Access
Who can see your backup, in plain words.
The rules
Five rules, all of them checked every time
- 1
Everyone signs in with Airtable.
There are no AirtableBackup passwords. A person signs in through Airtable, which confirms who they are. If their Airtable account is deactivated, they cannot sign in here.
- 2
Being on the base is not enough. An owner has to invite you.
An owner or admin of the account adds people by email under Settings, People. Someone who collaborates on your base in Airtable but was never invited cannot open the console, see the backup, or restore anything.
- 3
Being invited is not enough either. Airtable has to list you on the base.
A person sees a base only while Airtable lists them as a collaborator on it, at edit or better. If your account backs up bases A and B and Airtable shares only B with someone, they see B. Base A is not in their list, cannot be chosen, and its data cannot be read through them.
- 4
When someone leaves, their access ends on its own.
The console re-checks these rules on every click, against a list refreshed every minute. Remove a person from the base in Airtable, or from the account under Settings, and within about a minute their next click ends their session and they cannot sign in again. There is no second list to remember.
- 5
Putting data back uses their own Airtable permission.
A restore, an undo or a batch fix asks the person to approve a short-lived Airtable grant in their own name, good for an hour and never stored. Airtable applies their permission and attributes the change to them, so nobody can restore into a base they could not edit.
Roles
What an owner, an admin and a member can do
Roles belong to the account, not to Airtable. An owner can do everything: billing, adding and removing bases, inviting and removing people, changing roles. An admin can do all of that except billing and owner changes. A member reads: the timeline, record history, past versions, health and exports. Any of them can restore, because restoring runs under their own Airtable permission, not the account’s.
Our own staff never use customer sign-ins. The operator panel has its own password and second factor, shows accounts and service health, and does not browse base data.
Edges
What this does and does not promise
- Base level, not field level. A person who can see a base in Airtable sees that base’s backup in full, including fields an Airtable interface may hide from them. Field- and view-level permissions are not mirrored.
- About a minute, not instantly. The collaborator list is refreshed every minute. A removal takes effect on the person’s next click after that.
- If Airtable cannot be reached. The console serves the last answer it had for fifteen minutes, then closes every session rather than guess. During that window an owner or admin can still reach a base whose connection needs fixing; a member cannot.
- Sessions last a day. A session that sits idle for a day ends, so Airtable confirms who you are at least daily. Someone at work all week does not notice: the session renews while it is in use.
How the data itself is protected is on the security page.