Secure by design

Customer data is hosted in Lovable Cloud in supported regions including the EU, US, and Australia. Data residency is region-specific and does not move across regions by default.

On Business and Enterprise plans: No. Customer prompts, code, and workspace data are not used to train Lovable models. If you are on a Free or Pro plan, log in, open Account Settings Privacy, and turn off Use my Lovable content for model training to exclude your own data from AI model training. Where third-party AI providers are used, contractual agreements restrict training and retention of customer data.

Lovable is a multi-tenant platform with logical isolation between workspaces and projects. Customer data is not accessible across accounts. Isolation controls are enforced at both the application and infrastructure layers.

Lovable works with a limited set of infrastructure and AI subprocessors. All subprocessors are covered under contractual data protection agreements. A current list of subprocessors is available upon request.

No. Lovable does not clone customer Git repositories, access application code inside your environments, or require internal CI/CD access. Your source code, repositories, and production infrastructure remain inside your organization's existing security perimeter. Lovable does not deploy agents inside customer production environments or introduce inbound network connections.

No. Lovable does not require direct access to customer CI/CD pipelines or production infrastructure. It does not deploy agents inside production environments or introduce inbound network connections. All integrations operate within defined permission boundaries.

Publishing permissions are enforced server-side and cannot be bypassed via client-side requests. Editing, approval, and publishing are separate role-based permissions. Production publishing can require explicit approval, and all publishing events are logged with user attribution.

Lovable integrates with SAML and OIDC identity providers and supports SCIM for automated provisioning and deprovisioning. Access is role-based, with permissions explicitly defined for viewing, editing, approving, and publishing. All authorization checks are evaluated server-side at request time.

Yes. Lovable supports least-privilege access through role-based permissions and integration with enterprise identity providers. Organizations can define granular roles for editing, approving, and publishing, ensuring users receive only the access required for their responsibilities. Access policies align with organizational identity and workspace configuration settings.

Secrets are encrypted at rest and scoped to specific environments. Access to secrets is role-controlled and auditable. Secrets can be rotated or revoked without requiring full system redeployment. Integrations execute within predefined permission boundaries to reduce unintended credential exposure.

Yes. A basic security scan runs automatically every time you publish, covering database configurations, RLS policies, and cloud project settings (~10-15 seconds). A deep security scan is available on demand and analyzes your full codebase (~3 minutes). Workspace admins can enable auto-fix to have the agent resolve non-breaking findings automatically, and can configure publish blocking for critical issues. Dependency checks run continuously in the background on every edit. Business and Enterprise admins can schedule recurring deep scans across all workspace projects.

Lovable supports SOC 2 and GDPR requirements and provides security documentation and data protection agreements for enterprise review.