For years, software reached production through checkpoints security controlled: a ticket, a code review, a CI gate and a security sign-off.

AI app builders skip all of them. An HR coordinator describes an app in plain English and can publish it within the hour. 52% of organizations already build custom applications with AI. The opportunity is huge, and so is the need to secure it without slowing anyone down.

Base44 is where much of that building happens, no coding required. Base44 passed $100M in annual recurring revenue by early March 2026 and $200M ARR in August. JH Kelly builds department apps in about a week with a 4-person data team, and teams can go from an idea to a live app in a single day.

Every AI-generated app has the same parts: the builder, the site it runs on, the database, the login and, more and more often, an AI agent. Most stacks spread those parts across 4 or 5 vendors. Base44 puts all of them in one workspace. With its new Compliance API, it also gives enterprise admins one place to govern them: who can open an app, who can read its data and who its agents can talk to.

Base44 just launched its Compliance API, and Orca is ready on day one. Today, Orca is extending AI AppGen Security to Base44. It joins Vercel and Claude in the same risk model and alert queue you already use for AWS, Azure and Google Cloud.

You can’t block your way out of AI outside your pipelines. You secure it through the platform’s control plane, then rank its risk against everything else you run.

Base44 built the controls. Orca keeps drift in check.

A single Base44 app now leaves a trail in three places: its settings live in Base44, its code can sync to GitHub, and the data it touches sits in your cloud. Each place has its own security view, and none of them shows the whole app. Security teams end up asking three tools one question: can this app put us at risk?

Base44’s enterprise controls are the foundation: SSO enforcement, SCIM, audit logs, IP allowlists, a Security Center that scans app code, and now a Compliance API that opens workspace settings to the rest of the security stack. The next question for security teams is whether those controls stay on as builders publish new apps. 

Across AI app builders as a whole, drift is common for security controls. Escape’s passive scan of 5,600+ public vibe-coded apps found 2,000+ vulnerabilities, 400+ exposed secrets and 175 instances of exposed PII.

Take two apps from the same well-governed workspace:

  1. App A is a sales deal-tracking dashboard. It’s restricted to the workspace, each rep sees only their own records, and every admin uses MFA.
  2. App B is an HR onboarding portal published last week. Its builder switched it to public for a vendor demo and never switched it back, so its Employees table is now readable without login.

From the outside, both are just URLs. Only the workspace configuration, now readable through Base44’s Compliance API, shows that App B drifted from policy. 

The question isn’t “is anything misconfigured?”

It’s “which of these apps can actually create risk?”

Introducing the Orca Base44 connector

Orca’s connector is built on Base44’s new Compliance API, which gives enterprise admins a read-only view of how a workspace is set up. There’s nothing to install, and nothing to add to the builder’s workflow. The Compliance API is available to Base44 Enterprise customers. A workspace admin creates an API key with the Compliance API permissions and adds it to Orca’s Base44 connector.

Discover. Orca inventories apps, data schemas, backend functions, secret names, API keys, integrations, custom domains and AI agents, plus members if the admin allows it. It ties each app to the person who built it.


Inventory of Base44 apps and assets in the Orca Platform.

Govern. Orca checks the workspace against more than 30 out-of-the-box posture rules:

  • Data exposure: Public apps without login, data entity permissions that don’t match app visibility, public apps holding secrets, and backend functions with no login wall.
  • Identity: Admins without MFA, SSO that is configured but not enforced, guest SSO exemptions, and risky or stale API keys.
  • AI agents: Superagent and embedded-agent access settings, checked against each app’s visibility.
  • Workspace guardrails: Public default visibility, non-admins who can publish to the internet, a disabled IP allowlist, unrestricted iframe embedding, and domains that point at deleted apps.

Findings map to SOC 2, ISO 27001, NIST 800-53, GDPR, PCI DSS and HIPAA, so GRC teams get evidence without chasing app owners.


Security alerts for a Base44 app in the Orca Platform.

Context that tells you which app to fix first

In Orca, Base44 findings join the same Unified Data Model as the rest of your environment.

  • Exposure, ranked. Orca adds every live, published Base44 app to its exposure graph as internet-reachable. It then precisely prioritizes apps that combine public access with open data, secrets, outside connectors or anonymous agents. App B rises to the top, and App A stays quiet.
  • One queue for every AI builder. Base44 findings sit next to Vercel and Claude findings, with the same workflow, ticketing and compliance reports, and a named business owner on every finding.
  • Code and workspace, side by side. Base44 builders usually never see a pull request, yet their apps still produce code, and with Base44’s GitHub sync (Builder plan and up) that code lands in your repos. Orca already scans the repos you connect to. Now it also sees the workspace that published them: who has access, what is exposed, and what agents and connectors can reach. Base44’s Security Center also checks code inside the builder.

Builders keep their platform and their speed. Security gets enough context to approve apps instead of blocking them. That’s how AI AppGen Security turns “no” into “go.”

Want to see how Orca keeps your Base44 workspace enterprise ready? Book a demo and we’ll walk through a live workspace.

About the Orca Platform

Orca Security delivers security for the companies that build. As cloud, applications, AI and app generation expand the attack surface, Orca transforms security risk into the context teams need to act. The Orca Platform provides complete visibility across cloud, AI, and application environments, correlates risk across every layer, and prioritizes the exposures that matter most so organizations can remediate faster and innovate with confidence. Trusted by hundreds of organizations, including SAP, Autodesk, Gannett, Lemonade, and Digital Turbine, Orca is backed by leading investors including Temasek, CapitalG, ICONIQ Capital, and Redpoint Ventures.