Category: Productivity
Secure Airtable browsing
Airtable has a SOC 2 Type 2 audit. It is also ISO 27001 certified. Your own risk sits in share links and browser sessions.
Quick answer
Airtable completed a SOC 2 Type 2 audit. It is certified to ISO/IEC 27001:2022. It also holds ISO/IEC 27701:2019 for privacy. SAML single sign-on is an Enterprise plan feature. Sharing settings decide what outsiders can see. Anyone with an unrestricted share link can open it. Paid plans add a password or email domain limit. Treat invite emails and record links as untrusted.
Last updated
2026-10-30
Main browser risks for Airtable
- Phishing that mimics Airtable share/invite flows and captures credentials.
- Accidental exposure from publicly shared bases or misconfigured permissions.
- Sensitive exports and attachments downloaded from untrusted contexts.
- Session hijacking and token theft risk when users authenticate and browse risky sites in the same session.
- Malicious links embedded in records (vendor sites, file shares) leading to malware or fake logins.
Typical sensitive data in Airtable
- Customer and lead lists (PII).
- Project plans, operations workflows, and internal process data.
- Attachments like invoices, contracts, and screenshots.
- Integration tokens and webhook endpoints (depending on setup).
- Employee data used in internal operations.
- Exports and CSV reports shared externally.
Which Airtable sharing option to use
| Sharing option | Who can open it | Use it for |
|---|---|---|
| Open share link | Anyone who has the link | Data you would publish anyway |
| Password-protected link (paid plans) | Anyone with the link and the password | Short-term sharing with a known outside group |
| Email domain-restricted link (paid plans) | People signed in to Airtable with a matching email domain | Sharing inside your company |
| Workspace or base collaborator | People you invite, with the permission level you set | Ongoing work that needs edit rights |
From Airtable's trust page and share menu help article, checked October 30, 2026. Turning off copying does not stop viewers copying single cells.
Recommended controls by role
IT Admins
- Add a password or domain limit to share links.
- Turn off copying out of views with sensitive data.
- Isolate unknown external links opened from Airtable records and attachments.
- Enforce extension allowlists through browser policy.
Support
- Treat customer links and files as untrusted.
- Keep customer data out of untrusted web tools.
- Use a dedicated browser profile for link-heavy support work.
Security
- Audit public sharing and enforce least-privilege permissions on bases.
- Monitor for unusual exports and mass downloads.
- Use isolation for investigating suspicious links or invite messages.
Where Shield fits with Airtable
The controls above are general security practices, not Legba features. Airtable is not a Legba integration.
Legba's part is narrow. Shield opens a page in an isolated browser off your device. Use it for a link you do not trust.
Limits
Shield moves page execution off your device. Downloads and copied data still cross that boundary. It cannot stop you sharing passwords with unfamiliar sites. Treat downloads and sign-in prompts with care.
Free for 30 days. No card required.
Airtable security questions
Is Airtable secure?
Is Airtable encrypted?
Can I password-protect an Airtable shared view?
Does Airtable support SSO?
References
- 01Airtable: Trust and securityAirtable
- 02
- 03
- 04
Keep exploring
- How to open a suspicious link safelyVerify the sender first. Isolate only what you must inspect.
- ShieldShield opens a page in an isolated browser off your device.
- All guidesThreats, secure apps, and AI security pages.
- All secure app guidesBrowse apps by category.
- Browser threatsUnderstand threats and mitigation patterns.
- AI security guidesBrowse guides about AI prompt leakage and prompt injection.
