Yes, Airtable is a real software company: its about page says it started in 2012 and lists a San Francisco headquarters, and its security page cites a SOC 2 Type 2 audit and ISO/IEC 27001 and 27701 certificates. The bigger checks are on your side: who can edit, how plans renew, and what happens to deleted records.
Putting your customer list, project tracker or stock records into someone else's database is a bigger step than signing up for an app. If the tool vanishes, leaks or locks you out, it isn't just an inconvenience. It's your operations. So when people ask whether Airtable is legit, they're usually asking a sharper question: can I trust this company with data my business runs on?
That's the question this page answers. I'm Lilach Bullock, and in 23 years of marketing I've watched plenty of small teams move their spreadsheets into a no-code tool and only read the small print after something went wrong. I haven't tested Airtable for this page. What follows is what Airtable's own security page, terms of service and privacy policy say, what that means for a business owner, and what I'd check before moving anything live.
Who's behind Airtable
Its site describes Airtable as a next-gen app-building platform for business, and its plans page says it lets teams build custom business apps with no code. Its about page says the company started in 2012 on the belief that the people who know the work should build the systems, and it lists San Francisco as its headquarters.
That's a company with a public history, a named base and full legal pages, which answers the basic legit question. Its menus also list a Contact Support route and a help centre, so there's a route to a human if something breaks. Whether it's safe enough for your data is a separate question, and that's where its own documents get specific.
Data and security, straight from its own pages
Here's the short version of what Airtable says about protecting what you put in, laid out against the question a cautious owner would ask.
| Your question | What its pages say | What that means for you |
|---|---|---|
| Has anyone independent checked its security? | Its security page says it has undergone a SOC 2 Type 2 audit and lists ISO/IEC 27001 and ISO/IEC 27701 certificates | Outside auditors have reviewed its controls; you can ask for the latest SOC 2 report through its sales team |
| Who owns the data I put in? | Its terms say you, or your licensors, own the content you put into the service | Your records stay yours, not Airtable's |
| Can it read my records? | Its privacy policy says it won't use or access your content except in listed cases, such as running the service, support you approve, or legal requests | Access is limited to set purposes, so read that list if your data is sensitive |
| Can I control who sees what? | Its security page lists collaborator permissions, password-protected or domain-restricted share links, and record-level revision history | You can limit editing and see who changed what |
| Can I lock down logins? | It lists two-factor authentication for password logins, and SAML single sign-on on the Enterprise plan | Switch on two-factor from day one; SSO depends on your plan |
| Where is my data stored? | Its security page says customers can choose to have data stored in the European Union | Useful if you have UK or EU data duties |
| Which privacy laws does it cover? | It says its privacy programme is designed for GDPR, UK GDPR and the CCPA as amended by the CPRA, and offers a Data Processing Addendum to sign | If you handle customer data, sign the DPA |
The page also says Enterprise customers can store data at rest with customer-owned keys, that it publishes a current list of data subprocessors, and that security issues can be reported through a HackerOne bug bounty programme. It mentions HIPAA and a TX-RAMP Level 2 certificate too. Those are claims from Airtable's own page, so if a contract depends on any of them, ask for the paperwork rather than relying on a summary, mine included.
What happens to records you delete
This is the line I'd want every new user to read. Its privacy policy says you can access, correct, amend or delete your content, but that content you delete may be kept in archived or backup copies so features such as revision history and base snapshots keep working.
The same policy says you can ask for permanent deletion by contacting its privacy team, and warns that doing so may impair or disable some features, such as revision history and snapshots, for that content. So pressing delete in a base isn't the same as erasing something for good. If you hold personal data and someone asks you to remove theirs, factor that extra step into your process.
Billing rules to read before your team grows
Its plans page says a Free plan exists for individuals, very small teams and lightweight needs, with Team, Business and Enterprise Scale plans above it. My guide on how far Airtable's free plan stretches covers where those limits tend to bite.
- Per seat: its plans page says Airtable charges per seat, and on plans above Free every user with edit permissions counts. Inviting a freelancer as an editor adds a seat, so give view access where that's enough.
- Auto-renewal: its terms say subscription plans renew automatically for a term the same length as the original unless you cancel before the term ends. An annual plan rolls into another year.
- Cancelling: its terms say you can cancel at any time from your Account Settings page, and you keep access until the end of the current term.
- Refund rights: the refund right the terms describe is for customers in the European Union or Turkey who cancel within fourteen days of purchase. Outside that, don't assume you'll get anything back for an unused term.
The arbitration clause in its terms
Its terms contain a mandatory individual arbitration agreement, flagged in capitals. That means a serious dispute would usually go to individual arbitration rather than a court case or a group claim. It's common in US software terms and doesn't say anything bad about the company, but it's the kind of clause you should know about before you sign a business contract, not after.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Signs it fits your team, and signs it won't
Airtable fits you if you want to turn messy spreadsheets into a shared app without hiring a developer, you'll keep a tight list of who can edit, and you want independent security certificates on record when a client or partner asks how their data is handled. The EU storage option and the DPA are real strengths for anyone with UK or European obligations.
I'd skip it if your team is large and everyone needs to edit, because per-seat billing scales with every editor, or if you need deleted records gone the moment you press the button without contacting anyone. In those cases, compare it with Notion, Smartsheet, monday.com, Asana or plain Google Sheets. My roundup of tools people weigh up against Airtable lays those out side by side.
Three checks before you move a live workflow in
- Build one real base with a copy of your data and invite one colleague with edit rights and one with view rights, so you see exactly how seats and permissions behave.
- Switch on two-factor authentication, sign the Data Processing Addendum if you hold customer data, and choose EU storage if your obligations call for it.
- Set a calendar reminder a week before your plan renews, and write down how you'd export your data if you ever left.
If you're ready to start, my guide on setting up your first Airtable base walks through the basics. Do the three checks first, though. They take an afternoon, and they're the difference between trusting a tool and hoping it works out.
Frequently asked questions
Is Airtable a real company?
Yes. Its about page says Airtable started in 2012 and lists a San Francisco headquarters, and its site describes a no-code app-building platform for business. Its terms, privacy policy and security page are all public.
Does Airtable have security certifications?
Its security page says it has undergone a SOC 2 Type 2 audit and lists ISO/IEC 27001 and ISO/IEC 27701 certificates. It says you can request its most recent SOC 2 report through your account manager or its sales team.
Who owns the data I put into Airtable?
You do. Its terms say you, or your licensors, own the content you put into the service, and its privacy policy says you own the content you upload. Deleted content may stay in archived or backup copies unless you ask its privacy team for permanent deletion.
Does Airtable renew automatically?
Yes. Its terms say subscription plans renew automatically for a term the same length as the original unless you cancel before the term ends. You can cancel from Account Settings and keep access until the current term finishes.
Is there a free Airtable plan?
Yes. Its plans page says the Free plan is for individuals, very small teams and lightweight needs. Plans above it are charged per seat, and every user with edit permissions counts.
