Security Basics for a Custom Frontend

What You'll Learn

These security basics apply to any app built with a custom frontend, using a frontend builder like Lovable, Base44, or Claude Code with Knack as your backend. The first one, Data Access Control, decides which records a user can touch at all. The rest protect your account and your audit trail. Set them all up before you add real data.

Set Up Data Access Control First

Data Access Control decides which records a user can see, edit, or delete. With a custom frontend, it's doing that job alone. There's no Page Access layer in front of it, because your frontend isn't using Knack's own page screens. Page Access only controls which Knack pages a role can open, and your custom frontend never touches those pages.

Set this up before anything else in this article.

Go to Users > All Users > Data Access and click Start Setup. For each role and each table, set two permissions:

• Owned By User, what a user can do with records they created or are assigned to
• All Other Records, what a user can do with everyone else's records

See Data Access Control and Checking That Your Access Rules Actually Work to confirm it's working. Everything else in this article is a secondary control. This is the one that decides whether your data is actually private.

Turn On Record History

Record history logs every change to a record, including changes made from your custom frontend. It shows what changed, when, and who made the change, so you can trace any edit back to a user.

To turn it on, go to Settings > General in the Knack Builder, scroll to Record History, and turn it on.

Require Two-Factor Authentication for Your Users

Two-factor authentication (2FA) asks users for a code from an authenticator app each time they sign in. Even if someone's password is stolen, they can't get in without the code.

To turn it on, go to App Settings in the Knack Builder and open the Two-Factor Authentication tab. Once it's on, it applies to your custom frontend automatically. You don't need to change anything in your frontend builder.

Here's what your users will see:

• The next time they sign in, Knack asks them to set up 2FA by scanning a QR code with an authenticator app.
• After that, they enter a 6-digit code from the app each time they sign in.

Users who sign in through single sign-on (SSO) follow their SSO provider's sign-in steps instead.

For details on managing 2FA for individual users, see Two-Factor Authentication (2FA): Setup, Management & Live App Experience.

Turn On 2FA for Your Knack Account

Your Knack account controls your app's tables, settings, and access rules, so protect it too. Builder 2FA is separate from your users' 2FA. It applies when you sign in to the Knack Builder.

Turn it on from the Security section of your Knack Dashboard. Every person with their own Knack account who works on your app should turn it on. See Builder Two-Factor Authentication for steps.

Deactivate Users Who Leave

When someone leaves your organization, deactivate their user account in Knack right away. Once deactivated, they see a message that their account has been deactivated when they try to sign in to your custom frontend.

To deactivate a user, open their record in the Knack Builder and change their status to Inactive.

Lock Down Access for Signed-Out Visitors

The Public role covers anyone who isn't signed in. If you followed the Data Access Control setup above, confirm Public is set to No Access on every table that isn't meant to be public, and that enforcement is on.

Check Your Security Setup

After setting things up, test them the way your users will experience them.

• Create a test login for each role in Knack, using fictional details.
• Sign in to your published app as each test user, not inside your frontend builder's preview.
• Confirm 2FA asks for a code when a test user signs in.
• Deactivate a test user and confirm they can't sign in.
• Make a change from your frontend, then check that it appears in the record's history in the Knack Builder.

Next Steps

• Checking That Your Access Rules Actually Work: Confirm Knack is enforcing who can see and change your records.
• Authentication Best Practices: Recommendations for sign-in security, including HIPAA apps.
• Choosing a Default User Role for a Custom Frontend: Decide what new users can access before they're assigned a role.