Base44 Buyer's Checklist: Security, Export, Credits and Refunds

Is Base44 safe to pay for? For a business app that stores no health records or card numbers, yes, as long as you accept four conditions that most buyers only notice after checkout. Base44 was founded by Maor Shlomo, a Base44 guide says Wix acquired it in June 2025, and the platform is now run by Wix.com Ltd. Base44 says it holds SOC 2 Type II and ISO 27001 certification, but it cannot sign a HIPAA Business Associate Agreement. The conditions: on every plan except Enterprise your workspace data can train AI models, code export starts on Builder ($40 per month billed annually or $50 per month billed monthly) and still runs on Base44's backend, credits expire monthly, and plans are non-refundable.

Who holds your account, and what Base44 promises on security

Your contract is with Wix.com Ltd., which controls your personal information from Israel and acts as processor for the data inside your apps. Base44 says it encrypts traffic with TLS 1.2 or newer and stored data with AES-256, keeps secrets in a cloud key service, and shares its full SOC 2 report only under NDA through its Trust Center. One limit matters more than the badges. Data tables and private apps are not end-to-end encrypted, so Base44 admins can reach your data if needed.

The Terms also bar protected health information and payment card data unless Base44 agrees in writing. The rest of the responsibility lands on you. Base44's own pages say the app owner stays responsible for app security, the AI does not guarantee a secure setup, and default settings may allow public access. Treat the generated app as a draft to audit, not a finished system, and plan a review before real customers sign in.

• Run the built-in security scan (every plan, Free included); it warns in the publish panel but never blocks publishing.
• Make files in the app file library private: they open for anyone with the link until you change them.
• Act on any credit protection warning, which means outsiders could spend your credits.
• Ask whoever reviews the app about login tokens: they live in browser localStorage, not HttpOnly cookies.
• Stop here if the app will hold patient records.

Size the credits before you size the plan

Base44 sells a monthly allowance per workspace, not seats, and invited members share it. Starter costs $16 per month billed annually or $20 per month billed monthly and buys 100 message credits plus 2,000 integration credits a month ^[1]. Message credits pay for building: Base44 estimates about 0.5 credit for a simple change and 3 to 4 for an app-wide one, and Discuss mode about 0.3 per message. So 100 credits is not 100 changes.

Integration credits are the sneakier pool. Every time a visitor triggers a built-in email, AI call, image or agent reply, your workspace pays. Credits expire at each monthly reset, even on an annual plan, with one exception: a monthly-to-higher-monthly upgrade carries unused credits over for one cycle. Credits burned on failed AI output come back to nobody, and Version History is the only undo. The Base44 pricing guide sets out every plan's allowance.

• Count the changes you expect a month and multiply by 0.5 to 4 credits each.
• List which built-in services your app calls for every visitor; when they run dry, end users see a generic error.
• Accept that more credits means a bigger plan: Base44 does not publish a way to buy extra credits outside a plan.

Ownership, GitHub and an export that is not an exit

On paper, the code is yours. The Terms say you own the generated code and apps to the extent such rights exist, subject to Base44's own intellectual property, and warn that output may not be unique. Base44 claims no ownership of your data, yet it takes a perpetual, irrevocable, worldwide, sub-licensable license to that data and to the generated output, including to train its models, and it may use customer data in marketing. You also may not use the output to build a competing product.

Leaving is the harder test. Base44 says two-way GitHub sync exports the full source code (Builder plan and up); its developer docs add that the exported code still calls Base44's backend through its SDK, that Base44 does not support self-hosting that backend, and that data, secrets, app users and version history are not in the code export ^[2]. Moving out therefore means a replacement backend plus code changes.

• Starter lets you edit code in the app, but GitHub sync and ZIP download need Builder.
• Export your tables as CSV from the dashboard on a schedule; the ZIP never carries records.
• If an exit is likely within a year or two, budget developer time for a new backend now.

Your data and the models that learn from it

This is the clause buyers skip most. Only Enterprise workspaces are excluded from AI model training, and the exclusion is automatic there. On every other plan, Business included, workspace data can be used to train AI models and no opt-out setting exists ^[3]. Business here means part of Base44's Enterprise offering, which its help center splits into a self-serve Business plan and a sales-led Enterprise plan; neither price is published. Prompts also travel to outside model providers such as Anthropic, Google and OpenAI.

Location is the second check. Data sits in the US by default. Storage in the EU, the UK or Australia needs an Enterprise plan (Business or Enterprise), or Elite for workspaces created before October 2026. Residency covers storage, not processing, and only for apps created after mid-April 2026. Account details, billing data, public files and private files uploaded before mid-October 2026 stay in the US either way.

• Keep confidential client material out of a non-Enterprise workspace.
• If European customers expect EU storage, get the Enterprise quote before you build.

Plan gates to test against your feature list

Plan names hide the feature that forces an upgrade, and the pricing card lists only highlights. Before you choose, write down the three or four things the app cannot ship without, such as a custom domain, payments, a GitHub repository or single sign-on. Then match each must-have against this map of the lowest plan that unlocks it, and buy that plan rather than the cheapest one:

The jump most teams hit is Starter to Builder, because payments, connectors and GitHub all sit one step up. By our arithmetic that step costs $24 more a month billed annually ($288 a year) or $30 more a month billed monthly ($360 a year). Two smaller traps sit nearby. The free domain for one year comes only with yearly Starter (bought from early October 2026), Builder, Pro and Elite. And the Terms allow paid accounts only for trade, business, craft or professional use, not personal projects.

Money out, support and the fine print

Renewal is automatic, for the same term, at the price current at renewal and without earlier promotional discounts; Base44 may charge up to three weeks before the new term starts. Upgrades take effect at once on the saved card. A yearly plan cannot be switched to monthly, and no plan can be paused. Canceling stops the next renewal, keeps access to the end of the paid period, and returns nothing for that period.

Plans are non-refundable under Base44's Terms; its help center says Customer Care may approve a prorated refund, minus processing fees, for a mistaken purchase or special circumstances ^[4]. That changes the annual decision. Starter billed monthly for 9 months costs $180, under the $192 charged once for a year billed annually, while 10 months costs $200, by our arithmetic. Paying monthly wins only if you might stop within nine months.

After the paid period ends, the workspace moves to Free. Free keeps up to 5 apps published (with more than 5 you choose which; the rest are unpublished, not deleted); custom domains stop working, apps can no longer take payments, paid features such as backend functions and connectors stop, and your data stays in the workspace. A bank chargeback is harsher: it suspends the workspace at once. The cancellation walkthrough covers every step.

Gaps to price in before you sign

Some answers simply are not on Base44's pages. It does not publish an uptime SLA for self-serve plans; Enterprise contracts carry their own. Support runs through tickets, an AI assistant first and a human specialist after, in English only, and Base44 does not publish response times or support hours. Premium support appears only on the Elite card. There is no free trial of a paid plan, so Free is your test bench. And the Terms cap Base44's liability at the greater of the fees you paid in the prior 12 months or 100 US dollars.

• Decide what an outage costs you, since no self-serve SLA applies.
• Plan your own fixes: Customer Care does not debug your app's code, prompts or architecture.
• Read the arbitration clause: disputes go to individual arbitration, with 30 days to opt out.

The bottom line

Base44 clears the basic bar for a business app: a large owner in Wix, the certifications it says it holds, and a security scan on every plan. The checklist is about fit, not alarm. Pay only if you accept AI training on your data below Enterprise, a backend you cannot take with you, credits that vanish monthly and a no-refund rule. Health data, strict EU storage or a likely exit soon point elsewhere, or to an Enterprise conversation. For an internal tool or MVP, start on Free, then buy the lowest plan your feature list demands.