“If Lovable is SOC 2 compliant, does that mean my app is too?”
We get versions of this question a lot. The same goes for GDPR, ISO 27001, etc.
When building on Lovable, or any AI software creation tool for that matter, users don’t automatically receive the certifications of that platform. Our audits, certifications, and data protection commitments give you evidence about the platform you’re using, but your responsibilities depend on what you build, the data you collect, and how you run your business.
Here’s what each means, how to think about your own project, and what we’re doing to make this easier in the future!
What Lovable has
Lovable publicly documents SOC 2 Type II, ISO 27001:2022 certification, GDPR support, and AIUC-1 certification.
| Standard or regulation | What it means | What it means for your project |
|---|---|---|
| SOC 2 Type II | An independent auditor examines security controls within defined systems and evaluates how they operated over a specified period. | You can use Lovable’s report to assess us as a vendor. It doesn’t constitute an audit of your business or app. |
| ISO 27001:2022 | Certification of an information security management system: how an organization identifies, manages, and reviews security risks within a defined scope. | It provides evidence of how Lovable manages information security. Your organization doesn’t become ISO certified by using us. |
| GDPR support | GDPR sets legal requirements for handling personal data. Lovable provides data processing commitments and documentation to support customers’ obligations. | You still need to assess how your project collects, uses, shares, and retains personal data. |
| AIUC-1 | A standard addressing risks associated with AI agents. Lovable’s enterprise overview describes independent auditing and quarterly third-party testing. | Lovable’s certification doesn’t certify every app or AI workflow a customer builds. |
For the underlying standards, see a SOC 2 report review checklist, ISO’s explanation of ISO 27001, EU’s GDPR guide, and AIUC-1.
For current audit and certification information, start with Lovable’s Trust Center.
Why your business needs its own assessment and controls
SOC 2 reports, ISO 27001 and AIUC-1 certifications come from independent third-party assessments with a defined scope. An assessor reviews the organization’s systems, controls, and practices. Lovable’s assessment covers Lovable within that scope. It doesn’t assess your business because you build with us. The same is true of any other AI platform you use.
If you want a SOC 2 report or ISO 27001 certification for your own business, you need to put the relevant controls and processes in place, gather evidence, and go through your own independent assessment. We’re working with compliance automation partners on tooling to make certification easier for builders. More on that soon.
GDPR works differently. It is a law that protects people’s privacy rights by protecting the information that identifies them or can be linked to them, known as personal data. Where it applies, you need to build the required protections into your app and the way you operate it. That includes collecting only the data you need, restricting access, setting retention rules, and supporting applicable requests to access, correct, or delete personal data. You also need a lawful basis for processing and accurate information for users about how their data is used. The EU GDPR guide is a great starting point.
For example, if one of your users asks you to delete their personal data, you need a process to handle that request and, where deletion is required, a way to remove it from your database and any connected services. That workflow is something you build and run for your app. Lovable’s compliance commitments cover how we handle data as your provider, not the processes inside your project.
How to think about GDPR for your app
The GDPR applies depending on where people are, not where they’re from. It covers people in the EU regardless of citizenship, and it does not follow EU citizens who are living abroad. This means if you are selling to people in the EU, you need to comply with GDPR guidelines. The UK has its own GDPR regime (EU guidance on applicability, UK GDPR guidance).
Then work through these questions.
What personal data are you collecting, and why?
List the information your app handles, including account details, form submissions, uploaded files, and information captured by connected services. Collect only what you need, identify a lawful basis for each purpose, and decide how long you’ll keep it. Consent is one possible lawful basis; it isn’t the right basis for every activity. EDPB practical FAQ, ICO data protection principles.
Who decides how that data is used?
If you decide why and how personal data is processed, you’re generally the controller. If you build and operate software on another organization’s instructions, you may be a processor. Your role determines your obligations and the agreements you need. For personal data inside your app, you are typically the controller and Lovable is your processor. EDPB guide to controllers and processors.
Where does the data go?
Map the full path: hosting, database, email provider, analytics, payment services, and any AI features you add. Review the relevant providers and processing agreements. Check international transfers as well as storage locations. Choosing an EU database region alone doesn’t establish that every connected service processes data only in the EU. EDPB international transfer guidance.
Does your privacy notice describe your app accurately?
People need to understand what information you collect, why, who receives it, how long you keep it, and how to exercise their rights. A generated privacy notice needs to be checked against your actual setup. If you add a service that receives personal data, review whether your notice needs updating. EDPB transparency and rights guidance.
Can you handle a privacy request?
Work through what happens when someone asks for access to their information, a correction, or deletion where applicable. Identify the records across your database and connected services, who handles the request, and how you’ll verify the requester’s identity. EDPB guidance on individuals’ rights.
Have you tested who can access the data?
Test with separate accounts and different roles. Can one customer read another customer’s records? Are uploaded files exposed? Does a former employee still have access? Document your decisions and checks so you can demonstrate how you protect personal data. ICO security and accountability principles.
These questions give you a starting point. Projects involving sensitive data, children, or higher-risk processing need further assessment of the requirements that apply. Please read our platform rules for more information.
What if a customer asks for your SOC 2 report?
If a customer requires a SOC 2 report covering your own service, you’ll need a separate examination with an independent CPA firm. That review considers your defined system and controls, including how your organization operates it. Lovable’s report can inform the vendor review portion of that work.
A trust center can also help communicate your security practices. Lovable provides project-based trust centers that display observed controls, but the page itself isn’t a certification or a guarantee of compliance. How Lovable app trust centers work.
What we’re working on
We’re working on integrations with third-party systems, and Lovable-built skills to make more of this work easier to handle out of the box.
Our goal is to help you understand what your project needs and do more of the work within your building workflow. You’ll still need to make decisions about your business, your users, and their data.
For your next project, Lovable’s chat is a good place to start. Because it reads your project without changing any code, you can ask it to walk through your app and help you build the data map: which tables hold personal or sensitive data, which third-party services receive it, how authentication and access rules are set up, and whether anything is logged or stored longer than it needs to be.
From there, you can ask it to compare what it finds against the SOC 2 Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) and point out where you’re likely to have gaps.
A few prompts to get started:
- “List every place this app stores or sends user data, and who can access each one.”
- “Review our database access policies and flag any table that’s readable by users who shouldn’t see it.”
- “Which SOC 2 controls would apply to an app like this, and which ones are handled by Lovable versus by us?”
- “Draft a short checklist of what we’d need to document before talking to a SOC 2 auditor.”
Treat the answers as a starting point. Chat can help you understand your setup and prioritize, but SOC 2 is ultimately an audit of your organization’s controls and processes, not just your code, so you’ll still need policies, evidence, and an independent auditor. When you’re ready to fix something chat surfaced, switch to Build and the context from your conversation carries over.
This post is general information, not legal advice for your project.
