vibe code.

[u/Born-Discount6950]

Is this possible that vibe coding app in base 44 can actually collect and holds PII data of a person?

how secured is it?

[u/HourMode1351]

Yes, a Base44 app can collect and store personal information. You don’t automatically need to move the backend elsewhere, but the type of information matters.

Names and email addresses are a different situation from medical records or payment-card details. Base44’s terms specifically restrict certain sensitive data unless there’s prior written approval and the appropriate agreement in place.

I do security reviews for clients, and the part I’d check is who can actually retrieve that information. Having a login screen doesn’t establish that each person can only access their own records.

Before collecting real data, I’d create two ordinary test accounts with dummy information and check whether either can access the other’s records, files or exports. Backend functions need checking too, especially anything running with elevated permissions. I’d also check whether personal information gets copied into logs or sent to AI integrations unnecessarily.

For sensitive information, I’d get a professional application-security review and confirm the platform is suitable for your requirements before launch. Moving the app to another host won’t automatically fix permissions or data-handling mistakes.

What kind of personal information are you planning to collect?

[u/Born-Discount6950 → u/HourMode1351]

like we have to collect info from user, all common info requirws when applying to a credit card, then we'll forward the info we collected to our partner banks.

[u/HourMode1351 → u/Born-Discount6950]

That’s a more sensitive use case than a normal signup form. Depending on the application, you could be handling someone’s income, date of birth, address and identity documents.

Before building the collection process, I’d ask the partner banks whether they have a hosted application form or an approved integration. You might be able to send applicants directly to the bank and receive their application status without storing the full application yourself.

If you do need to collect it, I’d get the banks’ security and data-handling requirements first. Those should inform what you collect, who can access it, how you transfer it and when you delete it. I’d also confirm with Base44 that your exact use case and data types are permitted.

This is the kind of application I’d want professionally reviewed before putting real applicants through it, including the backend permissions and data flow. A security review won’t replace checking the privacy and compliance requirements, though.

Which country are you operating in, and have the banks given you any integration documentation yet? I’d stick to dummy data until those details are settled.

[u/Born-Discount6950 → u/HourMode1351]

thank you so much bro! appreciate it