The 2026 No-Code CIO Buyer's Guide: 10 Questions Platform Demos Don't Answer

No-code platform demos are brilliant at showing you what you can build in twenty minutes. They're terrible at showing you what happens two years later when procurement, security, and legal get involved.

I've watched dozens of these demos. Someone drags together a CRM in the time it takes to order lunch. The room is impressed. Someone from IT raises a hand and asks about SSO. The salesperson says "that's on our enterprise plan." The conversation pivots back to drag-and-drop magic, and nobody asks the hard questions.

This guide is the antidote. Ten questions drawn from real gaps across the major platforms: Bubble, Webflow, Airtable, Glide, Softr, Stacker, Retool, and AppSheet. Answers sourced from published documentation, trust centres, DPAs, and pricing pages as of July 2026. Where a platform doesn't publish something, I've said so.

TL;DR: No-code platforms hide procurement risk in three areas: security features gated behind 3x-5x price jumps, disaster recovery plans that don't exist on paper, and AI subprocessor lists your compliance team hasn't seen. Ask these ten questions before signing anything.

1. How much will SSO actually cost us?

If your organisation uses Azure AD, Okta, or Google Workspace, SAML is basic security hygiene. There is exactly one major platform that gives you SSO on every paid tier: Stacker, where SAML ships with the Standard plan at $50/month. Every other platform gates SSO to Enterprise or its highest self-serve tier. Airtable requires Enterprise Scale (custom pricing). Bubble, Webflow, Glide, Retool, and Softr all do the same. AppSheet is the partial exception: SSO comes through Google Workspace identity, which means you need Google Workspace.

The price jump from non-SSO to SSO tiers is frequently 3x to 5x. At Retool, going from Team ($10/builder/month) to Enterprise (custom, typically $60K+/year) makes SSO the single most expensive checkbox in procurement.

Evidence to request. A redacted enterprise agreement showing SSO as included, not a paid add-on. Confirm whether SCIM is included or extra.

Red flag. "Contact us" pricing with no written quote at your user count.

2. Where does our data live, all of it?

Residency means application data, backups, logs, telemetry, support tickets, subprocessors, and AI inference calls. A platform that stores app data in Frankfurt but sends support tickets to Zendesk in the US has a residency gap. One that runs AI through OpenAI's US API does too.

Airtable publishes the most detail: EU data on Enterprise Scale lives in AWS Frankfurt with backups in Frankfurt AZs plus Ireland, and Enterprise customers can restrict AI to AWS Bedrock within the VPC. User metadata and support data stay in the US regardless. Bubble Enterprise offers roughly 15 AWS regions. Softr defaults to AWS Frankfurt but its AI runs through OpenAI's US API.

Glide is US-only and lists seven AI subprocessors including three Chinese vendors: DeepSeek, Moonshot AI, and Z.ai. If you work in a regulated industry, that list should set off every alarm. Webflow and Retool Cloud are US-only with EU options on Enterprise. Stacker does not publicly disclose its data centre locations. There is no trust centre. Community questions about EU hosting from January 2026 remain unanswered.

Evidence to request. A current subprocessor list showing jurisdiction per subprocessor. An architecture document mapping where AI inference happens relative to your data region.

Red flag. "Our cloud provider handles that" without specifics. AI features routing through a US-hosted model with no opt-out.

3. Will you sign a BAA?

If your app handles patient names, appointment data, or anything that could be PHI, you need a Business Associate Agreement. HIPAA-compliant infrastructure without a signed BAA is theatre.

Airtable, Bubble, Webflow, Glide, Retool, Stacker, and AppSheet all offer BAAs on enterprise or custom tiers. None on self-serve plans. Softr does not offer a BAA at all. AppSheet's path is the most complex: the BAA comes through Google Workspace Enterprise Plus, not AppSheet directly.

Evidence to request. A sample BAA template covering all data types including file attachments and AI-processed data.

Red flag. "We're built on HIPAA-compliant infrastructure" but no signed BAA.

4. What do your audit logs actually capture?

The gap between what platforms say and what they log is enormous. Airtable has the most mature system: 26 event categories, 34 tracked model types, REST API with streaming, 180-day retention, on Enterprise and Enterprise Scale. Retool logs 80+ event types with CSV export and 1-year retention from the Business plan.

Bubble says "enterprise-grade audit logs" but doesn't publicly document what's captured. The "Run As" admin impersonation feature doesn't leave an audit trail. Stacker's Activity Feed states: "we don't have logs or audit trails on who deleted the record." Activity cannot be exported. Softr logs schema changes only, no record-level data changes. Glide logs billing events and logins; full audit trails are Enterprise-only. AppSheet captures user data changes with BigQuery export, though forum threads report gaps in recording.

Evidence to request. A complete list of audited event types. Ask them to show you a record deletion in the audit log. If they can't, that's your answer.

Red flag. "Audit logs" that don't capture deletions. UI-only logs with no export. Retention under 90 days.

5. Who can see what, and can you prove it?

Row-level security, "this salesperson can only see their own accounts," is surprisingly rare. Field-level security is rarer still. Only two platforms offer both enforced server-side: Bubble (Privacy Rules) and Stacker (RBAC with record-level and field-level CRUD).

Airtable has field-level permissions on Business+ but no native row-level security, a long-standing gap. Glide has Row Owners but visibility conditions are UI-only. The community recommends building separate apps for admins and users. Softr has server-side row-level via Conditional Filters but no field-level permissions. Retool and AppSheet require permissions to be implemented manually in queries. Webflow has no row-level or field-level permissions at all.

Evidence to request. Create a restricted record, then try accessing it directly via the API. If the API returns it, the permissions are cosmetic.

Red flag. Platforms recommending separate apps for different user classes as a security workaround.

6. How do you handle vulnerabilities and incidents?

Airtable runs a public HackerOne bug bounty, the only platform with a fully public paid programme. AppSheet inherits Google's VRP. Webflow has a Bugcrowd VDP (not paid). Retool published a detailed post-mortem of an August 2023 breach, the only platform to publicly document a security incident. Bubble has a VDP with safe harbour. Softr runs a severity-based bounty. Glide does annual pen testing but no formal bounty. Stacker explicitly states it "does not currently operate a formal disclosure or bounty program."

Across all eight platforms, not one publishes an incident response SLA beyond "without undue delay." Not one publishes pentest results without an NDA.

Evidence to request. Most recent third-party pentest summary under NDA. The incident response plan section covering customer notification timeline.

Red flag. No security contact on public pages. No VDP. SOC 2 claims without a verifiable trust centre.

7. Which AI models are you using, and what happens when they change?

Nearly every platform now ships AI features. Few make contractual commitments about model providers.

AppSheet is simplest: only Google Gemini, first-party. Retool is most flexible: OpenAI, Anthropic, Azure OpenAI, Bedrock, Gemini, Cohere, plus custom providers, with Enterprise BYO API keys so you control the model relationship directly. Airtable uses OpenAI, Anthropic, Google, IBM, and Meta, but Enterprise can restrict to Bedrock-only within the VPC, with contractual commitments against training on customer data. Bubble uses Claude Sonnet 4.5. Softr uses OpenAI only. Webflow uses OpenAI, Anthropic, and Google.

Glide has the widest AI list: OpenAI, Anthropic, Azure ML, Google Cloud, plus DeepSeek, Moonshot AI, Z.ai, and OpenRouter (300+ models). Three Chinese vendors, no customer routing controls. Stacker does not disclose which AI models it uses at all.

No platform contractually commits to advance notice of model provider changes.

Evidence to request. Current AI model providers with processing locations. A commitment on training data usage. The process for notification of model changes with a right to object.

Red flag. Undisclosed model providers. Chinese AI vendors in subprocessor lists with no opt-out.

8. How do we get our data out?

Webflow has the strongest story: full site export including HTML, CSS, JS, and images on all plans including free. Retool and Stacker are presentation layers on your own databases, so data was always yours. Airtable offers full base CSV export, attachment export, and REST API. Bubble has Data API and JSON/CSV export. Glide data lives in Google Sheets or Glide Tables, both exportable. AppSheet integrates with Google Takeout.

Softr is the outlier: data in Airtable or Google Sheets is independently exportable, but Softr configuration, pages, permissions, workflows, is not.

Evidence to request. Test-export a non-trivial base during evaluation. Check whether related records stay related and attachments come through.

Red flag. "Contact support" as the export mechanism.

9. What will this cost in year three?

No-code pricing has been volatile. Airtable in Q3 2025: Plus ($10/seat) to Team ($20/seat), a 100% increase, and Pro ($20/seat) to Business ($45/seat), a 125% increase. Webflow raised prices twice in under six months during 2025-2026, with monthly costs up 39% for some users in May 2026. Bubble introduced mobile pricing in October 2025 adding 40-75% for web+mobile plans. Glide progressively reduced Business update limits from 25K to 10K to 5K. AppSheet consolidated Enterprise Standard into Enterprise Plus ($20/user), a 100% increase.

Softr has held prices steady through 2025-2026. Retool and Stacker have been relatively stable.

Usage-based pricing carries the most year-three uncertainty: Bubble's Workload Units, Glide's updates, Retool's workflow runs and agent hours all create variable costs hard to predict at signing.

Evidence to request. Price change history for your plan type over three years. A multi-year price cap. Written pricing for three usage scenarios.

Red flag. Multiple price increases in an 18-month window. Shrinking plan limits at the same price point.

10. Who owns you, and what's your recovery plan?

AppSheet is owned by Google: won't run out of money, but the 2026 strategy update ("stability and availability focus, reduced new features") reads like maintenance mode. Airtable is independent, cash-flow positive, roughly $700M in the bank, the safest longevity bet. Bubble is founder-controlled, well-capitalised. Webflow is independent at a $4B valuation. Retool at $3.2B, though last raise was July 2022. Glide last raised in April 2022. Softr last raised $13.5M in 2022. Stacker raised roughly $3.5M in seed, the smallest capital base here.

On disaster recovery: only two platforms publish RTO/RPO targets. Webflow: RPO 1 hour, RTO 24 hours. Glide: RTO 5 days for data centre loss, RPO roughly 24 hours. A 5-day RTO means a working week of downtime. Airtable, Bubble, Retool, Softr, and AppSheet publish nothing quantifiable. Stacker's terms disclaim backup responsibility onto the customer. This is the weakest area across the entire category.

Evidence to request. RTO and RPO in the contract, not the marketing page. Evidence of the most recent DR test. For smaller platforms, a continuity plan.

Red flag. Terms disclaiming backup responsibility. "We run on AWS so we're fine."

The takeaway

Ask about SSO on the first call. It's the fastest way to surface whether pricing is transparent or theatrical. If SAML requires a call with someone who can't give you a number, the platform is hiding cost complexity elsewhere.

Treat unpublished DR and audit capabilities as absent, not "probably fine." Six of eight platforms publish zero RTO/RPO targets. Half don't publish a full audit log event catalogue.

AI model dependencies are the new supply chain risk. Three platforms have Chinese AI vendors in their subprocessor lists. One doesn't disclose its AI providers at all. Zero platforms offer contractual notice periods for model changes.

No-code platforms have changed what small teams can build. But they're still software companies, and procurement still matters. The demo shows you what the platform can do. These ten questions show you what it's like to live with.