Lovable launches enterprise bundle: deployment to a customer's own AWS and Azure, EU inference, and policies

Lovable, a service for building apps in a conversation with AI, has released a set of features for large companies. The main change: apps and their data can now run in the customer's own cloud account on AWS or Azure. Both options are still in private preview. Deutsche Telekom was the first to reach production: in October, it launched its Lovable apps in its own AWS account. The other additions address the questions security teams typically ask: where the code runs, where model requests go, and who can publish what.

The release is built around a federated model that Lovable sees among its customers. A central IT or AI team sets the rules once, and individual departments build apps within them. The company calls this governed sprawl instead of shadow sprawl.

Data stays inside the customer's perimeter

Deploy on AWS and Deploy on Azure move preview sandboxes, published apps, the database, file storage, and logs into the customer's account. All of it runs in a dedicated network. Apps reach internal systems such as a data warehouse through VPC or VNet peering, and those systems are not exposed to the public internet. Lovable handles installation and updates. A typical example, the company says, is an HR app that reads data from a personnel system: until it runs inside the network, it won't be allowed into production.

Bring your own key is a separate feature. Even when apps are deployed in the customer's own cloud, chat and project history stays with Lovable. An admin connects their own encryption key, and once it is revoked, Lovable can no longer read the history. The feature is in private preview and so far works with AWS KMS in workspaces on Deploy on AWS. Azure Key Vault will arrive together with Deploy on Azure.

EU inference is now available for European companies. By default, requests go to the model providers' standard endpoints, which may process them in the US. With the option enabled, requests stay on European endpoints both during development and in the AI features of published apps. If no European endpoint can serve a request, it fails with an error instead of being routed to another region.

Governance: Organizations, policies, Action center

The Organizations console lets admins configure SSO and SCIM for all workspaces at once, map identity provider groups to workspaces, block changes to settings and the creation of unapproved workspaces, and view audit logs across the entire organization. Internal apps can be published company-wide: only members of the organization's workspaces can open them.

Workspace policies either block an action or require approval from an admin or owner. The first policies cover publishing:

• block publishing when there are unresolved findings with personal data (replaces the Block publishing with PII setting);
• approval for publications by external collaborators;
• a ban on public publishing;
• approval for apps with connectors;
• block publishing at addresses outside verified domains.

When approval is requested, all admins get a notification in Lovable and by email. Re-approval is needed only when something the policy checks changes, such as connectors or audience. While a request is pending, development and preview continue. For the connector and external collaborator policies, the dialog shows how often they would have triggered over the past 30 days.

The Action center collects approval requests and signals: projects with no owner, sharp spikes in credit spend, public apps with critical vulnerabilities, and apps that haven't been edited for months. It is available on Business and Enterprise; approval requests require Enterprise.

API and log export

The Lovable API, available on Business and Enterprise, can read settings, members and groups, analytics, and security scan results. It can also publish, unpublish, update, and delete projects. Enterprise also gets PII labels and a project security inventory. Data on credits and limits will be added later. Owners and admins create the keys, and OAuth clients are supported as well.

Audit logs go to Splunk, Azure Log Analytics, Amazon S3, Google Cloud Storage, or Azure Blob Storage every hour or every three hours, new records only. Lovable itself keeps logs for 13 weeks, while export gives the customer its own copy for as long as needed. Cloud access uses short-lived credentials, with no long-lived keys.

What's next

Planned features include settings that apply to all of an organization's workspaces at once, feature parity between AWS and Azure and Lovable hosting, and Deploy on Google Cloud. Policies, the Action center, the API, and log export already work. For Organizations and the private previews, contact your account manager or write to [email protected]. Teams whose prototypes are stuck on security should check three things in advance: whether they need deployment in their own cloud, whether a regulator requires model requests to be processed in the EU, and which publishing policies to enable first.