A button works in both demos. That tells you almost nothing. The decision appears when a signed-in user tries to read another account’s record, an expired session breaks a write, and you must explain which parts survive an export.
Use one fictional vertical slice
Illustrative scenario: a property-inspection SaaS lets a user sign in, create an inspection for one customer account, attach findings, and export that account’s records. Build only enough to test five moments.
| Moment | Bubble path | WeWeb + Xano path | Evidence to capture |
|---|---|---|---|
| Sign in | Account event and user state inside the Bubble application. | WeWeb session using Xano as the documented authentication system. | Failed login, logout, expired session and changed role. |
| Write | Workflow validates input and changes Bubble data. | WeWeb calls a Xano endpoint that validates and writes. | Request, validation error, duplicate submit and resulting record. |
| Cross-account read | Bubble Privacy Rules are exercised through UI and direct data paths. | Xano endpoint authorization is exercised with a known foreign record ID. | Denied read using two accounts and the real session path. |
| Broken request | Inspect event, conditions, Privacy Rules and data state. | Trace WeWeb action, network request, Xano endpoint and database action. | Correlation ID, operator view and safe user-facing error. |
| Exit | Open a documented CSV, JSON or NDJSON database export outside Bubble. | Open a documented Xano CSV table/view export; inventory WeWeb bindings separately. | Rows recovered and every workflow, plugin, endpoint, auth setting and UI behaviour to rebuild. |
What the official docs establish
As observed on 28 July 2026, Bubble documents workflows as events and actions that can affect the interface, database, accounts and external APIs. Bubble also documents server-side Privacy Rules and database exports in CSV, JSON and NDJSON. Those facts establish available mechanisms. They do not establish that your rules are correct, your build is faster or your system is portable.
WeWeb’s Xano integration documentation describes GET endpoints as data sources, endpoint calls from workflows and Xano as an authentication system. Xano documents CSV export for a table or view. Those facts establish a frontend/backend seam and an export mechanism. They do not prove lower maintenance, safer authorization or complete migration.
These capability observations are a point-in-time reading, not a substitute for a build. Re-run the slice on the exact versions and branches you intend to operate, especially after a material product, plan or environment change.
Replace “data ownership” with an exit inventory
An exported table is useful. It is not the application. Separate three questions:
- Contract: what rights and restrictions apply to the account, project and exported data?
- Rows: can you export the records and files in a usable format?
- Rebuild: which workflows, permissions, plugins, schedules, endpoints, environment settings and interface behaviours must be recreated?
Open the sample export somewhere else. If you cannot name the non-exported system behaviour, you have not tested an exit—you have downloaded rows.
Make the operating envelope visible
| Question | Concentrated Bubble architecture | Split WeWeb–Xano architecture |
|---|---|---|
| Where is authorization expressed? | Privacy Rules, workflow conditions and other Bubble controls used by the slice. | Xano endpoint and data-access logic, plus the session sent by WeWeb. |
| Where can a write fail? | Inside workflow conditions, actions, plugins or data operations. | At the WeWeb action, network boundary, endpoint validation, auth or database action. |
| What must the operator understand? | One broad application environment. | The contract and evidence on both sides of an API boundary. |
| What can the docs not decide? | Which shape your operator can diagnose, test and recover under the product’s actual constraints. | |
Price the demonstrated slice, not a headline plan
Bubble, WeWeb and Xano have different plan structures, quotas and workload concepts. Pricing pages observed on 28 July 2026 are only quote inputs. Obtain dated quotes that name region, billing cadence, environments, add-ons, capacity assumptions and the vertical slice’s workload. Leave the row blank if those details are missing.
Measure the built slice before comparing speed
Do not score “faster,” “safer,” “more scalable,” “easy to migrate” or “better ownership” from marketing copy. Also ignore polished dashboard work beyond the five moments. You are choosing an architecture boundary, not designing the finished inspection product.
Log the drill before choosing
| Decision record | Evidence to attach |
|---|---|
| Reference slice | Exact fields, account boundary, role, write and export tested in both shapes. |
| Negative evidence | Foreign-record read, foreign-account write, expired session and role-change outcomes. |
| Incident trace | Where the request ID, technical error and customer-safe message appeared. |
| Exit inventory | Rows and files exported, plus every behaviour requiring reconstruction. |
| Dated cost envelope | Plan, region, add-ons, environments and workload assumptions. Leave this blank when they are unknown. |
| Decision | The architecture whose tested operating burden the current team can own, with untested paths named. |
The operator still owns the seam
A visible API boundary may clarify responsibility. It may also give one founder two consoles to search at 2 a.m. A single environment can simplify the trace while concentrating rules nobody has tested. Count the places you can actually diagnose, not the boxes in the architecture diagram.
Make the stack decision from the drill
Do not crown a stack from its feature list. Run the same sign-in, write, denied access, broken request and exit drill. Choose Bubble if the tested concentrated system is clearer for your operator; choose WeWeb + Xano if the tested API seam makes authorization and recovery more legible. If neither run produces evidence, postpone the stack decision.
Recheck the vendor boundary
- Bubble, Workflows, observed 28 July 2026; recheck the current workflow behaviour on the branch you intend to operate.
- Bubble, Privacy Rules and data exports, observed 28 July 2026; re-test in the target app.
- WeWeb, Xano integration, observed 28 July 2026; confirm the current integration contract in the intended environment.
- Xano, CSV import and export, observed 28 July 2026; export scope is limited to documented tables/views.
- Bubble pricing, WeWeb pricing and Xano pricing, observed 28 July 2026; obtain current quotes for the intended regions, plans and workload.