[{"data":1,"prerenderedAt":348},["ShallowReactive",2],{"blog-is-safe/softr":3},{"id":4,"title":5,"body":6,"category":320,"date":321,"dateModified":321,"description":322,"draft":323,"extension":324,"faq":325,"featured":323,"headerVariant":332,"image":333,"keywords":334,"meta":335,"navigation":336,"ogDescription":337,"ogTitle":333,"path":338,"readTime":339,"schemaOrg":340,"schemaType":341,"seo":342,"sitemap":343,"stem":344,"tags":345,"twitterCard":346,"__hash__":347},"blog/blog/is-safe/softr.md","Is Softr Safe? No-Code App Builder Security Review (2026)",{"type":7,"value":8,"toc":310},"minimark",[9,13,16,22,29,34,37,40,47,53,57,60,63,66,73,84,87,93,96,102,106,109,115,118,124,128,131,137,140,156,159,163,166,172,178,184,190,193,197,200,206,212,218,224,230,234,240,246,252,286,305],[10,11,12],"p",{},"The most common Softr security mistake has nothing to do with Softr itself. It's a default data block setting. When you add a List or Gallery block in Softr and connect it to your Airtable table, the default loads every record in that table for every logged-in user. If you're building a client portal where Company A should only see their own data and you skip the \"Filter by logged-in user's email\" condition on that block, every authenticated client sees every other client's records.",[10,14,15],{},"That one missing filter causes the majority of multi-tenant data leaks in Softr apps.",[17,18,19],"tldr",{},[10,20,21],{},"Softr is safe as a platform: your Airtable API key lives server-side, the app requires authentication by default, and Softr's infrastructure handles SSL and managed hosting. The risk is record-level data filtering. Any block without a \"Filter by current user\" condition exposes all records to all logged-in users. For client portals, member databases, or any multi-tenant app, audit every data block before you go live.",[23,24,26],"verdict-badge",{"verdict":25},"caution",[10,27,28],{},"Use with Caution",[30,31,33],"h2",{"id":32},"what-softr-controls-platform-security","What Softr Controls (Platform Security)",[10,35,36],{},"Softr hosts on managed cloud infrastructure and proxies all data source connections server-side. Your Airtable Personal Access Token (PAT) never appears in browser requests. Softr's backend makes the Airtable API calls and returns only the filtered results to the frontend.",[10,38,39],{},"This matters more than it sounds. Tools that connect directly to Airtable from the browser leak the API key in network requests, extractable by anyone with DevTools open. Softr avoids this by design.",[10,41,42,46],{},[43,44,45],"strong",{},"Authentication options:"," password login, magic links, Google and Apple SSO (paid plans), and SAML-based SSO for enterprise integrations. Email verification is on by default for new accounts.",[10,48,49,52],{},[43,50,51],{},"What Softr does not control:"," which records get returned to which users. Record-level security is your configuration, not the platform's.",[30,54,56],{"id":55},"the-data-filter-vs-ui-filter-problem","The Data-Filter vs. UI-Filter Problem",[10,58,59],{},"This distinction catches most Softr teams.",[10,61,62],{},"Softr lets you hide blocks based on conditions: \"show this section only to users in the Premium group\" or \"hide this list from unauthenticated visitors.\" UI-level visibility controls are useful for navigation and layout. They are not a security boundary.",[10,64,65],{},"A hidden block can still be triggered by a user manipulating the DOM, navigating to a direct URL, or exploiting a logic error in the visibility condition. Some hidden blocks also make API calls in the background, fetching data before deciding to display it.",[10,67,68,69,72],{},"The only reliable security boundary is a ",[43,70,71],{},"record-level filter on the data block itself",". In the Softr editor, this means configuring each List, Gallery, or Table block with a filter condition like:",[74,75,80],"pre",{"className":76,"code":78,"language":79},[77],"language-text","Email field = Current user's email\n","text",[81,82,78],"code",{"__ignoreMap":83},"",[10,85,86],{},"or",[74,88,91],{"className":89,"code":90,"language":79},[77],"User ID field = Current user's Softr ID\n",[81,92,90],{"__ignoreMap":83},[10,94,95],{},"This filter runs server-side before any records are fetched. Only matching records come back. A logged-in user cannot access records they don't own by inspecting page source or manipulating requests.",[97,98,99],"danger-box",{},[10,100,101],{},"A block displaying all records from a shared Airtable table with no user filter means every authenticated user in your app can see every other user's records. Open Settings > Data > each block's filter configuration and verify each one has a current-user condition.",[30,103,105],{"id":104},"airtable-pat-scope","Airtable PAT Scope",[10,107,108],{},"Softr connects to Airtable using a Personal Access Token. That PAT has access to every base and table the connected account can see. If you use your primary Airtable account, Softr's connection spans your entire workspace.",[10,110,111,114],{},[43,112,113],{},"Fix:"," Create a dedicated Airtable account that has access only to the specific bases your Softr app needs. Generate the PAT from that account. When Softr queries Airtable, it operates only within those bases.",[10,116,117],{},"When creating the PAT in Airtable, expand \"Add a base\" and select only the relevant bases rather than granting workspace-wide access. This limits exposure if a misconfiguration returns records it shouldn't, or if Softr's integration ever has an incident.",[119,120,121],"tip-box",{},[10,122,123],{},"Airtable PATs support base-level scoping since the PAT rollout in early 2023. Always select specific bases rather than full workspace access when connecting third-party tools like Softr.",[30,125,127],{"id":126},"user-groups-and-row-level-access","User Groups and Row-Level Access",[10,129,130],{},"Softr's User Groups let you define roles (Client, Admin, Member) and restrict page access to specific groups. This is role-based access. It is not the same as row-level access.",[10,132,133,136],{},[43,134,135],{},"Group-level control"," alone doesn't prevent one \"Client\" from seeing another \"Client's\" records. Every user in the Client group can see whatever the block returns, and without record filters, that's everything.",[10,138,139],{},"For multi-tenant apps, you need both:",[141,142,143,150],"ol",{},[144,145,146,149],"li",{},[43,147,148],{},"Group-level restriction"," on the page (only Clients can see this page)",[144,151,152,155],{},[43,153,154],{},"Record-level filter"," on each data block (only records owned by the current user)",[10,157,158],{},"Testing this properly: create two test accounts in the same User Group with different emails and different records in Airtable. Log in as one. Check whether you can see the other account's records. If you can, filters are missing.",[30,160,162],{"id":161},"data-sources-beyond-airtable","Data Sources Beyond Airtable",[10,164,165],{},"Softr supports Google Sheets, HubSpot, SmartSuite, Notion, BigQuery, and PostgreSQL alongside Airtable. The same record-filter configuration applies, but how each source enforces filters differs.",[10,167,168,171],{},[43,169,170],{},"PostgreSQL:"," Softr translates block filters into SQL WHERE clauses that run at the database level. These are reliable.",[10,173,174,177],{},[43,175,176],{},"Google Sheets:"," Softr fetches sheet data and filters in its own processing layer. This is workable but less predictable than a database-level filter. Test thoroughly with multiple user accounts before trusting it for sensitive data.",[10,179,180,183],{},[43,181,182],{},"Airtable:"," Block filters pass as formula conditions to the Airtable API. These run server-side in Airtable before results are returned. Reliable when configured correctly.",[10,185,186,189],{},[43,187,188],{},"Notion:"," Filters operate through the Notion API's database filter objects. Behavior depends on the Notion database's own permission settings.",[10,191,192],{},"If you're switching data sources or using multiple sources in one app, retest your filters. The Softr editor may show correct results for your account during setup while failing for other users in production.",[30,194,196],{"id":195},"authentication-settings-to-review","Authentication Settings to Review",[10,198,199],{},"A few settings worth checking before launch:",[10,201,202,205],{},[43,203,204],{},"Password policy:"," Softr's default password requirements are permissive. Update minimum length and complexity in Settings > Users > Password Policy.",[10,207,208,211],{},[43,209,210],{},"Magic link expiry:"," Magic links stay valid for a configurable window. Reduce it for apps that handle sensitive business data.",[10,213,214,217],{},[43,215,216],{},"Session timeout:"," Configure how long users stay logged in after inactivity. The default suits low-sensitivity apps but is too permissive for financial or healthcare workflows.",[10,219,220,223],{},[43,221,222],{},"SSO over native password login:"," Google and Apple SSO inherit the MFA settings of those providers. If your users have Google accounts with 2-step verification enabled, SSO is more secure than Softr's native password login.",[225,226,227],"warning-box",{},[10,228,229],{},"Softr does not support MFA as a standalone second factor for native password logins as of 2026. If MFA is a compliance requirement, route authentication through an SSO provider (Google Workspace with 2FA enforced, Okta, Azure AD) rather than Softr's built-in password system.",[30,231,233],{"id":232},"what-softr-does-not-cover","What Softr Does Not Cover",[10,235,236,239],{},[43,237,238],{},"HIPAA:"," Softr does not advertise a standard BAA on regular plans. Airtable (the most common data source) requires its Enterprise Scale plan for HIPAA. The combination of both platforms for PHI needs a compliance review that goes beyond their standard terms.",[10,241,242,245],{},[43,243,244],{},"Audit logging:"," Softr does not provide a detailed access audit trail showing which user viewed which records and when. For regulated industries or high-security internal tools, this is a gap.",[10,247,248,251],{},[43,249,250],{},"Complex ownership logic:"," Softr handles \"current user's email = record's email\" filters cleanly. More complex multi-table ownership patterns (a user belongs to an org, the org owns records) require careful multi-step filter configuration and thorough testing.",[253,254,255,262,268,274,280],"faq-section",{},[256,257,259],"faq-item",{"question":258},"Is Softr safe for building client portals?",[10,260,261],{},"Softr is safe for client portals when you configure record-level filters on every data block. The platform handles hosting and authentication, but filtering records by logged-in user is entirely your configuration. A block set to show all records with no user filter exposes every client's data to every authenticated user.",[256,263,265],{"question":264},"Does Softr expose my Airtable data publicly?",[10,266,267],{},"Not by default. Softr apps require login unless you explicitly set pages to public access. The risk is between authenticated users: without record-level filters, every logged-in user sees every record in your connected Airtable base, not just their own.",[256,269,271],{"question":270},"Can Softr connect to data sources other than Airtable?",[10,272,273],{},"Yes. Softr supports Airtable, Google Sheets, HubSpot, SmartSuite, Notion, BigQuery, and PostgreSQL. The same record-filter principles apply across all sources, but enforcement varies. PostgreSQL filters translate to SQL WHERE clauses and are reliable. Google Sheets filtering is less predictable. Test each source carefully before trusting it for multi-tenant access control.",[256,275,277],{"question":276},"Is Softr HIPAA compliant?",[10,278,279],{},"Softr does not advertise a standard HIPAA BAA on regular plans. Airtable (the most common Softr data source) only offers HIPAA compliance on its Enterprise Scale plan with a signed BAA. Do not build a HIPAA-regulated workflow in Softr without a full compliance review of both platforms.",[256,281,283],{"question":282},"What does someone see if they inspect network traffic in my Softr app?",[10,284,285],{},"Requests go from the browser to Softr's own API, not directly to your Airtable base. Softr proxies all data source calls server-side, so your Airtable PAT is never visible in the browser's network tab. What is visible is the actual data returned by each block, which is exactly why record-level filtering matters: the filter runs server-side before data is sent to the browser.",[287,288,289,295,300],"related-articles",{},[290,291],"related-card",{"description":292,"href":293,"title":294},"Security review of Airtable for builders and teams: PAT scope, share link risks, HIPAA limits, and what to lock down.","/blog/is-safe/airtable","Is Airtable Safe?",[290,296],{"description":297,"href":298,"title":299},"Bubble defaults privacy rules to Everyone on every new data type. Here's what to lock down before you launch a Bubble app.","/blog/is-safe/bubble","Is Bubble Safe?",[290,301],{"description":302,"href":303,"title":304},"Step-by-step configuration guide for Softr: Airtable permissions, user groups, visibility rules, and the security checklist.","/blog/guides/softr","Softr Security Guide",[306,307],"cta-box",{"href":308,"label":309},"/","Start Free Scan",{"title":83,"searchDepth":311,"depth":311,"links":312},2,[313,314,315,316,317,318,319],{"id":32,"depth":311,"text":33},{"id":55,"depth":311,"text":56},{"id":104,"depth":311,"text":105},{"id":126,"depth":311,"text":127},{"id":161,"depth":311,"text":162},{"id":195,"depth":311,"text":196},{"id":232,"depth":311,"text":233},"is-safe","2026-06-23","Softr proxies Airtable requests server-side and keeps your API key out of the browser. The real risk is record-level filtering. Skip it and every user sees every other user's data.",false,"md",[326,327,328,330,331],{"question":258,"answer":261},{"question":264,"answer":267},{"question":270,"answer":329},"Yes. Softr supports Airtable, Google Sheets, HubSpot, SmartSuite, Notion, BigQuery, and PostgreSQL. The same record-filter principles apply across all sources, but how Softr enforces those filters varies. PostgreSQL filters translate to SQL WHERE clauses (reliable). Google Sheets filtering is less predictable. Test each source carefully before trusting it for multi-tenant access control.",{"question":276,"answer":279},{"question":282,"answer":285},"amber",null,"is softr safe, softr security, softr airtable security, softr user groups, softr data filter, softr no-code security, softr client portal",{},true,"Softr security review for no-code founders. Data-filter vs UI-filter, Airtable PAT scope, user group configuration, and what breaks if you skip the audit.","/blog/is-safe/softr","7 min read","[object Object]","Article",{"title":5,"description":322},{"loc":338},"blog/is-safe/softr",[],"summary_large_image","AaMWNUof167y03k6HL9xtHjRasdWKn1Gkui5RrqWoUY",1784736399080]