Lovable launches Deploy on Azure: your apps and data live in your own subscription

Lovable, a service where users build apps by chatting with an AI, has opened a private preview of Deploy on Azure. The app and all of its data run entirely in the customer's Azure subscription, inside a dedicated virtual network. The editor, agent, chat history and billing remain in Lovable's multitenant cloud. The mode is available to selected Enterprise customers and is now one of three ways to run Lovable in a Microsoft environment. For companies whose security policies require keeping the app and its data in their own infrastructure, this removes the main barrier.

What exactly gets deployed in your subscription

An administrator creates a new Enterprise workspace and chooses Azure as the hosting location. Lovable generates an Azure Resource Manager template, which the customer's team reviews and runs itself. Lovable's container images are copied into the customer's Azure Container Registry, so they can be scanned in a standard pipeline, like images from any other vendor. A Lovable runner operates on a virtual machine inside the VNet. It brings up and maintains the data plane, as well as the database and object storage.

The dedicated VNet hosts the following components:

• The Lovable data plane on an Azure Kubernetes Service cluster, including the preview sandboxes where builds run during iterations
• Published apps: static assets in Azure Blob Storage, dynamic requests through Azure Functions
• The app database on Azure Database for PostgreSQL (Flexible Server) and object storage in Blob Storage
• App logs, which can be sent to Blob Storage or to a Log Analytics workspace
• The connector gateway and integration secrets

Some components will arrive during the preview; the account team confirms the current set for a specific configuration. Apps reach internal systems, such as a data warehouse or CRM, through VNet peering. Those systems do not go out to the public internet.

What stays with Lovable and how data is protected

The app-building work itself still happens in Lovable's multitenant service: the editor, agent, chat and project history, workspace settings, identity and billing. Requests to AI models during development are also handled by Lovable's AI service. The boundary is clear: the code and data of the finished app sit in the customer's subscription, while the process of creating it stays with the vendor.

The link between the subscription and Lovable is one-way. Components in your subscription initiate the outbound connection themselves, encrypted with mTLS. No inbound access to your network is required for Lovable. App data stays in the VNet under your Azure encryption and your access rules. Chat and project history on Lovable's side is encrypted at rest. With the bring your own key setup, an admin connects a key from their own Azure Key Vault in the workspace settings and can revoke Lovable's access at any time. Enterprise controls also apply: SSO and SCIM through Entra ID, publishing limited to workspace members by default, a security check on every build, and audit logs.

Three options and how to choose

Deploy on Azure is one of three options. Copilot Managed Runtime (public preview) hosts the app in a Microsoft tenant behind Entra sign-in. It inherits DLP and connector controls, but requires Copilot Credits or a Power Platform premium license, and it does not include Lovable's built-in database, secrets or backend functions. The third option, hosting on Lovable with Microsoft connectors, offers the full feature set. The connectors cover Microsoft 365, Entra ID, Azure management and Fabric. Traffic comes from a fixed IP range for allowlisting, and each connector requires admin consent. Lovable holds SOC 2 Type II, and Enterprise workspaces cannot create public projects. Teams may work in several workspaces and combine the options.

In practice, the choice looks like this. If your policy requires keeping data in your own subscription and reaching internal systems over a private network, Deploy on Azure fits. If you have already invested in Power Platform and want tenant policies, look at Copilot Managed Runtime.

If the app needs to read and write Microsoft 365, Entra, Azure or Fabric data and hosting on Lovable's side is acceptable, take the third option. One caveat applies to the preview: some Lovable hosting features are not yet available there, and the vendor promises parity later. To get into the program, contact your account manager or write to byoc@lovable.

dev. IT and security teams should prepare questions in advance about the ARM template, image scanning and keys in Key Vault.