Compliance
The Base44 DPA, Explained
OffRamp · October 29, 2026 · 7 min read
Short answer: yes, Base44 has a DPA — available on request, part of its Terms. It covers GDPR processing terms, sub-processors, transfer mechanisms, and what happens to your data when you leave. What it does not do is give you portability: a signed DPA governs how Base44 processes your users' data, not whether you can take it with you.
The thirty-second version
What a data processing agreement is (and why Base44's matters to you)
The moment your Base44 app collects a name, an email address, or anything else that identifies a person, two legal roles snap into place. You are the data controller: you decide what gets collected and why. Base44 is the data processor: it handles that data on your behalf, on its servers, under its subprocessors. Under GDPR (Article 28), a controller may only use processors that provide sufficient guarantees — and the proof of those guarantees is a written contract between you. That contract is the Data Processing Agreement.
So the DPA question is not really about Base44's paperwork. It is about your compliance: if you run a Base44 app with European users and you cannot produce a signed DPA with your processor, that is your gap, not theirs. Base44 states it is GDPR compliant with a DPA available on request, and the DPA forms part of the Terms of Service governing the Base44 branded services — which, per the DPA's own Exhibit C, are operated by Wix.com Ltd. The paperwork exists. The question is whether you have a signed copy, and whether you know what it actually promises.
Everything below is drawn from Base44's own security page, its docs, and the published DPA exhibits (checked October 29, 2026). If the live documents ever disagree with this page, the live documents win.
The actual promises
What Base44's DPA covers
Stripped of legalese, the DPA makes six commitments worth knowing about. Read them as a checklist the next time an auditor — or a customer — asks what your processor guarantees.
Processing on your instructions
Base44 processes personal data only to provide the services, in accordance with the agreement. The nature, purposes, and duration of the processing are determined by you, through how you use the platform. Base44 may also use fully anonymized or aggregated data — a standard carve-out worth noting.
Technical and organizational measures
The DPA includes an exhibit of security measures: encryption of app data in transit (TLS 1.2+) and at rest (AES-256, backups included), secrets managed in a cloud KMS, plus regular penetration testing by internal and third-party teams. Platform certifications sit alongside it: SOC 2 Type II and ISO 27001.
Sub-processors, bound by contract
Base44 maintains a public sub-processor list (Exhibit C): Mongo for data storage and hosting, SendGrid for email, Render for server services, Google Cloud for analytics, OpenAI and Anthropic for LLM calls, Supabase for media hosting, DataDog for logging, and Wix.com Ltd itself. Every sub-processor is bound by written data-processing terms, and Base44 commits to notifying customers of planned additions or replacements, with time to object.
Lawful transfer mechanisms
Transfers of personal data outside the EEA, UK, or Switzerland use permitted mechanisms: adequacy decisions where they exist, the pre-approved Standard Contractual Clauses, or the EU-US Data Privacy Framework, of which Base44 is an active participant.
Help with data subject rights
The DPA commits Base44 to assist you with data subject requests — access, deletion, erasure. In practice: users can contact compliance@base44.com for data subject requests, and you can delete your own app's user data from the Users tab in the app dashboard. Base44 also supports a GDPR deletion flow for user data.
Return or delete on the way out
Upon termination — or on your request — Base44 will, at your choice, either return or delete all personal data it processed on your behalf, in accordance with the DPA. This is the clause to read twice, because “return” sounds like portability and is not. More on that below.
Getting the paperwork
How to get a signed copy of the Base44 DPA
Base44's security page describes the DPA as available on request — it is not auto-signed when you create an account. In practice that means asking: through your account contact, through support, or via the Trust Center linked from the security page. Ask for three things, not one:
- A countersigned copy of the current DPA. The terms are published as part of the Terms of Service, but an auditor wants a version with both parties' names on it — yours included.
- The current sub-processor list. Exhibit C is public, but sub-processors change; ask for the version current at signing, and confirm you are on the notification list for additions.
- The technical and organizational measures exhibit. This is the document that turns “we take security seriously” into a checkable list — encryption standards, access controls, testing cadence.
One more thing to confirm in writing: which of your workspaces and apps the DPA covers. If you run multiple workspaces — say, one per client — make sure the agreement's scope matches your actual footprint, not just the workspace you happened to ask about.
Where the data lives
Where the DPA says your data lives
The DPA's transfer mechanisms matter because the default answer is the United States: by default, your app data is stored in the US. On a Business or Enterprise plan, you can choose to store it in the EU or the UK instead. That choice is the data residency control — and residency controls where data is stored, not where every byte is processed, so the transfer mechanisms above still do real work.
Two caveats Base44's own docs state plainly: account and billing data stays in the US regardless of your residency choice, and residency options have varied over time by plan and app creation date — so verify what applies to your specific apps rather than assuming the current docs describe your historical setup. Our data residency page walks through the full picture, and the security page covers the platform certifications that sit next to the DPA.
The honest limit
What a DPA can't do for you
Here is the part most DPA writeups skip, and the reason this page exists on an OffRamp site rather than a law firm's. A data processing agreement governs how Base44 processes personal data on your behalf. It does not grant portability. Signing the DPA does not give you a database connection string, backups you control, or the ability to host the app anywhere else. “Return or delete on termination” means a data handover — an export — not a running app. A data export preserves the information. It does not preserve the working app, its logins, or its integrations.
The second limit is about your own integrations. The DPA's own text says it plainly: when you connect third-party tools through the platform and share personal data with them, that engagement is at your sole discretion — and Base44 advises you to review and execute terms for those integrations yourself. Your Stripe, your email provider, your analytics: each one needs its own DPA with you. Base44's DPA covers Base44. Nothing more.
None of this is a criticism of the DPA — it is a standard, serious document, and Base44's compliance posture (SOC 2, ISO 27001, published sub-processors, DPF participation) is genuinely stronger than most of its competitors'. It is simply a different problem from the one most people are actually worried about. The DPA answers “is my users' data handled lawfully?” It does not answer “do I actually own my app?” — ownership without portability is a lease, and a lease with excellent paperwork is still a lease.
The compliance argument for ownership
The DPA you sign with yourself: owning the stack
There is a version of this story where the DPA question gets simpler, not harder. When your app runs on infrastructure in your own name — your Supabase project, your Vercel account, your GitHub org — the processor relationships become direct: you hold the DPA with each vendor, you hold the keys, and the data lives in accounts you control. No intermediary decides the residency options, the sub-processor list, or what “return” means on the way out. Compliance stops being a document you request and becomes a property of the architecture.
That is what OffRamp builds: your Base44 app migrated onto Supabase, Vercel, and GitHub accounts in your name, where the database, the logins, and the integrations move with the code. The DPA paperwork gets easier because the chain of custody gets shorter. If your app has real users and real data obligations — HIPAA-adjacent or otherwise — start with a migration off Base44, and let the compliance story be the easy part for once.
FAQ
Questions, answered honestly
Does Base44 have a data processing agreement?
Yes. Base44 states it is GDPR compliant with a Data Processing Agreement available on request. The DPA is part of the Terms of Service governing the Base44 branded services, which are operated by Wix.com Ltd. You can find it via Base44's security page and Trust Center.
How do I get a signed copy of the Base44 DPA?
The DPA is available on request rather than auto-signed at signup. Ask Base44 — through your account contact, support, or the Trust Center — for a countersigned copy of the current DPA, plus the current sub-processor list and the technical and organizational measures exhibit. Those are the three documents an auditor will actually want to see.
Who are Base44's sub-processors?
Base44 publishes a sub-processor list as Exhibit C of its DPA: Mongo (data storage and hosting), SendGrid (email), Render (server services), Google Cloud (analytics), OpenAI and Anthropic (LLM calls), Supabase (media hosting), DataDog (logging), and Wix.com Ltd itself. All sub-processors are bound by data processing agreements with Base44, and Base44 commits to notifying customers of additions or replacements so you can object.
Where does Base44 store my app's data under the DPA?
By default, your app data is stored in the United States. On a Business or Enterprise plan you can choose the EU or the UK instead. Transfers outside the EEA, UK, or Switzerland use permitted mechanisms: adequacy decisions, Standard Contractual Clauses, or the EU-US Data Privacy Framework. Note that residency controls where data is stored, and account and billing data stays in the US.
What happens to my users' data if I cancel Base44?
Under the DPA, upon termination or on your request, Base44 will — at your choice — either return or delete all personal data it processed on your behalf. Read that carefully: return means a data handover, not a running app. A data export preserves the information; it does not preserve the working app, its logins, or its integrations.
Does signing Base44's DPA mean I can take my app and data elsewhere?
No — and this is the honest limit most DPA writeups skip. A DPA governs how Base44 processes personal data on your behalf; it does not grant portability. You still cannot take the database, user accounts, or backend off Base44's servers. The DPA also doesn't cover the integrations you add yourself — Base44's own terms say third-party engagements are at your sole discretion, so you need to review the terms of every integration you connect.
Compliant paperwork — but is the app actually yours?
A signed DPA covers how Base44 processes your users' data. It doesn't change who holds it. Migrate your app off Base44 onto Supabase, Vercel, and GitHub accounts in your name — where you hold the data, the keys, and the vendor relationships directly. Connect your Base44 account from the OffRamp home page. The free analysis takes about a minute, and your fixed quote comes with it.
Start your free analysis