The ACS Security Model
A secure platform is the foundation. Secure implementation is the work.
ACS combines Base44’s platform-level protections with application-specific access controls, data boundaries, integration safeguards, testing, and operational documentation.
Base44 Platform Security
An independently audited foundation.
Every ACS system runs on the Base44 platform. The controls below are Base44 platform-level protections, as published by Base44.
- SOC 2 Type II
- ISO 27001 certified
- GDPR compliant, with a Data Processing Agreement available from Base44
- AES-256 encryption for data at rest
- TLS 1.2 or higher for data in transit
- Encrypted secrets management
- Built-in security scanning
- Package vulnerability scanning
- Code vulnerability scanning where supported by the applicable Base44 plan
- Exposed credential detection
- Login verification checks
- Row-level and field-level data security
- Regular internal and third-party penetration testing
Source: base44.com/security
Available on qualifying Base44 plans
Additional Base44 controls available on qualifying plans may include organizational SSO, SSO enforcement, SCIM provisioning, IP allowlists, workspace audit logs, data residency choices, connector governance, and centralized workspace security controls. These are plan-dependent and are not part of every implementation.
The ACS Secure Build Standard
ACS configures and validates the application itself.
A secure platform doesn’t configure your permissions, your data boundaries or your integrations — that’s implementation work. These are the controls ACS builds and verifies in every system, scoped to what the system actually does.
Identity & Access
- Authentication required for private functionality.
- Roles defined around actual job responsibilities.
- Least-privilege access by default.
- Administrative operations restricted to authorized roles.
- Immediate removal or revocation paths for former users.
Data Boundaries
- Row-level security for record-level access.
- Field-level protection for sensitive fields.
- Customer, company, department, and user data separation.
- Public data explicitly separated from private operational data.
- Anonymous access reviewed and intentionally limited.
Backend Protection
- Sensitive operations performed through protected backend functions.
- Authentication and authorization checked server-side.
- Elevated service-role access never exposed to the frontend.
- User-controlled input validated before use.
- Errors do not expose credentials or sensitive internal details.
Connector Security
- OAuth and provider authorization used where supported.
- Only the minimum necessary connector scopes requested.
- Tokens and credentials stored in encrypted backend secrets.
- No API secrets embedded in frontend code.
- Webhook signatures or shared-secret verification used where applicable.
- Failed, duplicate, expired, and revoked connection scenarios tested.
- Human approval retained for sensitive or irreversible actions.
Launch Controls
- Base44 security scan run before production launch.
- No unresolved Critical or High findings at handoff.
- Medium findings reviewed and documented.
- Anonymous, standard-user, manager, and administrator access tested separately.
- Data permissions reviewed for create, read, update, and delete operations.
- Security headers reviewed.
- Major workflows tested for both success and failure.
- Material security decisions documented for the client.
Operational Protection
- Activity and audit records included where the system requires accountability.
- Backup, export, recovery, and rollback requirements defined during scoping.
- Data retention and deletion expectations documented.
- Security is reassessed after material system changes when included in the client's support or maintenance scope.
- ACS does not require a permanent retainer, but ongoing monitoring and maintenance can be scoped when the client needs it.
Compliance readiness
Built to support your requirements—not hide them behind a badge.
A secure platform can support a compliant system, but no software platform automatically makes an organization compliant. Compliance depends on the client’s data, workflows, policies, users, vendors, contracts, and ongoing operating practices.
- Data classification and minimization
- Consent and privacy boundaries
- Role and access mapping
- Record retention and deletion
- Activity history and audit evidence
- Vendor and connector review
- Human approvals and escalation paths
- Incident and recovery planning
- Data Processing Agreement review
- Client-specific regulatory requirements
ACS provides custom software design, implementation, and technical security controls. ACS does not provide legal advice, compliance certification, or an independent security audit. Clients remain responsible for determining the laws, regulations, contractual requirements, and industry standards that apply to their organization.
Regulated data boundaries
Where the honest answer is “it depends on review.”
Healthcare and PHI
A standard Base44 implementation is not HIPAA compliant, and ACS does not claim otherwise. Base44 currently states that it does not provide a standard signed Business Associate Agreement. Real protected health information must not be stored in a standard implementation without an approved BAA-compliant architecture and written review.
Payment Information
ACS systems use established payment providers such as Stripe or Square. Raw card numbers, CVV values, and unnecessary payment credentials are not stored inside the ACS application database.
Other Regulated Work
Financial, education, employment, government, and other sensitive-data systems require a specific review of data, access, retention, vendors, geography, and contractual requirements before launch.
The process
Security work, in order.
- Scope Risk
- Map Access
- Build Controls
- Test Boundaries
- Review Findings
- Launch & Document
Security should match the way your business actually works.
The Systems Audit identifies the information your business holds, who needs access, where it moves, and which controls belong in the final system.
Book a Free Systems Audit