Lovable adds own-cloud deployment and admin controls for Enterprise

Running apps in your own cloud

According to Lovable, many apps cannot go to production until they run inside a company's own network. An HR app that reads from an HR system is the example the company gives. With Deploy on AWS and Deploy on Azure, Enterprise teams can run such apps and the data behind them in their own cloud account. Both are in private preview.

Preview sandboxes, published apps, the app database, file storage and app logs run in a dedicated network inside the customer's account. Apps reach internal systems such as a data warehouse over VPC or VNet peering, so those systems stay off the public internet. Lovable says it installs and updates everything it deploys there, and that Enterprise security controls still apply. Deutsche Telekom went live in October with its Lovable apps running in its own AWS account, according to the company. Interested teams can contact their account team or email [email protected].

Chat and project history still stay with Lovable in this setup. Bring your own key, also in private preview, lets admins connect their own encryption key in Workspace settings. If the key is revoked, Lovable can no longer read the history. Today it works with AWS KMS in workspaces that use Deploy on AWS. Azure Key Vault support is rolling out with Deploy on Azure, and Lovable is also working on it for workspaces hosted on Lovable.

For European customers, EU inference keeps an Enterprise workspace's AI model requests on EU model endpoints, both while building and for AI features in published apps. By default, requests go to the standard endpoints of the providers on Lovable's subprocessor list, which can process requests in the U.S. A request that no EU endpoint can serve fails rather than running elsewhere. A workspace owner or admin turns it on in Privacy & security settings.

Organizations, policies and the Action center

Large companies often run several workspaces, one per team or region. Organizations lets central IT manage identity across all of them from one console. Admins can:

• Set up SSO and SCIM for every workspace
• Map identity provider groups to workspaces
• See every member and their workspaces
• Lock identity settings so workspace admins cannot change them
• Block people from creating unapproved workspaces
• Review audit logs across the organization

Teams can also publish internal apps to the whole company by choosing the organization audience in the publish dialog. Organizations is available on Enterprise and is also where admins set up Deploy on AWS and Azure workspaces.

Workspace policies decide what needs review before an app goes to production. A policy either blocks an action or requires an admin or owner to approve it. The first policies cover publishing: restricting publishing while a project has unresolved PII findings, requiring approval when external collaborators publish, restricting public publishing, requiring approval for apps that use connectors, and blocking publishing from email addresses outside verified domains. When no policy applies, the app publishes without review.

When approval is required, the publisher sends a request with a note, and every admin and owner is notified in Lovable and by email. Later updates go out without a new request unless something the policy checks changes. Policy changes and decisions appear in audit logs. Lovable says more policies are coming.

Requests are handled in the new Action center, which also flags projects whose owner left, projects with sharply rising credit usage, public apps with critical security findings and public apps nobody has edited for months. The Action center is available on Business and Enterprise, while approval requests need Enterprise.

API and audit log export

The Lovable API, available on Business and Enterprise, lets admins pull usage and security data into their own dashboards. They can read workspace settings, list members and groups, pull analytics, poll security scans, and publish, unpublish, update or delete projects. Reading PII labels and the project security inventory is Enterprise only. Credit usage and limits are coming next. Owners and admins create API keys in Workspace settings and can register OAuth clients.

Audit logs can now be exported every hour or every three hours to Splunk, Azure Log Analytics, Amazon S3, Google Cloud Storage or Azure Blob Storage. Lovable keeps audit logs for 13 weeks, and an export lets customers keep their own copy longer. Lovable signs in to AWS, Google Cloud and Azure with short-lived credentials, so there is no long-lived key to manage.

What it means for enterprise teams

The release targets the federated model Lovable describes, where a central team sets rules once and functional teams build within them. Its stated aim is "governed sprawl" rather than shadow sprawl. Next, Lovable is building settings that apply to every workspace in an organization at once, working toward full feature parity on Deploy on AWS and Azure compared with hosting on Lovable, and preparing Deploy on Google Cloud. Workspace policies, the Action center, the Lovable API and audit log exports are live now, while Organizations and the private previews are set up through the account team.