAA plans and states plainly that standard plans do not include one. Blaze says customers can process and store PHI once a BAA is executed. Those are public-materials observations as of 5 August 2026, not recommendations, and every one of those plans, prices and terms can move. What they share is that a founder can read the answer before talking to a salesperson, which is exactly what Base44’s pages do not offer.
A private written agreement might answer the first gate. It may not authorize every medical use described in a product idea. Ask Base44 to identify the exact services, regions, support paths, integrations, subprocessors, backup systems, and incident obligations covered by the proposed agreement. Have counsel compare that scope with the real workflow before any production PHI is introduced.
HHS recognizes two HIPAA de-identification methods: Expert Determination and Safe Harbor. Removing names alone does not establish either method. A prototype using synthetic data avoids putting real PHI into the platform, but other privacy, consumer-protection, medical-device, professional-licensing, and state-law questions can still depend on the product.
Base44’s own security record: what Imperva found in 2025
The certificates were live while Base44’s own platform had holes in it. In August 2025 the security firm Imperva published four findings from research it had reported to Base44 in March 2025:
- An open redirect in the login flow, at
app.base44.com/login?from_url=, that leaked access tokens and enabled account takeover. The first patch only checked that the redirect started with the trusted prefix, so a host likeapp.base44.com.example.comstill passed. A strict URL-validation fix followed in April 2025. - Stored cross-site scripting through
/apps-show/{app-id}, which rendered user-built apps on the trustedapp.base44.comorigin, so attacker JavaScript ran with access to a victim’s authentication tokens. - Premium editing enforced on the client side only, which meant the restriction could be bypassed by changing JavaScript in the browser.
- The main platform JWT passed into user-built apps through URLs, handing platform credentials to any script running inside those apps.
Imperva reported all four in March 2025. Its timeline records March fixes, then additional fixes and architectural work beginning in April. The write-up went public in August 2025. Base44 responded, which is the disclosure process working as intended. The point for a compliance reader is the timing. Every one of those flaws existed while the SOC 2 Type II and ISO 27001 badges were on the site, because a certificate is a statement about how an organization runs a process, not a guarantee that nobody will find a bug in the product.
What a certificate does not reach: what the audits actually found
That gap between a written control and a working one is the part of app-level data security that no platform certificate reaches. Nothing in the price list reaches it either, which is why what Base44 integration credits cost at runtime ends at the same boundary from the billing side. The two cases below come from the 21-app audit corpus mentioned at the top.
The clearest case in the corpus was an incident-timeline tool that marketed GDPR and HIPAA workflows. Its exported reports stamped “encrypted at rest” and “access logged” onto the output. Neither control existed. The app had no authentication at all, its AI-generated compliance verdict could be steered by text a visitor typed into the incident field, and it scored 57 out of 100. Nobody set out to lie. Someone asked an AI builder for a compliance report template, got one, and the template’s reassuring footer became a claim the moment a customer read it.
A second app failed the same way one layer down, and it is the one I would put in front of any founder who thinks a written control counts as a control. A multi-tenant health-data platform, sold as AI guardrails for clinical records, did write a HIPAA audit trail. The trail was written after the clinical record had already committed, in a step that swallowed its own errors, so a change could persist with no immutable record of it and still return success to the caller. The audit log existed, and on the days it would have mattered it was incomplete, with nothing in the app to say so. That is why AI coding tools ship security holes by default applied to a compliance control. The same split runs through whether Lovable is safe and whether Supabase is safe, on platforms whose certificates are just as real.
What your Base44 app still has to prove
Platform documents do not inspect your implementation. A useful technical review should verify at least these application facts, and the middle of the list is a self-check you can run on your own Base44 app in about ten minutes with a spare login:
- 01 Inventory personal data, special-category data, and possible PHI across entities, files, prompts, logs, email, analytics, exports, and backups. Record the purpose and recipient for each flow.
- 02 Determine whether your organization is a controller, processor, covered entity, business associate, or none of those for each workflow. Do not infer the answer from the platform or the word healthcare in the product name.
- 03 Obtain the documents that apply to your account: order form, DPA, subprocessor list, security report or certificate, transfer terms, and any proposed BAA. Confirm the legal entity and covered services.
- 04 Open every entity holding anything personal and read its permission level for all four operations. Creator Only or narrower, or you have a reason written down for why not.
- 05 Log in as a second account and try to reach a record belonging to the first, through an edited URL or ID, backend functions and direct API calls included. A result coming back is a cross-customer read, whether or not anything warned you at publish time.
- 06 Delete a test account, then go looking for its rows in every other entity: activity logs, uploaded files, anything analytics touched. Whatever survives is what a deletion request will not reach.
- 07 Try to export everything one account holds. If no route exists, an access request currently has no answer.
- 08 Force an error on a path that touches personal data and read what the log recorded. An error handler that dumps the whole request object writes that data somewhere new.
- 09 Read your own privacy policy against Base44’s subprocessor list and check that every LLM and logging vendor your app reaches is actually named in it.
- 10 Ask privacy or healthcare counsel to review legal scope, lawful basis, Article 9 conditions, transfer mechanism, notices, retention duties, BAA terms, and any sector-specific requirements before launch.
I can trace a defined failure in a working app’s data path and change the code. If one of the checks above fails in your app, talk it through with me on a free 20-minute video call. If you want the change made, I check the app and give you a fixed quote, and you pay after you see it working. That work excludes legal advice, regulatory or compliance certification, and penetration testing. It cannot decide whether a lawful basis applies, approve a transfer assessment, negotiate a BAA, or certify that an organization complies with GDPR or HIPAA.
Common questions about Base44 compliance
Is Base44 HIPAA compliant?
Base44’s public materials do not provide enough evidence for an unconditional yes. The Terms allow PHI only after prior written agreement and the appropriate agreement, while the restricted-use terms separately limit high-risk health-service uses. Obtain written confirmation, an executed BAA where HIPAA requires one, the exact covered-service scope, and counsel review before introducing PHI.
Can a Base44 app be made HIPAA compliant?
Possibly, and never by configuration alone. Nothing you switch on inside Base44 changes the answer, because both gates are contractual: Section 4.3 of the Terms allows PHI onto the platform only if Base44 expressly agrees in prior writing and the appropriate agreement is in place, and HIPAA separately requires an executed BAA carrying the terms HHS describes. No public Base44 BAA or HIPAA service scope was located as of 16 August 2026. Until both documents exist, no setting inside the app makes it compliant.
If both are executed, what remains is the app’s own work: the required risk analysis, the administrative, physical and technical safeguards for electronic PHI, a breach process running on HIPAA’s clock, and evidence that one signed-in patient cannot reach another patient’s record. Two paying accounts and an edited record ID give a first negative answer to that last one in ten minutes; settling it means repeating the test on every read, write and delete path a patient record travels, and no vendor agreement covers any of it.
Is Base44 GDPR compliant?
Base44 publishes a DPA, security materials, subprocessors, and transfer terms, and its trust center describes the platform as GDPR compliant. Your organization’s compliance remains fact-specific. The parties’ actual roles, lawful basis, special-category condition, transparency, rights handling, security, transfers, retention, and incident response all matter.
Does Base44 sign a BAA?
No public Base44 BAA or HIPAA program was located as of 2 August 2026, and the trust center names SOC 2 Type II, ISO 27001, GDPR and PCI DSS payment processors without naming HIPAA anywhere. Base44’s Terms allow PHI only after Base44’s prior written agreement and the appropriate agreement is in place, which leaves a private BAA possible but unpublished. Ask Base44 in writing for the agreement itself and the exact list of covered services before any real PHI goes near the platform.
Is Base44 compliant with Canadian privacy law?
Base44’s public materials address EU and UK data protection, not PIPEDA or Quebec’s Law 25, so nothing on its pages answers this. Storage defaults to the United States, EU or UK residency is limited to Elite and Enterprise plans for apps created after 16 April 2026, and no Canadian region is documented. If you have Canadian users, treat the cross-border transfer, the notice you give people about it, and Quebec’s assessment duty as your own analysis.
Does Base44’s SOC 2 Type II report cover my app?
No. It is vendor evidence about controls in Base44’s defined system and review period. Inspect the report and its complementary customer controls, then separately test your app’s permissions, integrations, logs, retention behavior, and user-facing claims.
Can I see Base44’s SOC 2 report?
Base44’s trust center says the SOC 2 Type II report is available by request under NDA rather than as a public download. Ask for the report period, the system description, the control scope, any noted exceptions, and the complementary user entity controls. Those complementary controls are the list of things the auditor assumed the customer would do, and they are the part that lands on your app rather than Base44’s.
Has Base44 ever had a security incident?
Yes. On 27 August 2025 the security firm Imperva published research describing four flaws in Base44 itself: an open redirect in the login flow that leaked access tokens, stored cross-site scripting from rendering user-built apps on the trusted app.base44.com origin, premium editing enforced client-side only, and the main platform JWT passed into user-built apps through URLs. Imperva reported them in March 2025 and Base44 fixed them by April 2025, with the first open-redirect patch bypassed before a strict URL-validation fix landed. All of it happened while the SOC 2 Type II and ISO 27001 badges were live.
Can an existing Base44 app move to EU or UK storage?
Base44 says changing workspace residency affects newly created apps. Its current procedure for an older app is to select the region, clone the app, export and import the data, and have users sign up again because users are not copied. Processing may still occur outside the storage region, so verify the complete data flow and transfer mechanism.
Built it with AI. Can’t get the last part right?
That’s the normal state of an AI-built app, and it’s fixable. I trace what the app actually does, explain what needs changing, and build it if you want me to.
Talk about your app → 
Free 20-minute video call with me.