Bolt Security & Data Handling Checklist

Look forYes, for content created from October 7, 2026, unless the user turns off Model training in account settings. StackBlitz may also license de-identified datasets built from that content to third parties. The setting is off by default in the EU, UK, and Switzerland. Accounts under a separate written agreement are excluded, and so are organization-managed accounts unless their admin enables the uses. Bolt's security page says Enterprise and Team customers under a master services agreement (MSA) or data processing agreement (DPA) are excluded. Have personal-account builders turn the setting off before company content goes in, because opting out does not unwind models already trained or datasets already delivered.

Look forFind out who uses Forge. Since its research preview ended on October 14, 2026, only Lite subscribers who signed up by that date can use it. Pro plans lost access, and Teams and Enterprise plans never had it. While Forge is on, StackBlitz may use the prompts, code, project files, and fix traces it processes to train models and to prepare de-identified datasets licensed to third parties. The Model training opt-out does not apply. Accounts located in the EEA, UK, and Switzerland are excluded. Switching to another agent stops new collection and leaves collected data in place, so anyone who ran company work through Forge should request removal from privacy@stackblitz.com.

Look forRun the database security check on any plan, and on paid plans the full audit, which reviews who can see and change data, sign-in, input handling, and keys. In an outside scan published in April 2026, 21 of 289 bolt.host apps had critical Supabase access issues, most of them prototypes left online.

Look forPublish privately until launch. Free sites are always public and indexable. Paid plans can publish privately to invited people and trusted email domains, and a site with a custom domain must be public. Teams admins can set Private only for every team project. Since mid-October 2026, Pro and Teams builders can choose Private or Public when they publish from a phone, and adding individual viewers or trusted domains still happens on desktop.

Look forGive edit rights sparingly. Viewers can open the project, its code, and the running app, and Editors and Co-owners also see environment variables. Store secrets in the database secrets settings and keep them out of code. Keep external collaboration off for team projects unless a project needs it.

Look forDecide whether you need SSO or audit logs. Audit logs come only with Enterprise. Bolt's pricing table lists SSO on Teams and Enterprise, while its help center says SSO sign-in is Enterprise only, so get SSO on Teams confirmed in writing. Enterprise supports Okta, Azure AD, and other SAML providers. Teams has admin and member roles, integration controls for GitHub, Stripe, and Supabase, member and usage exports, and the personal account restriction. Accounts are StackBlitz accounts, managed at stackblitz.com.

Look forRequest Bolt's SOC 2 Type II report through its trust profile at trust.bolt.new. Enterprise offers deployment into your own AWS or Azure tenant. Projects run inside a browser WebContainer while you build. Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher, and StackBlitz is based in the United States.