Executive Summary
The first app is fast on every low-code platform. The platforms differ in where the apps run, who may build them, what the meter counts and how an app leaves.
A low-code application platform is software for building business applications with visual tools instead of most hand-written code, and for running those applications once they are built. IBM describes low-code as a software development approach that lets people build applications with minimal hand coding, using visual tools such as drag-and-drop interfaces, prebuilt components, workflows and templates. IBM states that no-code development platforms enable users to create applications and automate business processes without writing any code, while low-code environments are often used by professional developers to automate the generic aspects of coding. Decide which of the two your builders need before you compare products. A business analyst and a professional developer will judge the same product differently.
Choose a platform on five things: where its apps and data can run, including on your own servers; who is allowed to build and how their work is governed; how a change moves from development to production; what the pricing meter counts as adoption grows; and how an app and its data leave the platform if you stop paying for it.
The vendors divide by what their platform was built around: full application development by professional teams, process automation, a productivity suite, a CRM, a service management platform, internal tools for developers, or a database. Start from the approach that matches the apps you plan to build and the platforms you already own, then test the shortlist on one of your own applications.
What Is a Low-Code Application Platform?
A low-code application platform covers the whole life of an app: a visual designer, a data model, logic and workflow, connectors to other systems, and a runtime the finished app runs on. The runtime sets it apart from a code generator. Apps built on the platform usually keep running on it, so its hosting options, pricing and support terms last as long as the apps do.
Two groups build on these platforms. Business staff who build their own apps, often called citizen developers, need templates, guardrails and someone to review their work. Professional developers need version control, testing, separate environments and a way to write code where the visual tools stop. Security teams have a reference list for the first group. OWASP states that the mission of the OWASP Citizen Development Top 10 Project is to help organizations identify, prioritize, and mitigate risks tied to citizen development. OWASP states that the project, originally focused on Low Code No Code platforms, broadened its scope, and that its Top 10 risks cover threats introduced through business innovation platforms, AI assisted coding, and AI agents.
AI has changed what the platforms are compared with. IBM states that many low-code vendors have incorporated agentic AI into their products, and that the visual canvases remain while the manual coding experience is replaced with AI code generation. IBM states that the result of an agentic coding project is not a low-code artifact but a conventional codebase, which means full ownership, custom code, reduced vendor lock-in and compatibility with modern tools. Ask of every AI feature what it produces: a model that only the platform can run, or code that your developers can read, test and keep.
Governance decides whether a low-code program grows or gets shut down. An app built by a business team reads and writes real data with the builder’s own permissions. Before you open the platform to business staff, decide which connectors they may use, who approves an app before it reaches other users, and who takes over an app when its builder changes jobs.
Count the platforms you already own. Productivity, CRM and service management suites include app builders, and some licenses you already pay for may cover simple apps. A separate platform earns its place when your apps need data, users or hosting that the suite you own does not cover.
Which Low-Code Platforms Run On Premises?
Several do, in different ways. Some install the full platform in your data center or on your own Kubernetes cluster. Others run only as the vendor’s cloud service and reach systems inside your network through an agent or gateway. Ask each vendor which of these it offers, and which features each option keeps.
OutSystems states that OutSystems can be installed on the private cloud of a third-party vendor or in an organization's data center. OutSystems states that OutSystems Developer Cloud can now run apps, data, and AI agents in a customer's own private or public cloud, or on on-premises Kubernetes infrastructure. Mendix documents deployment of Mendix applications on premises, on Microsoft Windows and Linux. Appian states that it can be deployed in self-managed, hybrid clouds (AWS, Azure, Google), or on-premises. Retool states that self-hosted Retool is deployed for production on a Kubernetes cluster using Helm. Oracle states that all APEX functionality is available whether it runs on premises or in the cloud, with no feature restrictions tied to deployment model.
A self-managed edition is not always the same product as the cloud edition. Appian states that a feature it marks may not be available or may have limited functionality in self-managed deployments of Appian. Mendix states that no backup or restore functionality is installed automatically with Mendix on Kubernetes, so customers choose and deploy their own solution. Ask for the feature list of the self-managed edition in writing, the upgrade schedule, and who applies security patches.
Self-hosting can also sit in a higher price tier. Mendix states that Mendix on Kubernetes is a premium offering, with additional licensing and cost implications for applications in production. Retool states that its Enterprise plan includes Retool Cloud, self-hosted, or air-gapped deployment.
A platform that runs only in the vendor’s cloud can still reach systems in your data center. Microsoft states that the on-premises data gateway initiates outbound connections to the cloud but requires no inbound connections. With a gateway, the apps, their data store and their logs stay in the cloud service; only the connection to your systems starts inside your network. If a regulator or a contract requires the application itself to run on your infrastructure, a gateway does not meet that requirement.
| Deployment model | What runs where | What to ask |
|---|---|---|
| Vendor’s shared cloud | Apps, data and logs in the vendor’s multi-tenant service | Which regions hold the data, and who at the vendor can reach it |
| Vendor-run dedicated instance | A single-tenant instance that the vendor operates | Whether it is priced separately and follows the same release schedule |
| Your cloud account, vendor-managed | The runtime in your account, with platform updates from the vendor | Which direction connections run, and who holds the encryption keys |
| Self-managed on premises | The whole platform on servers or Kubernetes you run | Feature parity with the cloud edition, upgrades, backup and patching |
| Cloud service with a gateway | Apps in the vendor’s cloud; an agent inside your network | Payload limits, and which data leaves your network |
How do you evaluate Low-Code Application Platforms?
Test AI app generation on a real requirement, not a sample. Appian states that Composer turns business requirements, in natural language or existing documents like Word, text, or PDF files, into working Appian applications. ServiceNow states that App Engine includes Build Agent, which generates apps, workflows, and agents from natural language descriptions. Give each vendor the same requirement document from your backlog. Score how much of the result your team had to change, and whether a developer could review what was generated.
The developer path matters once an app outgrows its builder. ServiceNow states that developers building custom applications in ServiceNow Studio can use external tools like Cursor or Claude Code connected through the Build Agent SDK. Salesforce lists IDEs such as Code Builder and its extensions for VS Code among its developer tools. Oracle states that APEXlang gives developers and AI agents a supported way to express application intent as structured metadata that can be reviewed, versioned, governed, and executed by APEX. Ask where a developer writes code when the visual tools stop, and whether that code is tested and versioned with the rest of the app.
Application lifecycle management (ALM) tools decide how safely a change reaches users. Microsoft states that solutions are the mechanism for implementing ALM, used to distribute components across environments through export and import. ServiceNow states that applications can be forked and branched using built-in Git support. In the proof of concept, make a change, promote it through a test environment, and roll it back.
Governance controls should work before an app is built, not only after. ServiceNow states that all aspects of low-code app development can be managed centrally, from app idea intake to pipeline and deployment. Microsoft states that when data policies are created or updated, each app, flow, and chatbot is evaluated, and one that violates the policy is put into a suspended or quarantine state so that it can't operate. Ask how an administrator finds every app on the platform, its owner and the data it touches.
Data access is where most low-code apps succeed or stall. Appian states that its data fabric unifies enterprise data in hybrid and multi-cloud architectures, with access to real-time data stored across systems. Ask whether the platform keeps its own copy of your data, where that copy lives, and how it stays current with the system of record.
Plan the exit on day one. OutSystems states that it generates standard, open code based on widely used frameworks and languages that can be extended and integrated with other systems. Ask every vendor to show what an exported app contains, whether it runs without the platform, and how you get the data out.
| Capability | What it does | Buyer translation |
|---|---|---|
| Visual builder | Pages, forms, data models and logic assembled from components | Whether business staff can build an app your team would support |
| AI generation | Apps, workflows or agents drafted from a description or a document | How much your team changes in the result, and whether a developer can review it |
| Developer extension | Code, IDEs and APIs for what the visual tools cannot do | Where custom code lives, and whether it is tested and versioned with the app |
| Lifecycle management | Environments, version control and promotion to production | Who approves a change, and how it is rolled back |
| Governance | Connector policies, app inventory and approval of new apps | Whether you can find every app, its owner and its data |
| Data and integration | Connectors, gateways and the platform’s own data store | Where copies of your data live, and how they stay current |
| Hosting options | Vendor cloud, your cloud account or your own servers | Which features each option keeps, and who patches it |
| Exit | Export of app definitions, code and data | What still runs, and what you still own, if you leave |
Vendors in Low-Code Application Platforms
Representative vendors include Appian, Mendix, Microsoft Power Platform, Oracle APEX, OutSystems, Retool, Salesforce Platform and ServiceNow App Engine. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The approaches below follow one question: what was the platform built around? That origin decides which apps each one builds without extra products, and which data it reaches first.
The application development approach covers full applications built by professional teams, with visual tools for other builders and several hosting options, described in the on-premises section above. Mendix states that it was acquired by Siemens in 2018.
Appian describes itself as an AI process automation platform. Test a process platform on a process from your own operations that runs for days and passes between several people and systems.
Three vendors add low-code to a suite you may already own. Microsoft describes Power Apps as a suite of apps, services, and connectors, as well as a data platform, that provides a rapid development environment to build custom apps for business needs. Salesforce states that App Builder allows business users, admins, and developers to create AI applications with little to no coding. Salesforce describes Hyperforce as the secure, compliant, and high-performance foundation of the Salesforce Platform. ServiceNow describes App Engine as its platform for building, deploying, and governing custom workflow applications. Choose one of these when the apps will use that suite’s data and users, and ask what it costs to hold data or users the suite does not already cover.
The last two approaches start from systems that developers already run: their databases and APIs. Retool states that it can deploy apps built in Lovable, Replit, and other platforms, from an uploaded ZIP file or a GitHub sync. Oracle states that Oracle APEX is a fully supported no-cost feature of the Oracle Database, and that an Oracle Database maintenance agreement also covers support for Oracle APEX.
| Vendor | Approach | Where it fits |
|---|---|---|
| Mendix | Application development platform | Model-driven applications, on Mendix Cloud, Kubernetes or your own servers |
| OutSystems | Application development platform | Full applications, in OutSystems’ cloud, your cloud or your data center |
| Retool | Internal tools for developers | Internal tools on your databases and APIs, in Retool’s cloud or self-hosted |
| Oracle APEX | Low-code in the database | Data-centered apps inside Oracle Database, in the cloud or on premises |
| Microsoft Power Platform | Low-code in the productivity suite | Departmental apps tied to Microsoft 365 and Dataverse |
| Salesforce Platform | Low-code on the CRM platform | Apps on Salesforce data, users and security |
| ServiceNow App Engine | Low-code on the service management platform | Workflow apps on the ServiceNow platform |
| Appian | Process automation platform | Process applications across people, rules and systems |
Eight vendors are named across seven approaches, and OutSystems and Mendix share one. The seven vendors from the previous edition stay, and Oracle APEX was selected to represent low-code built into a database. A row here is not for sale. The roster check for this edition covered 16 low-code vendors, from open-source builders to ERP suites, and any of them can describe its own product in the Spotlight below.
How much should you budget for Low-Code Application Platforms?
Low-code vendors meter different things, so list prices rarely compare across vendors. OutSystems states that its subscriptions are priced according to the scale and complexity of the apps built, measured in Application Objects (AOs), the sum of the screens, database tables, and API methods across your apps, and that a typical medium-sized app is about 150 AOs. OutSystems states that its subscriptions are also priced according to the number of non-anonymous end users who use your apps, with internal and external end users counted separately. Appian states that its platform capability is priced per user, per month, per app.
Some vendors publish per-user prices. Microsoft lists Power Apps Premium at $20.00 per user per month, paid yearly, and at $12.00 per user per month with a 2,000-seat minimum. Salesforce lists Platform Starter at $25 USD per user per month, billed annually, with 10 custom objects. Salesforce lists Platform Plus at $100 USD per user per month, billed annually. Retool lists its Business plan at $50 per builder per month and $15 per internal user per month, billed annually. Retool defines a builder as a user who created or edited an app or workflow in the billing cycle, and bills per builder, per month.
Check what a license leaves out, and what you already own. Mendix states that for its Standard and Premium packages it does not include the compute resources needed in its license price. Mendix states that it does not charge for anonymous users accessing applications made on the Mendix platform, or for developers making apps on the platform. Microsoft states that some Microsoft 365 licenses include limited Power Apps and Power Automate use rights intended for scenarios that use Microsoft 365 data and standard connectors, which don't provide the same rights as standalone premium licenses.
A successful program costs more each year, because every meter above grows with adoption. Model the price at the number of apps, users and stored records you expect in year three, and write the renewal terms into the first contract.
| Meter | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Per user | Each person who runs apps, sometimes split by internal and external | Adoption across the business | Occasional users priced like daily users |
| Per builder | Each person who creates or edits apps in the period | The number of people allowed to build | A one-line edit counting a user as a builder |
| Per app or app size | Each app, or units of screens, tables and APIs | The size and number of apps | A growing app moving the account into the next tier |
| Storage and capacity | Data held in the platform’s own store | Records, files and logs kept | Copies of business data billed by the gigabyte |
| Hosting option | Dedicated, private cloud or self-managed editions | Data residency and security requirements | An on-premises need found after the contract is signed |
How long does implementation take for Low-Code Application Platforms?
Most of the work in a low-code rollout is the operating model, not the installation. Set up governance before the first business-built app goes live, because rules added after hundreds of apps exist have to be enforced app by app. The phases below assume about three months from contract to a governed first release. Self-managed hosting adds the installation and upgrade work.
Set up environments for development, test and production. Decide which connectors business builders may use, who approves an app for wider use, and how apps are named and owned. On self-managed hosting, install the platform and agree its upgrade and backup routine.
Build two or three apps from the backlog with a mixed team of developers and business builders. Promote each one through test into production, and record the support model that will apply to every app after them.
Offer training, templates and a request process to business teams. Review each new app before it reaches users outside its builder’s team, and keep an inventory of every app, its owner and its data.
Move apps that become business-critical to a developer team, with tests and version control. Review usage against the license every quarter, before the renewal sets next year’s price.
What should you ask vendors about Low-Code Application Platforms?
Ask each vendor to answer in writing and to demonstrate on one of your own applications.
-
Must the apps run on your own servers or in your own cloud account?Yes Shortlist platforms with a self-managed or customer-cloud edition, and get the feature differences from the cloud edition in writing.No Compare the vendors’ cloud services on data location, access to your systems and log retention.
-
Will business staff build apps, not only developers?Yes Weight governance: connector policies, an app inventory, approval before release and a handover path.No Weight version control, testing, code extension and deployment pipelines.
-
Do most of the apps extend a suite you already own?Yes Price the suite’s own app builder first, and buy a separate platform only for what it cannot hold.No Compare dedicated platforms on the hosting, data access and exit terms you need.