Publish a Bolt.new app — with your own domain

You've built something in Bolt.new that works — and now it needs to go online, ideally on your own domain. The good news: Bolt ships with a deploy button that gets you live in seconds. The honest news: it has limits you should know about before real user data comes into play. Here's the whole path, in plain language.

In short

Bolt's "Deploy" button publishes your app to Netlify and gives you a live link right away. You attach your own domain via DNS records. What the button doesn't solve: backend, a safe place for API keys, and the data location (Netlify hosts in the US). If you need more, you export the code to GitHub and host it EU-safe. Which way fits depends on whether your app processes real personal data.

1. The built-in deploy button (→ Netlify)

Bolt.new has a "Deploy" button built right in. One click, and Bolt publishes your app to Netlify — an established hosting service — and gives you a live link immediately (an address on a Netlify subdomain, such as your-project.netlify.app). You can share it straight away.

This is the fastest way to get anything online, and for a demo or a first test it's perfectly enough. What it can do: publish static frontend apps (the part that runs in the browser) with no extra setup. What it can't do: conjure up a full backend, a database, or a secure place for secret keys. More on that shortly.

When is the button enough? Prototype, landing page, demo for gathering feedback — anything where no real personal user data is being processed yet.

2. Connecting your own domain

The Netlify link works, but it doesn't look like "your" app. For your own address like my-app.com you need two things: a registered domain (bought from a provider like IONOS, Namecheap, etc.) and a couple of DNS records.

DNS is basically the phone book of the internet: it translates your domain name into the address of the server where the app lives. For non-techies, one of these two kinds of records usually does the job:

  • CNAME record — says "this (sub)domain points to that address." Common for www.my-app.com.
  • A record — points directly to a server IP address. Common for the "bare" domain my-app.com without www.

The exact values are given to you by the hosting provider; you enter them at your domain registrar. Technically this is done in a few minutes — but it can take up to 24–48 hours for the change to become visible worldwide. Don't panic if it doesn't work instantly.

3. The limits: backend, secrets, data location

This is where it gets important, because these three points are easy to overlook in a quick deploy.

Backend. Bolt mainly builds the frontend — what's visible in the browser. As soon as your app needs a database, logins, or server-side logic, a separate service comes into play (often Supabase). The Netlify deploy alone doesn't include this.

ENV secrets. The single most important point — see the warning below.

Data location. Netlify hosts in the US by default. For a private playground that doesn't matter. But as soon as your app is public or commercial and processes real personal data of people in the EU, the data location becomes relevant — for GDPR compliance you want EU data residency.

Watch out for secrets: API keys and secret keys never belong in the frontend. Anything shipped to the browser can be read in the source by any visitor with two clicks — including supposedly "hidden" variables. If you put, say, a payment or database key directly in the client code, it's public. Such keys belong in a backend or in server-side environment variables. Before going live, check that none of them are in the shipped code.

4. When you need more: GitHub export + EU hosting

As soon as your app gets serious — real users, a backend, a German/EU audience — you'll want to move beyond the pure button deploy. Bolt lets you export your project to GitHub: your code lands in a repository that you own. That gives you full control and no lock-in.

From there you can deploy the project to a platform of your choice — and this is exactly where the door to EU hosting opens: instead of the US, your app then runs on a server in the EU (no data transfer to third countries), and you can properly meet German legal obligations like the imprint (§ 5 DDG) and a privacy policy. You'll find the same comparison for Lovable apps in our article How to publish a Lovable app: 3 ways.

5. Which way for whom?

Your projectRecommended way
Just trying it out, demo, feedbackDeploy button (Netlify) — fast & free
Own domain, no backend, US servers fineDeploy button + DNS records
Backend/logins, more controlGitHub export + your own platform
Public/commercial, German/EU, legally safeGitHub export + EU hosting with auto-legal

In the end it comes down to one question: does your app process real personal data of people in the EU? If so, there's hardly a way around EU data residency, a checked secret setup, and a clean imprint.

The whole fourth step comes as a single sentence

Instead of Netlify (US) + domain setup + a manual secret check: VibeDeploy scans for leaked keys on deploy and puts your Bolt app live EU-safe — imprint & privacy policy automatically. Just tell your AI tool "deploy this."

Start free → claude mcp add vibedeploy -- npx @denkprozesse-deploy/vibe

Frequently asked questions

How do I put a Bolt.new app online?

The fastest route is the built-in deploy button: it publishes your app to Netlify and gives you a live link instantly. Alternatively, you export the code to GitHub and host it on a platform of your choice — for example, on an EU server.

Can I connect my own domain?

Yes. Bolt first publishes to a Netlify subdomain. You connect your own domain via DNS records (CNAME or A record). Technically it takes a few minutes; it becomes visible worldwide after up to 24–48 hours.

Are my API keys safe?

Only if they're not in the frontend. Anything shipped to the browser is publicly readable. Secret keys belong in a backend or server-side environment variables, never in client code.

Is Netlify hosting GDPR-compliant?

Netlify hosts in the US by default. For GDPR compliance with EU data residency you need your own EU server or EU-native hosting — relevant as soon as real user data is in play.

Note: This article provides general information, not legal advice. For binding guidance on imprints and data protection, consult a qualified source (e.g. e-recht24 or your local chamber of commerce).

Written by the VibeDeploy team · VibeDeploy is GDPR-safe auto-hosting for AI-built apps. Learn more →