Where Does Company Data Live in Shadow AI Apps Built on Lovable, Bolt, and Replit?

Last updated October 29, 2026

Company data in shadow AI apps built on Lovable, Bolt, and Replit lives in a database the platform provisions for each app, on vendor-managed infrastructure outside your Microsoft tenant. Lovable and Bolt build their backends on Supabase, Replit runs its own PostgreSQL service, and all three can add a user login that runs outside Microsoft Entra ID by default.

Let's say a sales manager describes a commission tracker to a vibe coding tool and shares the link with the team. Once the team starts using it, deal values and customer names sit in a hosted database behind a login page nobody in IT has seen. A Gartner survey of 302 cybersecurity leaders found that 69% of organizations suspect or have evidence of employees using prohibited public GenAI. Gartner also predicts that more than 40% of enterprises will have a security or compliance incident linked to shadow AI by 2030.

Does Lovable Cloud Create a Database Automatically?

Lovable's built-in backend bundles a database, file storage, authentication, and serverless functions on Supabase's open-source foundation. According to Lovable's Cloud documentation, the backend is enabled by default for every workspace. When a prompt asks for a login or file uploads, Lovable either turns Cloud on automatically or asks the builder in chat.

• The Enable Cloud, Modify database, Change data, and Configure auth permissions all default to Always allow, so the AI agent creates tables, writes records, and changes signup policies without asking.
• The data region defaults to the location closest to the builder and cannot be changed after Cloud is enabled.
• Sign in with Google takes one prompt, and Lovable can manage the OAuth credentials itself.

Does Bolt.new Include a Built-In Database and Login?

Bolt launched Bolt Cloud in August 2025, and every new project now includes hosting and user authentication without a separate account. Bolt Cloud runs on Netlify and Supabase, publishes projects to a free bolt.host subdomain, and creates a database automatically when a project needs one.

Does Replit Include a Database and User Authentication?

Replit's database documentation states that every Replit App comes with a database by default, including 20 GB of free storage. Since December 4, 2025, new development databases run on Replit's own infrastructure in place of Neon. Replit Auth lets people sign in with their Replit accounts, and the Replit Agent adds it whenever a prompt asks for it.

Lovable vs. Bolt vs. Replit Database and Login Comparison

Shadow AI App Security Risks for Microsoft 365 Environments

Each risk below applies to all three platforms unless noted.

• Identity. App users sign in with Google, email and password, or Replit accounts, so Conditional Access, MFA policy, and Entra ID offboarding do not apply, and the app stays online after the builder leaves the company.
• Data protection. Records in a vendor-hosted PostgreSQL database fall outside Microsoft Purview DLP, retention, and eDiscovery.
• Residency. Lovable sets the default data region by the builder's location, regardless of contractual or regulatory requirements.
• Ownership. The database lives in whichever account or workspace the builder used. Lovable's documentation notes that removing Cloud permanently deletes the instance.
• Credentials. API keys for Stripe, Microsoft Graph, or internal systems are stored in platform secret managers IT cannot audit.
  

Shadow AI Discovery Steps for IT Leaders

1. Run Cloud Discovery. Microsoft's shadow IT discovery tutorial for Defender for Cloud Apps explains how to pull app usage from Defender for Endpoint or your proxy. Filter for lovable.dev, bolt.new, and replit.com traffic. Defender for Cloud Apps is included in Microsoft 365 E5 and E5 Security, and it cannot discover apps missing from its catalog by default.
2. Interview the builders. For each app, record the owner, the data it holds, the hosting region, how users sign in, and which secrets it stores.
3. Apply vendor controls. Lovable Business and Enterprise admins can require a default hosting region, and Enterprise workspaces can disable Cloud through the Lovable account team.
4. Decide each app's future. Retire it, keep it under an AI usage policy that defines data handling, or follow a defined path to production on Azure with Entra ID authentication and backups.

Shadow AI Governance Services From a Top 1% Microsoft Partner

CloudServus is a top 1% Microsoft Solutions Partner globally and an Azure Expert MSP. Microsoft awards these designations for demonstrated technical competency, customer success metrics, and investment in certified engineers. The CloudServus shadow AI governance practice maps every AI tool in use and the data each one reaches. It then applies Purview classification and Entra ID access controls to the apps the business decides to keep. An AI Readiness Assessment measures infrastructure, data quality, and risk management before the next prompt-built app goes live.

Shadow AI Apps Frequently Asked Questions

What Is a Shadow AI App?

A shadow AI app is software an employee builds with an AI coding tool such as Lovable, Bolt, or Replit and runs without IT approval, security review, or monitoring.

Where Does Lovable Store App Data?

Lovable Cloud stores app data outside your Microsoft 365 tenant, on Lovable-managed infrastructure in the Americas, Europe, or Asia Pacific, and the region cannot change once Cloud is enabled for a project.

Does Microsoft Purview Protect Data in Vibe-Coded Apps?

Purview DLP and retention policies apply to Microsoft 365 workloads and connected sources. A database hosted by Lovable, Bolt, or Replit stays outside those policies until IT brings the app under governance.