When people in a company talk about shadow IT, it usually sounds like a problem. Someone brought in a tool without asking. Data sits where it shouldn't. IT cleans up afterwards.
AI tools give the topic a new shape. Business teams no longer just use someone else's software; they build their own. A sales lead builds an overview of her open quotes in an afternoon. A team lead in production builds an app for shift handovers. It's quick, it works, and it often bypasses IT.
We'd like to suggest a different reading.
Shadow IT is a request
Nobody builds an app after hours because they enjoy getting around the rules. People build because something is missing. Because the existing software doesn't fit the process. Because the IT ticket has been open for months. Because the spreadsheet with twelve tabs no longer cuts it.
That makes every self-built app a very precise request. It doesn't just say "we need something"; it shows what that something should look like. That is worth more than many requirements documents.
Respond with a ban and you lose exactly that knowledge. The app doesn't disappear. It just becomes invisible.
What is actually hard about AI apps in the shadows
It's worth naming the difficulties plainly, without horror stories:
- They run on personal accounts. When that person leaves, the app is left hanging.
- Sharing means passing on a link. Whoever has the link sees everything. There are no roles.
- Nobody checks what a change does. The next tweak can quietly reveal something that used to be hidden.
- There is no way back. When something breaks, the last working version is gone.
- IT sees nothing. Not because anyone hides it, but because there is no place where IT could see it.
None of these points has anything to do with the idea behind the app. They all have to do with where it runs.
Permission to build
Our position is simple: business teams should be allowed to build. Explicitly, officially, with backing. The question isn't whether they build, but where.
A good home for self-built apps brings what nobody should expect a business team to provide:
- The app runs in the company's workspace, with sign-in through company accounts.
- Permissions apply per role and are checked on every access.
- Every version is tested before it goes live.
- Every version is kept, and the previous one is a click away.
- Admins see every app and every change.
That is how Openbase.one works. A team describes in its own words what it needs and who may see what. A build agent builds the app, and Openbase.one asks only what needs a domain decision. Every version is built and opened in a real browser as every test persona. A version whose build or check fails doesn't go live.
App code runs isolated and reaches neither the internet nor other workspaces. Apps write no SQL; every data access is checked against the workspace, the app and the person's permissions. An audit log records who changed what.
What changes for IT
IT's job shifts. Instead of assessing every app on its own, IT sets the ground rules once: how people sign in, whether passwords are allowed, whether installed apps update automatically or only after approval. From then on, those rules apply to every app that gets built.
That isn't control through the back door. It's the reason IT can say yes at all. If you know every new app runs within the same guardrails, you don't have to worry about each one.
Leaving is covered too. The code of every app you build lives as a git repository in the workspace, and the data can be exported. Nobody is tied to a single person or a single tool.
What stays with the team
An environment can check whether a manager sees salaries. It can't judge whether the purchasing approval limit should be €5,000 or €10,000. The team that builds the app decides that, and it signs off on the app. That responsibility can't be automated away, and it shouldn't be.
If you want help with it, you'll get it. Platform support is included in every plan. For your own apps there are support contracts with named contacts and hours of help, and Premium includes a review of new apps before they go live.
Keep building, just here
The best answer to shadow IT from AI apps isn't a ban or an audit. It's an offer: keep building, but in a place the company can see and roll back. If you already have an app in another tool, just describe it again, this time in the company workspace.
And some things don't need building at all. Ready-made apps such as Files, Meet or Wiki come from the App Store, which keeps growing, and run as soon as they're installed.
What it costs
Openbase.one is priced per workspace. Users and apps are unlimited on every plan, and there is no licence per app. You can start for free, without a credit card. All the details are on the pricing page.
Describe your first app and watch it go live, checked.
Start for free