Airtable uses strong encryption to transmit data over public networks, including data transmitted between Airtable clients and the Airtable service.
For data in transit, Airtable supports the most recommended modern cipher suites, including AES-128 encryption, SHA-256 signatures and TLS v1.2 (when supported by the client). Airtable carefully tracks the latest developments in cryptography and industry-wide adoption of certain practices and implements the most up-to-date protocols and standards that are still supported by older clients. Airtable also encrypts customer data at rest using the AES-256 standard.
Airtable servers are located in the US, in data centers that are SOC 1, SOC 2 and ISO 27001 certified. Airtable’s data centers have round-the-clock manned security, automatic fire detection and suppression, fully redundant power systems, two-factor authentication and continual escorting for staff, visitors and contractors and audited physical access logs.
Airtable utilizes industry-leading Amazon Web Services (AWS) hosting infrastructure. High availability backups are stored redundantly across multiple availability zones to minimize any chance of data loss.
Airtable has developed, documented and tested business continuity and disaster recovery plans. Components of the disaster recovery plan include multiple site operations playbooks, which are regularly reviewed and rehearsed. Airtable’s operations team is on-call 24x7x365. For any service-impacting event, Airtable will work to restore availability with the highest possible urgency until service is restored.
Prior to hire, all Airtable employees undergo background checks, consisting of global, national and county criminal checks as well as identity verification. Upon hire and at least annually, all employees undergo security awareness, privacy and ethics training. Topics covered include: data privacy, account management, incident reporting and escalation, end device security, password security and data stewardship. At the end of such training, all employees confirm and acknowledge that they have read, understand and will follow Airtable security, privacy and ethics policies.
Those employees whose responsibilities require privileged access to certain systems or data (e.g., engineers, support personnel) undergo further training specific to their roles and privileges. All employees, regardless of access privileges, are required to follow security and privacy policies and playbooks, which include reporting issues and violations to the respective teams and individuals. All employees acknowledge that failure to do so may result in serious consequences, including termination.
Airtable has developed an employee handbook, a set of policies, standards, procedures and guidelines that guide employees towards responsible, ethical and acceptable behavior when using systems, accessing data, communicating with users and handling issues, no matter the context or venue.
All Airtable employees sign an agreement stating that they have read, agree to and will abide by the expectations laid out by the employee handbook.
All policies, procedures and other documents are reviewed and updated periodically and as required, with active and thorough communication to all employees if any changes are made.
Our security and privacy programs are led by our Head of Security, who holds chief responsibility for the development, implementation and oversight of these programs. Our entire product team, with years of experience operating in highly secure environments at leading technology companies like Google, Microsoft and Salesforce, supports the security team and contributes its collective knowledge in product security, incident response, risk and compliance and security operations.
Airtable follows the policy of least privilege when granting access to customer data to certain Airtable employees - these employees are only allowed access to the data that is absolutely required to complete their work or as part of a support incident, where access is approved by the customer.
All employee laptops are issued by Airtable to adhere to company security standards. All laptops are configured with data encryption, strong passwords and automatic locking after a short period of time. Employees are prohibited from installing unauthorized software or using unauthorized data storage services.
Airtable runs automated application-level security scans on a daily basis, package dependency security advisory scans on a weekly basis and endpoint scans on a monthly basis. In addition to internal scans, Airtable commissions external penetration tests from third-party vendors on a regular basis.
Airtable operates a bug bounty program to work with the security researcher community in identifying potential security issues. Airtable commits to responding to any reported vulnerabilities in a manner consistent with our high security and privacy standards.
Airtable team owners can manage and control each user's access by assigning them a permission level. The details of each permission level, including what each level is allowed or not allowed to do, are available in Airtable's support documentation. All data can only be accessed by other users if those specific teams or bases have been explicitly shared with those other users. In all other cases, other users will not have access to your teams and/or bases.
Airtable maintains a comprehensive view of the service’s infrastructure and security practices. To do this, the Airtable service monitors servers, workstations and mobile devices, generating and storing logs for review at a later time. These logs include audit, application, event and server logs, which track administrative access, all use of privileged commands and calls performed on production servers and networks. All actions in the Airtable application are logged. These logs are archived in AWS S3 for at least two years. Airtable deploys automated log analysis wherever possible to identify issues or anomalies - if any appear, the appropriate Airtable team members are notified. These alerts are resolved according to predetermined priorities and playbooks.
Airtable recommends enabling two-factor authentication for all users. With two-factor authentication enabled, for each time you log in, you will be required to access a mobile authentication app (like Google Authenticator), which will provide a one-time password that expires after a certain period of time. This extra step adds another layer of security and is available to every user.
Airtable Enterprise users can also enable SAML SSO (with any IdP supporting the SAML 2.0 protocol). By doing so, users across the enterprise can have a smooth transition in and out of Airtable, no longer requiring separate logins for the Airtable product. For IT and security teams, SAML SSO saves administrative time since it eliminates the need for things like password resets. SAML also increases security by maintaining control over authentication requirements and access at the centralized IdP.
Airtable utilizes an agile methodology for software development. As part of the development process, code and configuration changes are thoroughly reviewed and tested before being deployed. Review can include architecture or code-level review, as deemed necessary by the CTO or Chief Architect, as well as a specific security review by the Security Team. Changes also undergo thorough testing - as part of the quality assurance process for every Airtable update, acceptance testing is performed on multiple operating systems and browsers to ensure a consistent experience across all devices, platforms and browsers that are supported by Airtable.
In some cases, Airtable requires access to production servers and data to resolve issues (e.g., related to performance or customer-impacting errors). A deliberately small number of technical team members are granted this access via a combination of employee policy and technical controls. These team members are prohibited from using these privileges to access any customer data unless it is necessary to do so for operational reasons and the customer has allowed this access. To access the production environment via SSH, two-factor authentication is enforced by a bastion host where one authentication factor is a per-user password-encrypted RSA-2048 SSH key, which can be individually disabled, and the other factor is a time-based one-time password.