From the source
Lovable is telling builders that its own compliance certifications do not transfer to the apps they make on the platform, answering a question it says it gets often.
- The company publicly documents SOC 2 Type II, ISO 27001:2022, GDPR support and AIUC-1 certification, and points to its Trust Center for current audit information.
- Because those certifications come from independent third-party assessments with a defined scope, Lovable says its assessment covers Lovable and does not assess a customer's business.
- Builders who need their own SOC 2 report or ISO 27001 certification must put controls and processes in place, gather evidence and go through a separate assessment, and Lovable says it is working with compliance automation partners on tooling to make that easier.
- GDPR is a law rather than a certification, so Lovable walks through questions on what personal data an app collects, who decides how it is used, where it goes, whether the privacy notice matches the setup, how privacy requests are handled and who can access the data.
- For personal data inside an app, Lovable says the builder is typically the controller and Lovable is the processor, and a customer asking for a SOC 2 report covering the builder's own service needs a separate examination with an independent CPA firm.
