VendorScore · Database / no-code · Data-access posture
A plain-language answer from Airtable's public Trust & Security, Help Center and legal pages. EKM controls the keys; Airtable still decrypts your bases to run formulas, automations and AI.
Get the full 5-dimension PDF — join the waitlistEvidence dated 2026-10-07, public docs only, not legal advice.
Short answer
Yes, Airtable can read your bases by design (with controls). EKM encrypts record contents, attachments and history with your AWS KMS key and lets you revoke access, but Airtable decrypts content to run the service, and metadata and logs stay on Airtable keys.
Scored configuration: Airtable Enterprise Scale with Enterprise Key Management (EKM), using customer AWS KMS keys.
Default (no EKM): Airtable-owned keys; the report estimates Overall ~54.
Report confidence: Medium. No public statement on how Airtable support staff access content was found.
Higher = more customer control / less inherent vendor read access for the scored configuration. A strong SOC 2 doesn't mean the vendor can't read your data.
With EKM, admins can revoke key access per application, workspace or organization. User and team metadata and "sanitized logs" stay on Airtable-owned keys.
Evidence: Airtable EKMAirtable's AI Terms say it "will not use, or permit the Third-Party AI Providers or others to use, Input, Output, or any other Customer Data to train generative artificial intelligence models."
Evidence: Airtable AI TermsOur report flags these gaps in Airtable's public documentation:
Get the full 5-dimension PDF — join the waitlist
PDFs aren't for sale yet. Join the waitlist and we'll email yours when it's ready. No calls.
Yes, Airtable can read your bases by design (with controls). EKM encrypts record contents, attachments and history with your AWS KMS key and lets you revoke access, but Airtable decrypts content to run the service, and metadata and logs stay on Airtable keys. VendorScore rates Airtable 59/100 overall from public documentation (evidence dated 2026-10-07). Scored configuration: Airtable Enterprise Scale with Enterprise Key Management (EKM), using customer AWS KMS keys.
Airtable encrypts content in transit with 256-bit SSL/TLS and at rest with 256-bit AES, including backups. On Enterprise Scale, EKM encrypts record contents and comments, attachments, snapshots and history, change event logs and audit logs with your own AWS KMS key; admins can revoke key access per application, workspace or organization, and key use shows up in CloudTrail. User and team metadata and sanitized service logs stay on Airtable keys, and EKM "cannot be disabled" once on. It's not E2EE: Airtable still processes content server-side.
Airtable's Information Security Standards describe access controls "designed to limit access based on authorization", with provisioning, removal and periodic reviews of employee access to Customer Data. Its security practices article says Airtable is "committed to ensuring that your data is not seen by anyone who should not see it". VendorScore found no documented customer-approval gate for staff access, and Airtable's public docs don't describe its support-access process.
No, not for generative AI. Airtable's AI Terms say: "Airtable will not use, or permit the Third-Party AI Providers or others to use, Input, Output, or any other Customer Data to train generative artificial intelligence models." The AI Terms also say AI providers don't retain inputs or outputs on Business and Enterprise Scale; on lower plans they may be retained for up to 30 days for moderation.
VendorScore doesn't certify compliance; Airtable publishes a DPA at https://www.airtable.com/company/dpa. The DPA gives at least 10 days' written notice of new subprocessors, with an objection window of 10 business days, and offers SOC 2 reports and audits under conditions.
Airtable's core infrastructure list is short: AWS (infrastructure, email), Mailgun and Twilio (2FA). AI subprocessors (AWS, Anthropic, Google, IBM, OpenAI, Castle Global, Parallel, Reducto, Vercel) "will only process customer data for customers using Airtable AI". Support and other vendors include Forethought, Gong, PartnerHero, Pylon, Salesforce, Sierra, Workato, Zight, Zoom, Bright Data and Mapbox. The list is published at https://www.airtable.com/company/subprocessors.
Yes. Airtable says: "Airtable offers our customers the option to have their data stored in the European Union." Subprocessor locations in Germany and Ireland apply only for customers using European or Australian data residency.
Every URL cited on this page. Score, key findings and FAQ: VendorScore report (airtable.md), evidence dated 2026-10-07.