Rebuild · Base44

Base44 in production: patch or rebuild?

Base44 went from launch to a Wix acquisition in six months and to $100M ARR nine months later (Calcalist, 2026). If your app is one of the ones now carrying real work, company data, customer flows, maybe a funded product, this page covers what that growth curve means for you: what’s documented about the platform’s limits, what actually leaves the platform if you do, and a ten-question self-assessment that answers honestly whether you need a patch or a rebuild.

Take the ten questions → Book a 20-minute call →
leaves with you
frontend codeexported, but tied to the platform’s own infrastructure
app datacsv, excel or json — in 5,000-item batches
stays behind
backend logicai functions, server-side rules
database structureschema, indexes, relations
the auth systemsso, roles — the layer wiz research reached in july 2025
what you can carry out is the shell and the data
Sound familiar?

Their words, not mine.

If your version sounds like any of these:

  • The app does the job, but your security or compliance review can’t get past “the backend is a black box”.
  • Credits vanish into retry loops; the monthly bill is a guess.
  • You exported the code, looked at what came out, and realised the backend, database and auth stayed behind.
  • Post-acquisition changes worry you: McKelvey’s August 2026 review documents prices up 15–30% and support response times stretching from days to weeks since the Wix deal.
  • The “mobile app” turned out to be your web app in a wrapper: Base44’s own documentation describes it as running “your published Base44 app inside a secure web view”, without push notifications or full offline mode.

The exported code is tied to Base44’s own infrastructure, so it won’t actually run anywhere else without a serious rewrite.

reviewer quoted in Superapp’s Base44 review, August 5, 2026

Credit burn is unpredictable. The AI sometimes gets stuck on a feature, retries multiple times, and burns through credits without making progress. Users routinely report blowing through monthly allowances faster than expected.

Justin McKelvey, fractional CTO, after maintaining 8+ inherited Base44 apps, August 2026

Built an MVP, secured investment, but then considered leaving due to lock-in risks and scalability concerns.

user account summarised in CheckThat’s Base44 review aggregation, 2026
Why this happens

Bundled convenience has a flip side: bundled dependency.

Three things follow from that trade, and they are the reason this page exists: what the export actually hands you, what one disclosed vulnerability proved about inheriting a platform’s mistakes, and why a compliance review is usually where it all becomes concrete.

Base44’s genuine strength is that database, auth, hosting and integrations arrive as one bundle. No Supabase invoice, no separate deployment. That’s exactly why it’s fast, and exactly why leaving is not a download. The platform supports frontend code export, and app data can be exported in CSV, Excel or JSON. But backend logic, database structures and the auth system remain on the platform (documented in PlugThis’s expert review and CheckThat’s aggregation, both 2026). What you can carry out is the shell and the data. The running system stays.

The security dimension has one well-documented chapter. In July 2025, Wiz Research disclosed an authentication bypass in Base44: using an app’s app_id, retrievable from a public manifest file, an attacker could register a verified account on private enterprise apps, walking past SSO. Wiz reported it privately; Base44 fixed it within 24 hours (Wiz Research, Gal Nagli, July 29, 2025). Credit where due, the response was fast. The finding still matters for what it proves: apps built on a platform inherit the platform’s mistakes, and a bundled backend means you can neither audit nor fix that layer yourself. Wiz’s own framing was that the vulnerability “underscores security implications of AI-powered development” as a category, not a one-off.

For a team with a compliance surface, that’s the crux. SOC 2 or ISO reviews want to see who can access what, how it’s logged, and who fixes what breaks. On a bundled proprietary backend, the honest answer to all three is “the platform”. Some auditors accept that. Yours may not, and that’s usually the moment this page gets read.

The wider evidence on AI-built backends, with sources →
Patch or rebuild

Ten questions. An honest answer.

Not every Base44 app needs a rebuild, and this assessment will tell you if yours doesn't. No email required; the result shows immediately.

01 Where does your traffic come from?

Your app runs on servers in one physical place, and every click travels there and back, so a user in Singapore waits longer than one next door to the data centre. Base44 runs that infrastructure as part of the bundle, which means you don't choose where it sits or put copies nearer your users.

You don't control where a bundled backend runs; global users make that visible.

02 How big are the pieces of data you handle?

Small records are a customer row, an order, a form response: a few lines of text and numbers. Large files are signed contracts, scans, product images, video, and they strain storage and transfer in ways rows never do, on Base44 as anywhere else.

Note the export shape either way: data export runs in batches with a 5,000-item limit per request (CheckThat, 2026). Plan extraction time accordingly.

03 Does your data need to be queried later, or used once and dropped?

"Queried later" means you go back and ask the data questions: every invoice for this client last quarter, every employee whose review is overdue. "Used once" means it does its job in the moment and is done, like a notification that fires. Data you keep questioning has to be organised for searching, and on Base44 that organising happens inside a database you cannot reach into yourself.

Queryable business data on a backend you can't index yourself gets slower to work with as it grows.

04 Is your app read-heavy or write-heavy?

Reading is looking things up: dashboards, reports, someone opening a record. Writing is putting new data in: form submissions, imports, status changes, anything logged automatically. Many people can be handed the same answer at once, but writes have to be accepted one at a time and in the right order, which is where a bundled backend like Base44 runs out of room first.

Read-heavy internal tools are Base44's sweet spot; heavy write loads test the platform's limits sooner.

05 What genuinely needs to be real-time?

Real-time means the screen updates by itself, within a second, without anyone refreshing: a shared board where you watch a colleague move a card, a live queue, a chat. The honest test is whether a delay of ten or thirty seconds would actually break something. Most internal tools survive that delay comfortably; trading screens and live operations dashboards do not.

Real-time under load is where bundled platforms give you the least room.

06 Is the wall a hard platform limit, or the shape of your usage?

The difference is whether the wall moves if you change how you work. A hard limit stays put whatever you do: Base44 wraps your web app in a web view, so if you need a true native app with push notifications and offline use, no amount of clever building gets you there. Credits burnt in retry loops or a page that turned slow are usually habits, and habits can change, so if you haven't measured yet, say so honestly here.

The central question. Unmeasured credit burn can often be tamed. The web-view mobile ceiling can't; native is native.

07 Where does your business logic live?

Business logic is the rules that make your app yours rather than a spreadsheet: who gets approved, how a price is calculated, what happens when a deal closes. The question is where those rules physically sit, because rules built inside Base44 as backend functions and AI steps stay behind when you leave, while rules living in services you connect to can simply be pointed somewhere else.

Logic inside the platform layer is the part no export includes. That's the real cost of leaving, and it grows every sprint.

08 Is this internal glue or your product's backbone?

Internal glue is what your own team uses to work faster: an ops dashboard, an approval tracker, an onboarding checklist. If it breaks for an afternoon, colleagues grumble and work around it; if the thing customers pay for breaks for an afternoon, you are refunding money and explaining yourself to investors, and the standard it is held to is a different one entirely.

Internal tools can live with platform dependency. A funded product's backbone on an unauditable backend is a diligence finding waiting to happen.

09 What's your compliance surface?

Your compliance surface is how much of your app someone outside your company has the right to inspect. It appears the moment you hold personal data, HR records or payments, or the first time an enterprise buyer sends a security questionnaire or asks for SOC 2 or ISO. Those reviews ask who can access what, how access is logged and who fixes a flaw, and on Base44 the honest answer to all three is the platform, not you.

If an auditor will ever ask "show me the backend", the bundle is the blocker, not any single bug.

10 Who owns verification?

Verification is how you find out something broke before your customers do. Clicking through the app after a change only covers what you thought to click, and it quietly gets thinner as the app grows; a real layer means automated tests that run every time plus someone reviewing changes before they reach live users. On Base44 the AI writes much of the code, which makes that checking yours to own rather than optional.

On a bundled platform your own verification layer is the only one you control.

How to read your answers

Question 6 weighs heaviest: unmeasured cost and speed problems pull toward patch, hard ceilings (native mobile, platform performance, the bundle itself) pull toward rebuild. Questions 7 and 9 amplify: platform-locked logic and a compliance surface both raise what staying costs. For Base44 specifically, question 9 is often the decider; it was for the enterprise apps in the Wiz disclosure.

The rebuild

Keep what you proved. Own the whole thing.

How the work runs → The engagement and pricing →
01

What stays: the product and the experience. Base44 helped you find the flows that work; the rebuild treats them as the spec.

02

What changes: the bundle gets unbundled, on your terms. A database you can index, query and audit. Auth you configure and can show an auditor. Business logic in readable code under version control, with tests between every change and production. Native mobile if your product needs native mobile. And a bill that tracks usage instead of credits.

03

What comes back is more than what broke. The work spans product, business, design and tech in one head, so the rebuild also sharpens positioning and gives the design a senior pass. Measured where it counts: enterprise deals that stop stalling on the security review, support load down, shipping speed back, and a system that survives due diligence. That’s the rebirth: not the same app elsewhere, but the version the platform couldn’t let you build.

Who's behind this

Henrik Hallengren — 20+ years across product, tech, strategy and design; brands from Google to Mondelēz, worked with across roles and projects; production systems like the multi-tenant AI platform autoply built solo and running today. Independent: no platform ties, no referral fees.

The systems →About Henrik →
Next step

Start with the diagnosis.

Diagnosis: €7,500, fixed. One week. A written architecture review of your Base44 app: what the export covers, what has to be rebuilt, what it costs, and whether it’s worth it yet. Useful even if you stop there.

Book a 20-minute call

Guides for Base44