Your data should outlive my company

Self-hosting · 9 min read

Five weeks ago Airtable was bought by Bending Spoons for $1.285bn.

I am not going to tell you what happens to your bill. I don't know, and neither does anyone else writing about it this week. What I will say is that the acquirer has a public record: Evernote went from 341 people to 60 inside twelve months and the free plan was curtailed; WeTransfer saw staff cut and free limits tightened; TechCrunch traced the same cycle across five of their purchases.

I build a competing product, so discount me accordingly. But the question stands whether you ever talk to me or not, and it isn't really about Airtable. It's this: if the company holding your operational data changed its mind about you tomorrow, what would you actually do?

For most teams the honest answer is "export a CSV and hope." That is the problem I have spent this year on.

What "keep your own data" has to mean

It is a phrase every vendor uses and almost none of them mean, because meaning it is expensive. Here is the version I hold myself to.

It has to run without me. Not "we offer an enterprise self-hosted tier." Not "contact sales." The whole install is:

cp .env.example .env
node scripts/generate-keys.mjs
docker compose up

One container: the database, the API and the app together. Free tier. No licence clock, and nothing that phones home to ask my permission to keep working. If I am hit by a bus, the thing you installed keeps running exactly as it did the day before.

It has to be truthful about telemetry. There is a crash reporter and there are product analytics in the box. I would rather describe that accurately than write "no telemetry" and have you find the consent banner yourself. The crash pipeline stays inert until you set a key. The analytics ask first, honour Do Not Track, and post to your own instance rather than to me. The prompt the product actually shows on first run says it records page names and actions — never your data, never your record contents — and if you press No thanks, nothing is recorded and it does not ask again.

It has to be checkable rather than promised. Two scripts ship in the box:

bash scripts/rls-test.sh
bash scripts/tenant-isolation-test.sh

The second one proves two tenants cannot see each other in both modes — shared database and database-per-tenant. You run it against your own install. You don't take my word for the isolation, and you shouldn't.

The product this is attached to

None of the above matters if what you are self-hosting is a toy. The application I use to test this is a plant-wide manufacturing ERP: employees and gate entry, shifts and vacation, working stands, SOPs, items, bill of materials, warehouses and inventory, suppliers, purchase orders, customers, sales and production orders, quality, repairs, forwarders and shipments. Twenty-two pages, eleven workflows, one workspace.

Four things in there worth a technical reader's attention.

Field types that refuse bad input

Your database lets you type an IBAN wrong. So does every spreadsheet-shaped tool I have compared against — they store it as single-line text and hope, and you find out the money is gone about a week later. There are 90 field types here and 59 of them refuse malformed input by format or checksum.

Eleven of those are enforced in the database itself rather than in the browser: IBAN and LEI by ISO 7064 mod-97, ISIN and card numbers and IMEI by Luhn, the VIN transliteration, ISBN-10, ISBN-13 and the bare ISBN, EAN-13, UPC. Those hold when the row arrives through the REST API, a webhook, or an importer at 3am with no browser in the loop.

The rest — VAT, MIC, ICD-10, SNOMED, NDC, HS codes, UN/LOCODE — validate as you type, and that is deliberate rather than unfinished. Their rules are national registries and revisable code lists. A regex that is subtly wrong at the database level rejects a real customer's valid identifier with no way around it. A mod-97 cannot be subtly wrong. Narrow and correct beats broad and approximate on the write path.

A dashboard is just a page

There is no separate BI product bolted on the side. A page is a stack of elements, and there are 48 of them — table, list, gallery, kanban, calendar, chart, form, gantt, timeline, pivot and the rest. You drop a number tile on a page, point it at a table and an aggregate, and that is your dashboard. The morning-meeting screen for the ERP above is three number tiles and a chart: order book, output and stock, on one page.

Every chart type and every view is on the Free tier. That is an easier promise to keep when the charts are not a separate product with their own margin to defend.

Automations you can audit

Rules are the part of a low-code tool that rots quietly. Somebody builds one, leaves, and two years later nobody can say what fires, or whether it still does.

So the workflow list is workspace-wide rather than buried one table at a time. Each rule shows its trigger, its condition, the app and table it belongs to, whether it is on — and the part I care about most, whether it has ever run. "Never used" is a badge on the row, not something you go digging through logs to work out. The rules marked that way are the ones worth deleting, and the page turns that into a five-second judgement instead of an afternoon.

A seam for agents instead of a fight with them

"AI will make no-code obsolete" is half right: generating an interface is nearly free now, and the moat no-code had in 2019 is gone. The half that is not right is that your data still has to live somewhere — with permissions, with a backup you have actually tested, with something stopping the malformed row, with an audit trail when someone asks who changed the price. AI does not remove that. It makes it easier to skip until it hurts.

So there is an MCP server in the box, over stdio and HTTP. Your database becomes a tool the agent holds, scoped by row-level security, rather than something reached through a scraped API key.

The AI meter I deleted

On the 4th of August I deleted our AI billing meter. Not disabled — deleted. There is no credit balance in the product, nothing to debit, and no code path that can refuse your AI call to protect my margin.

To be precise, because someone will eventually read the code and I would rather they find me accurate than clever: usage is still recorded. Which model ran, for which feature, on whose behalf, and how many tokens your provider counted. That row exists so an admin can check it against their own provider invoice. Recording is not metering — nothing in that row decides whether your next operation is allowed, and no number in it is a price.

The reason is that I could not find an honest version of the alternative. Every AI credit pack I priced came out as a markup on someone else's model, dressed up as a feature. You would be paying me to pass your prompt along. So instead: bring your own key. Your provider, your rate, your bill. I never see it and I take no cut, on every plan including Free.

The one thing that can stop an AI call is a spend cap you set and you raise, so a runaway workflow cannot burn through your provider key at 3am. I do not earn a penny from it firing.

This removes a revenue line most of my category treats as core. I would rather explain that to an investor than explain a credit pack to a customer.

What I don't have

I am one engineer, and the fastest way to lose a technical reader is to let them discover a gap I hid.

We are not SOC 2 certified. Not ISO 27001. No HIPAA BAA. The test suite fails the build if those words appear on the homepage, which was deliberate. If a certificate is a hard gate for you this quarter, I am the wrong call this quarter, and I will tell you that on the first call rather than the fifth.

What exists instead is measurement, and you can read the recordings:

An older load run on a smaller database read p50 6ms. I am quoting the slower number because it is the current one.

The repository is private while this is early. So "run the isolation test yourself" today means asking me for access rather than a public clone. That is a decision I intend to reverse, not a permanent one, and I would rather say it plainly than link you into a 404.

It is one person. That is the risk you take on, and it is exactly why the self-hosted path above is not a marketing tier. It is the answer to the obvious objection.

If you want to look

There are no seat minimums, no charge for read-only viewers, no charge for the people who use the apps you publish, and no view or chart type held behind a tier.

If you are weighing a move this quarter, the useful ten minutes is not reading this post — it is opening your current bill and counting how many editors you pay for versus how many actually edit. Almost nobody knows that number offhand.

And if you want to test the switching cost rather than guess at it: send me your gnarliest formula from Airtable, monday, ClickUp, Smartsheet, Quickbase, Notion or AppSheet. 7 dialects are understood inbound, 279 functions on this side to land them in. I will paste it in and screen-record what happens — working or not. I will show you the failures too. Those are more useful to me than the wins.