Airtable App Audit

The exposures we find are rarely inside Airtable itself. They are share links created for one purpose and never revoked, and API tokens scoped far more broadly than the job they were made for. Both sit outside the permission model you think you are relying on.

It depends what you mean by safe. Airtable is reliable and well run. What it does not give you is enforced constraints, real relationships or protection against two people editing the same thing at once, which is what business-critical data usually needs.

They can be, because a shared view link works for anyone holding it, with no login and no expiry unless you set one. They get created for a client or a contractor, pasted into an email, and then stay live long after the reason for them has gone.

Only through something you created, which is precisely why it is worth checking. Share links, integrations and API tokens each open a path. Reviewing what currently exists is usually the single most valuable hour anyone spends on an Airtable estate.

It gets slower and more fragile. Record limits arrive sooner than expected, views become unwieldy, and the absence of enforced relationships means the same customer ends up recorded three slightly different ways with nothing to prevent it.

Not necessarily, and not all at once. Airtable is genuinely good at what it is good at. The question is which parts of what you run on it have become business-critical, because those are the parts that now need guarantees Airtable does not provide.

Revoking stale links and rescoping tokens is quick and removes most of the immediate exposure. Moving critical processes onto a real database is a project, and one worth scoping properly. The audit is £495 + VAT and covers both. Credited back in full against the work.

It is the right kind of audit if a real part of your business depends on it, which is usually why people ask. We are not reviewing how you use the product. We are asking the questions you would ask of any system holding operational data: who can reach it, what would one leaked credential expose, will the data still be correct in a year, and what happens when you hit the limits.

Sometimes, but not by default, and not without showing you the arithmetic. Airtable is a good fit for a lot of what it gets used for and moving costs real money. The cases where we do recommend it are specific: you are near the record limits, the automations have become business-critical, or you need transactional guarantees Airtable cannot give. Often the better answer is to tighten sharing and tokens and keep going.

For our own internal bits and pieces, like most people. We are not Airtable consultants and we do not sell Airtable builds. What we do is data models, credentials and the question of what a system exposes, which applies here as much as anywhere.