AI App Builder Data Residency (2026): Four Layers, One Dropdown

Quick Answer

Ask eight AI app builders where your data lives and most of them will show you a dropdown. The dropdown is real. It is also answering a narrower question than the one you asked.

An AI app builder is not one system in one place. It is four systems that can each sit in a different jurisdiction:

1. The workspace. Your project files, your prompts and the generated source code, while you are still building.
2. The database. The rows your app writes once it is live.
3. The files. Uploads, images, attachments, anything your users hand you that is not a row.
4. The model. Where the inference actually runs when the builder generates code or your app calls an AI feature.

A region selector usually governs layer 2. Sometimes it governs layer 1 as a separate setting. It almost never governs layer 3, and no product in this comparison publishes a region control for layer 4.

Then there are the two questions nobody asks until the week they matter: can you change it afterwards, and what does the setting actually cover.

• 

  Softr is the only product here that is European by default. Its database sits in the AWS EU region unless you move it.

• 

  Bubble publishes the longest region list of anyone, twenty five AWS regions, and puts all of it behind a Dedicated instance.

• 

  v0 inherits Vercel's nineteen compute regions and twenty blob storage regions, and is the only product here with a documented separate control for file storage.

• 

  Replit is the only one that admits in its own documentation that development and production are two different locations, with two different menus.

• 

  Base44 is the most honest and among the most restricted. It states in plain text that residency covers storage and not processing.

• 

  Lovable gives you three continents on any paid plan and single countries only by Enterprise request.

• 

  Webflow does not offer a choice. Customer and end-user data is stored in the United States.

• 

  Bolt.new publishes no region control at all across its entire documentation set.

The finding that surprised us most is not on any of those lines. Three of these eight make the choice irreversible, and none of them says so at the moment you are choosing.

The four layers, and why the dropdown only covers one

The phrase "data residency" arrived in software from banking and healthcare, where it meant one thing: the database is in this country. An AI app builder breaks that assumption in a way a normal SaaS product does not, because the builder is itself a piece of software that holds your work.

When you prompt Lovable or Bolt.new to build something, the prompt goes somewhere, the generated code is stored somewhere, and a preview runs somewhere. That is all before your app has a single user. It is the workspace layer, and on most of these products it is governed separately from the app, or not governed at all.

Layer two is the one everyone means. It is the database behind the running app, and it is the layer a region selector normally controls.

Layer three is the quiet one. Files are stored differently from rows, usually in object storage rather than a database, often through a different subsystem with a different deployment footprint. We went looking for whether region selection follows files, and two vendors independently told us it does not.

Layer four is inference. Every product here calls a model provider to generate your code, and several offer AI features inside the apps you ship. None of the eight publishes a region control for that call. This is not an accusation that any of them mishandles it. It is an observation that the control surface stops at layer three.

Where each builder stands in September 2026

Every cell above is read from the vendor's own current documentation, and the sources are listed at the end. Where a cell says "not published" it means exactly that: the vendor's documentation does not address it. That is different from the vendor not doing it, and we have marked the one case where we can make the stronger claim.

Finding one: the region selector is a one-way door

This is the part we did not expect and the part most likely to cost somebody a weekend.

Replit publishes a two-column comparison of workspace geography against publishing geography. The two columns agree on exactly one row. Under "Can change later" both say, simply, No. Not "contact support", not "on request". No.

Lovable is equally direct once you find the sentence: "After Cloud is enabled, you cannot change the selected region, and you cannot move existing projects between regions." The workspace-level default applies only to new projects. Existing projects keep the region they were created in.

Base44 is the only one of the three that documents an escape route, and the escape route has a cost that deserves to be read twice. To move an app created before 16 April 2026 you change the workspace setting, clone the app, export the data from the original and import it into the clone. Then comes the sentence: "App users are not copied when you clone an app and cannot be exported. Users will need to sign up to the cloned app as normal."

Read that as an operations problem rather than a documentation detail. Migrating your app to the European Union means every existing account holder is signed out permanently and has to register again. For a shipped product with real customers that is not a migration, it is a relaunch.

The reason this matters more here than in ordinary SaaS is the order in which you find out. You pick a region on day one, while you are still deciding whether the thing works at all. The compliance conversation that makes the region load-bearing usually happens months later, when a customer sends a security questionnaire. By then the door has closed.

Finding two: files are the exception, and two vendors said so independently

We expected file storage to be an afterthought. What we did not expect was two unrelated vendors documenting the same carve-out in the same direction.

Base44 scopes its residency setting explicitly: it "applies to your app's data and users, as found under the Data and Users sections of your app dashboard." Then the exclusions: "Other data such as media files uploaded to your app, your Base44 account details, and billing information remains stored in the US regardless of this setting."

Bubble arrives at the same place from a completely different architecture. A Dedicated instance gives you isolated application and database compute in any of twenty five AWS regions. Bubble then publishes a list of things a Dedicated instance still shares with the main cluster: the DNS, CDN and networking layer, real-time notifications, parts of the editor, the debugger, server logs, app metrics, and file uploads.

So on the product with the widest region menu in this comparison, bought at the highest price point available, uploads still traverse shared infrastructure.

Two vendors, two architectures, one carve-out. If your compliance question is about customer-supplied documents, photographs, scans or signatures rather than about database rows, the region selector may not be answering your question at all. This is the same seam that shows up when you compare how these builders handle file storage generally, where the underlying object store is frequently a different product from the database it sits beside.

It lands hardest on apps whose primary payload is media rather than records. A team building for field service crews, where every job produces site photographs and a captured signature, is storing most of its regulated material in exactly the layer that residency settings tend to exclude.

Finding three: stored is not processed, and only one vendor says it out loud

Base44 publishes this sentence: "Data residency controls where your data is stored, not where it is processed. When your app runs, requests may be handled by Base44 services in another region before the result is saved to your chosen region."

That is a materially important distinction and Base44 is the only product in this set that states it plainly. It is worth being careful about what that means. It does not follow that the other seven process everything in-region. It follows that seven of eight do not tell you either way, and one of them does.

Under the GDPR, "processing" is an extremely broad term that covers storage but also transmission, structuring and retrieval. A guarantee scoped to storage alone is a genuine guarantee about a narrower thing than the word residency implies to most buyers. Base44 loses nothing by saying so, and gains the ability to be believed about everything else on the page.

Finding four: the menus are not symmetric

Replit is the only product here that treats development and production as separate residency decisions, which is architecturally the most honest position in this comparison. The two menus then turn out to offer different things.

Workspace geography offers North America, Europe and Asia. Publishing geography offers those three plus South America and Australia. You can therefore ship an app to Sydney, but you cannot put the workspace that builds it there.

The tier gating is also split. Workspace geography selection is available only to Pro customers. Publishing geography selection is available to Core, Pro and Enterprise. Free customers publish to North America by default, with no selection at all. Enterprise administrators can enforce a publishing geography across an organisation, but the policy "applies only to projects that have not yet been published", so anything already live in the wrong place stays there.

Finding five: Softr is European by default and nobody says so

Softr answers the question in its own documentation FAQ with one sentence: "All Softr Database data is currently stored in the AWS EU Region." Its security page offers "EU or US data residency. Host your data in the EU (Germany) or US."

Every other product in this comparison starts in the United States and offers Europe as an upgrade, an Enterprise request or not at all. Softr starts in Germany. For a European buyer that inverts the entire evaluation: there is no plan to upgrade to, no request to file, no cluster to be migrated into. The free tier gets the European database.

We should be precise about scope. That statement covers the Softr Database specifically. Softr's broader model is to connect to data sources you already own, such as an external spreadsheet or database, and query them through a proxy rather than copying them, which means for many Softr apps the residency question is answered by whatever system you connected rather than by Softr.

What Bolt.new not publishing anything actually tells you

Bolt.new is the one case where we can make the stronger claim rather than the softer one, because we read the whole index rather than searching a page.

Bolt.new publishes a complete documentation index of ninety two pages. Across that entire index there is no page about regions, data residency, data centres, the European Union or data sovereignty, and neither of the two database documentation pages names a region control. That is not an inference drawn from a failed search. It is a reading of the vendor's own published table of contents.

What it means is narrower than it sounds. Bolt.new certainly runs somewhere, and Bolt Cloud databases certainly sit in a region. The finding is that a prospective buyer cannot determine which region, or select one, from anything Bolt.new publishes. If residency is on your requirements list, that is an answer, just not a reassuring one.

Webflow: no choice, and a legal answer instead

Webflow is unambiguous in its privacy FAQ: "Webflow stores its Customers' and Customers' End Users' data in the United States, where Webflow is based." Its subprocessors are also predominantly United States based.

Webflow's answer to European customers is contractual rather than geographic. It is certified under the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework and the UK Extension, and its data processing agreement carries Standard Contractual Clauses as a transfer mechanism.

That is a legitimate and widely used approach, and it is worth understanding as a different category of answer rather than a worse version of the same one. A region selector changes where the data physically is. A transfer framework leaves the data in the United States and provides a lawful basis for it being there. Whether that satisfies your requirement is a question for your counsel, not for a comparison table, and buyers with public-sector or healthcare obligations frequently find that only the first kind of answer will do.

How to check what you actually have, in about ten minutes

None of this requires a sales call. Every one of these products exposes the answer somewhere in its own interface, and the locations are not obvious.

Lovable. Open the project, then More, then Cloud, then Overview, then Advanced settings. The row you want is labelled Database location. The workspace default, if your plan has one, lives under Settings, Security, Privacy and security, Default hosting region.

Replit. There are two answers and you need both. The publishing geography is chosen in the Publishing tool under Advanced settings, and once a project is published that is where it stays. The workspace geography was fixed when the workspace was created and cannot be inspected by changing it, because it cannot be changed.

Base44. Click the workspace name at the bottom left, then Settings, then Basic information. There is a Data residency row, and next to it a link that reads View data residency for all workspace apps. That second link is the useful one, because the setting applies per app at creation time and a workspace can easily contain apps in two different regions.

Bubble. If you are not on a Dedicated instance, you are on the shared cluster and there is no setting to find. If you are, the region was specified at provisioning.

v0. Check two things separately, because they are two products. Function region is a project setting. Blob store region is set per store at creation and shown in the dashboard, and a project can read from a store in a different region from the one its functions run in.

Softr. If the app reads from a Softr Database, it is in the EU region. If it reads from a connected external source, the residency question belongs to that source and not to Softr.

Webflow and Bolt.new. There is nothing to check. Webflow publishes that the answer is the United States. Bolt.new publishes nothing either way.

The single most useful habit is to record the answer somewhere durable on the day you create the project, because on three of these products that day is the only day the answer is under your control.

The awkward pattern across all eight

Line the eight up and something uncomfortable appears. The vendor that documents its limitations most thoroughly is Base44, and Base44 is also among the most restricted: United States by default, Europe only on Elite or Enterprise, only since April 2026, only for apps created after that date, and with media and account data excluded regardless.

Meanwhile the widest region list belongs to Bubble, and it is available only inside a Dedicated instance, which is an Enterprise purchase, and it still carves out uploads.

Transparency and capability are not correlated here, and that is worth naming because buyers routinely treat a detailed documentation page as evidence of a stronger product. In this comparison the opposite held. The products with the least to say were not the ones with the most to offer. They were mostly just the ones saying least.

Verdict, September 2026

For a European buyer who wants this to be true without an Enterprise contract: Softr. It is the only product whose database is in the European Union on the free plan, and being right by default removes the entire class of problem where somebody forgets to change a setting.

For per-layer control: v0 on Vercel. Nineteen compute regions, twenty blob regions, and a documented separate control for file storage, which is the layer everybody else excludes.

For the most honest architecture: Replit, for treating development and production as two residency decisions rather than pretending they are one, with the loud caveat that both choices are permanent.

For the most honest documentation: Base44, which is a different award from the one above. It tells you that storage is not processing, what the setting excludes and what migration costs. It is also the most constrained option here, and both facts are true at once.

Choose deliberately if you are on Lovable or Replit, because the decision you make in the first five minutes is the decision you keep. Do not assume a region selector covers your files, on any of these products, unless the vendor says so in writing. And if your obligation is geographic rather than contractual, Webflow and, on the published evidence, Bolt.new do not currently meet it.