AI App Builder Audits · AI Development Series

Airtable App Audit

Airtable stopped being a spreadsheet a while ago and became the system several parts of your business depend on. It is worth checking what it is handing out.

Straight answer: we do not sell Airtable consultancy. But an Airtable base that runs part of a business is a data model, a set of credentials and a sharing configuration — and that is what we audit. We look at what it exposes, not at how to use the product.

Book the £495 audit

Start here

What Airtable actually hands you

Airtable is rarely a deliberate architecture decision. It starts as a convenient list, and then interfaces get built on it, automations get added, other tools connect to it, and one day a meaningful part of the business is running on something nobody ever designed.

What a Airtable application is made of

Data Bases and tables, with per-record limits by plan
Interfaces Built-in views and dashboards for staff
Sharing Share links, which are public URLs
API A REST API over every base
Automations Triggers and scripted actions
Connected tools Softr, Zapier, Make and anything else holding a key

Two things account for most Airtable exposure. The first is share links: a shared view is a URL, and a URL is public to anyone who has it. They get pasted into emails, tickets and chat, and they do not expire unless somebody revokes them.

The second is API access. A token connecting a tool to a base typically has access to that whole base, and often several. Every tool, automation and former contractor holding one has that reach, and nobody keeps a list.

The pattern

What we consistently find

These are what we find when a business has grown into Airtable rather than chosen it.

Share links nobody remembers creating

A shared view is reachable by anyone with the address, with no login. They get created to show a client something quickly, then forgotten.

Because they are not tied to an account, there is no access log worth the name and no expiry unless somebody sets one. We enumerate them, because almost nobody can list their own.

What it costs you: live business data on a public URL, indefinitely.

Tokens with far more reach than the job needs

The token that lets your portal read one table usually has access to the entire base. Every connected tool holds one of these, and they rarely get rotated when people or suppliers change.

One leaked token is not one table; it is everything in the base.

What it costs you: a single credential exposing your whole operational dataset.

A spreadsheet holding a database's responsibilities

Airtable has no enforced relationships, no transactions, and per-base record limits. Linked records can point at deleted rows, two people editing at once can overwrite each other, and there is nothing preventing an invalid combination.

It works well for a long time and then stops working suddenly, usually as volume grows or when the automations start racing each other.

What it costs you: silent data corruption, and a hard ceiling you meet without warning.

Business-critical automations with no oversight

Automations send invoices, notify customers, update stock and move records between tables. They are built individually, are not version-controlled, and usually fail quietly.

When one stops working, the first sign is normally a customer asking where something is.

What it costs you: processes that stop running with nobody noticing.

Fair is fair

Where Airtable is genuinely good

Airtable is genuinely excellent at what it is for, and the fact that so many businesses end up running on it is a compliment rather than an accident. For structured operational data that a team maintains together, it beats both spreadsheets and a half-built internal system.

Genuinely well suited to

Structured operational data a team maintains together
Content calendars, inventories, CRMs and project tracking
Getting a process out of spreadsheets and email
Feeding portals and dashboards built on top of it
Teams who need to change the structure without a developer

Where it needs engineering behind it

Data that must stay consistent and reconcile correctly
Personal data, health data or financial records
Bases approaching the record or API limits on your plan
Processes that must not silently stop running
Anything needing a real audit trail or transactional safety

The honest summary: Nobody decides to run their business on Airtable; they arrive there one useful table at a time. The audit is usually the first occasion anyone has looked at the whole thing and asked what it is exposed to and where it stops working.

Meet the team

Prefer to watch? The short version of who we are and how we work

The offer

Do you need an audit?

Get it looked at if

A meaningful part of your operation depends on a base
It holds personal data or commercially sensitive information
Several tools or portals connect to it
You cannot list your active share links or API tokens
Automations run processes that customers depend on

You are probably fine if

It is a personal or small-team list of nothing sensitive
Nothing connects to it and nothing is shared externally
Losing it entirely would be an inconvenience, not a problem
It is well within your plan's limits and not growing

Common Questions

Questions about auditing a Airtable build

It is the right kind of audit if a real part of your business depends on it, which is usually why people ask. We are not reviewing how you use the product. We are asking the questions you would ask of any system holding operational data: who can reach it, what would one leaked credential expose, will the data still be correct in a year, and what happens when you hit the limits.

Sometimes, but not by default, and not without showing you the arithmetic. Airtable is a good fit for a lot of what it gets used for and moving costs real money. The cases where we do recommend it are specific: you are near the record limits, the automations have become business-critical, or you need transactional guarantees Airtable cannot give. Often the better answer is to tighten sharing and tokens and keep going.

For our own internal bits and pieces, like most people. We are not Airtable consultants and we do not sell Airtable builds. What we do is data models, credentials and the question of what a system exposes, which applies here as much as anywhere.

Explore More

Built with something else?

We audit what these tools produce, whichever one you used.

Other AI app builders

See every tool we audit →

The audit

Understand the risk

AI development, done properly →

Find out what you are sitting on

The AI Code Audit is £495, fixed.

Tell us roughly what you built and how many people use it. If an audit is not the right thing for you, we will say so.

What the report covers:

Every share link and API token, and what each one can reach
Base structure against what the business actually needs
Where you are against the record and rate limits on your plan
Which automations would fail without anyone noticing

We reply within one working day.