Bolt.new vs. Replit: data protection per plan
Bolt.new (4 plans) and Replit (4 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | Bolt.new | Replit |
|---|---|---|
| Provider based in | StackBlitz, Inc., 1160 Battery Street, Suite 30W, San Francisco, CA 94111, USA | Replit, Inc., 1001 E Hillsdale Blvd, Suite 400, Foster City, CA 94404, USA |
| Plans recorded | 4 | 4 |
| Hosting | US only: all 4 plans | US only: Startermixed: Core, Pro, Enterprise |
| Training on inputs | opt-out available: Free, Prono: Teams, Enterprise | not documented: Starter, Coreopt-out available: Prono: Enterprise |
| DPA | not documented: all 4 plans | not documented: Starter, Coreyes: Pro, Enterprise |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: Bolt.new Teams vs. Replit Pro
| Feature | Bolt.newTeams | ReplitPro |
|---|---|---|
| differs by plan | not publicly documented | yes |
| Details: DPA available | not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found) | yes (DPA forms part of the Replit Commercial Agreement; EU SCCs Module Two/Three, UK Addendum; general authorisation for sub-processors) Provider’s DPA |
| differs by plan | no | opt-out available |
| Details: Training on inputs | Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general. | Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. According to the documentation, the opt-out applies only to new content and does not delete any data; processing for operation, security and troubleshooting continues. |
| differs by plan | US only | mixed |
| Details: Data residency | Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. | Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Pro: workspace and publishing region selectable (including EU). |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Privacy policy section 11: storage as… | DPA: customer may request return or… |
| Details: Data retention | Privacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented. | DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. Pricing page: database rollback up to 28 days. |
| differs by plan | 30 USD/user/mo… (further prices in the details) | 100 USD/mo… (further prices in the details) |
| Details: Price | 30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated) | 100 USD per month or 90 USD per month with annual payment (pricing page; plus taxes depending on location). The pricing page shows further Pro tiers at 225, 440, 850 and 2,050 USD per month (with annual payment 215, 425, 825 and 2,000 USD per month); monthly credits according to the FAQ 'starting at $100 for Pro'. Additional usage under Effort-Based Pricing (pay-as-you-go) or via credit packs; budgets can be set as a hard cap. |
| yes | yes | |
| Details: AI features included | yes (features of Pro plus centralised billing, team management, admin controls) | yes (10 parallel Agents, USD 100 credit for the most powerful models, up to 15 collaborators, premium support) |
| 5 sources | 11 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by plan
- Bolt.new Teamsnot publicly documented
- Replit Proyes
- Bolt.new Teams
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
Replit Proyes (DPA forms part of the Replit Commercial Agreement; EU SCCs Module Two/Three, UK Addendum; general authorisation for sub-processors)
Provider’s DPA
Training
- differs by plan
- Bolt.new Teamsno
- Replit Proopt-out available
- Bolt.new Teams
Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.
Replit ProPrivacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. According to the documentation, the opt-out applies only to new content and does not delete any data; processing for operation, security and troubleshooting continues.
Hosting
- differs by plan
- Bolt.new TeamsUS only
- Replit Promixed
- Bolt.new Teams
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
Replit ProTrust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Pro: workspace and publishing region selectable (including EU).
Sub-processors
- Bolt.new Teamslist available
- Replit Prolist available
- Bolt.new Teams
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
Replit Pro- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
Retention
- differs by plan
- Bolt.new TeamsPrivacy policy section 11: storage as…
- Replit ProDPA: customer may request return or…
- Bolt.new TeamsPrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.Replit ProDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. Pricing page: database rollback up to 28 days.
Price
- differs by plan
- Bolt.new Teams30 USD/user/mo… (further prices in the details)
- Replit Pro100 USD/mo… (further prices in the details)
- Bolt.new Teams
30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated)
Replit Pro100 USD per month or 90 USD per month with annual payment (pricing page; plus taxes depending on location). The pricing page shows further Pro tiers at 225, 440, 850 and 2,050 USD per month (with annual payment 215, 425, 825 and 2,000 USD per month); monthly credits according to the FAQ 'starting at $100 for Pro'. Additional usage under Effort-Based Pricing (pay-as-you-go) or via credit packs; budgets can be set as a hard cap.
- Bolt.new Teamsyes
- Replit Proyes
- Bolt.new Teams
yes (features of Pro plus centralised billing, team management, admin controls)
Replit Proyes (10 parallel Agents, USD 100 credit for the most powerful models, up to 15 collaborators, premium support)
Evidence
- Bolt.new Teams5 sources
- Replit Pro11 sources
- Bolt.new Teams
- PricingPricing page, retrieved 18 Oct 2026
- StackBlitz Privacy Policy (as of 2026-09-22)Privacy notice, retrieved 14 Oct 2026
- StackBlitz Terms of Service (as of 2026-09-22)Terms and conditions, retrieved 14 Oct 2026
- Bolt.new Customer Assurance Profile (Trust Center)Trust Center, retrieved 18 Oct 2026
- Bolt SecuritySecurity page, retrieved 14 Oct 2026
Replit Pro- PricingPricing page, retrieved 18 Oct 2026
- SecurityTrust Center, retrieved 14 Oct 2026
- Privacy Policy (as of 2026-08-03)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2026-04-01)DPA, retrieved 18 Oct 2026
- Subprocessors (as of August 2026)Sub-processor list, retrieved 14 Oct 2026
- Terms of Service (as of 2026-08-03)Terms and conditions, retrieved 18 Oct 2026
- Docs: Model improvementDocumentation, retrieved 18 Oct 2026
- Docs: GeographyDocumentation, retrieved 18 Oct 2026
- Replit's Trust CenterTrust Center, retrieved 18 Oct 2026
- Docs: Account InactivityDocumentation, retrieved 18 Oct 2026
- Docs: Deleting your dataDocumentation, retrieved 18 Oct 2026
| Feature | Bolt.new | Replit |
|---|---|---|
| differs by tool | not publicly documentedall 4 plans |
|
| Details: DPA available |
|
|
| differs by tool |
|
|
| Details: Training on inputs |
|
|
| differs by tool | US onlyall 4 plans |
|
| Details: Data residency |
|
|
| list availableall 4 plans | list availableall 4 plans | |
| Details: List published |
|
|
| differs by tool | Privacy policy section 11: storage as…all 4 plans | DPA: customer may request return or…all 4 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 4 plans | yesall 4 plans | |
| Details: AI features included |
|
|
| 7 sources | 12 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by tool
- Bolt.newnot publicly documentedall 4 plans
- Replit
- not publicly documentedStarter (free of charge), Core
- yesPro, Enterprise
- Bolt.new
- Free
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
- Pro
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
- Teams
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
- Enterprise
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
Replit- Starter (free of charge)
not publicly documented (the DPA forms part of the Replit Commercial Agreement; according to the Terms, this applies to Pro and Enterprise)
- Core
not publicly documented, whether included in the plan (the DPA forms part of the Replit Commercial Agreement; according to the Terms, this applies to Pro and Enterprise)
- Pro
yes (DPA forms part of the Replit Commercial Agreement; EU SCCs Module Two/Three, UK Addendum; general authorisation for sub-processors)
Provider’s DPA - Enterprise
yes (DPA forms part of the Replit Commercial Agreement)
Provider’s DPA
- Free
Training
- differs by tool
- Bolt.new
- opt-out availableFree, Pro
- noTeams, Enterprise
- Replit
- not publicly documentedStarter (free of charge), Core
- opt-out availablePro
- noEnterprise
- Bolt.new
- Free
Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active.
- Pro
Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active. Help Center 'Bolt Forge': when Forge is used, prompts, code, project files, configuration, tool calls and edit histories are stored in de-identified form and used by Bolt's partners to train open-source models (consent before first use of Forge); sessions from the EEA, UK and Switzerland are exempt; switching to another agent only stops future collection, data already collected is removed only on request to privacy@stackblitz.com.
- Teams
Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.
- Enterprise
Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.
Replit- Starter (free of charge)
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. No opt-out is documented for Starter.
- Core
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. No opt-out is documented for Core.
- Pro
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. According to the documentation, the opt-out applies only to new content and does not delete any data; processing for operation, security and troubleshooting continues.
- Enterprise
Documentation 'Model improvement' (q7): 'For Enterprise users, Replit does not use customer content to train its models.' Pricing page lists 'Advanced privacy controls' and 'Single-tenant environments' for Enterprise. Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service.
- Free
Hosting
- differs by tool
- Bolt.newUS onlyall 4 plans
- Replit
- US onlyStarter (free of charge)
- mixedCore, Pro, Enterprise
- Bolt.new
- Free
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
- Pro
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
- Teams
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
- Enterprise
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. For Enterprise, the pricing page mentions 'Data governance & retention policies'; location options are not described.
Replit- Starter (free of charge)
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Starter: no choice of region documented.
- Core
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Core: publishing region (including EU) selectable, workspace region not.
- Pro
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Pro: workspace and publishing region selectable (including EU).
- Enterprise
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Enterprise: publishing region selectable and enforceable organisation-wide; the documentation names the workspace region choice only for Pro.
- Free
Sub-processors
- Bolt.newlist availableall 4 plans
- Replitlist availableall 4 plans
- Bolt.new
- Free
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
- Pro
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
- Teams
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
- Enterprise
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
Replit- Starter (free of charge)
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Core
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Pro
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Enterprise
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Free
Retention
- differs by tool
- Bolt.newPrivacy policy section 11: storage as…all 4 plans
- ReplitDPA: customer may request return or…all 4 plans
- Bolt.new
- FreePrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.
- ProPrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.
- TeamsPrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.
- EnterprisePrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented. Enterprise: retention policies configurable according to the pricing page (details not publicly documented).
Replit- Starter (free of charge)DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': accounts not used within one year are considered inactive; Replit may terminate inactive accounts and delete data, for free accounts the apps are deleted.
- CoreDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity.
- ProDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. Pricing page: database rollback up to 28 days.
- EnterpriseDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity.
Price
- differs by tool
- Bolt.new
- 0 USDFree
- 25 USD/mo… (further prices in the details)Pro
- 30 USD/user/mo… (further prices in the details)Teams
- customEnterprise
- Replit
- 0 USDStarter (free of charge)
- 20 USD/mo… (further prices in the details)Core
- 100 USD/mo… (further prices in the details)Pro
- customEnterprise
- Bolt.new
- Free
0 USD (pricing page; net/gross not stated)
- Pro
25 USD per month with monthly payment or 18 USD per month with annual payment (pricing page; net/gross not stated)
- Teams
30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated)
- Enterprise
Individual (pricing page: 'Custom')
Replit- Starter (free of charge)
USD 0 (Starter Plan documentation; no longer listed as a separate plan on the pricing page)
- Core
20 USD per month or 18 USD per month with annual payment (pricing page; prices plus taxes depending on location). Included: 20 USD credits per month; additional usage is billed under Effort-Based Pricing (pay-as-you-go) or covered by credit packs; budgets can be set as a hard cap (pricing page, FAQ).
- Pro
100 USD per month or 90 USD per month with annual payment (pricing page; plus taxes depending on location). The pricing page shows further Pro tiers at 225, 440, 850 and 2,050 USD per month (with annual payment 215, 425, 825 and 2,000 USD per month); monthly credits according to the FAQ 'starting at $100 for Pro'. Additional usage under Effort-Based Pricing (pay-as-you-go) or via credit packs; budgets can be set as a hard cap.
- Enterprise
Individual (pricing page: 'Custom')
- Free
- Bolt.newyesall 4 plans
- Replityesall 4 plans
- Bolt.new
- Free
yes (AI app builder; 300,000 tokens per day, 1 million tokens per month)
- Pro
yes (no daily limit, from 10M tokens per month, unused tokens roll over); according to the Help Center, Bolt Forge (agent using open-source models) was included at no extra cost during the research preview from 2026-09-14 to 2026-10-14, after which Pro no longer has Forge access
- Teams
yes (features of Pro plus centralised billing, team management, admin controls)
- Enterprise
yes (features of Pro plus SSO, audit logs, compliance support, data governance and retention policies)
Replit- Starter (free of charge)
yes (daily Agent credits up to a monthly limit, Lite Build, Design Canvas; no Full Build, no Plan Mode, no AI integrations)
- Core
yes (Replit Agent, AI integrations, Plan Mode; USD 20 credit for more powerful models)
- Pro
yes (10 parallel Agents, USD 100 credit for the most powerful models, up to 15 collaborators, premium support)
- Enterprise
yes (SSO/SAML, advanced privacy controls, single-tenant environments, static egress IPs)
- Free
Evidence
- Bolt.new7 sources
- Replit12 sources
- Bolt.new
- PricingPricing page, retrieved 18 Oct 2026
- StackBlitz Privacy Policy (as of 2026-09-22)Privacy notice, retrieved 14 Oct 2026
- StackBlitz Terms of Service (as of 2026-09-22)Terms and conditions, retrieved 14 Oct 2026
- Bolt.new Customer Assurance Profile (Trust Center)Trust Center, retrieved 18 Oct 2026
- Bolt SecuritySecurity page, retrieved 14 Oct 2026
- Help Center: Bolt ForgeHelp Center, retrieved 18 Oct 2026
- What is Bolt Forge? (Bolt blog)Provider blog, retrieved 18 Oct 2026
Replit- PricingPricing page, retrieved 18 Oct 2026
- SecurityTrust Center, retrieved 14 Oct 2026
- Privacy Policy (as of 2026-08-03)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2026-04-01)DPA, retrieved 18 Oct 2026
- Subprocessors (as of August 2026)Sub-processor list, retrieved 14 Oct 2026
- Terms of Service (as of 2026-08-03)Terms and conditions, retrieved 18 Oct 2026
- Docs: Model improvementDocumentation, retrieved 18 Oct 2026
- Docs: Starter PlanDocumentation, retrieved 14 Oct 2026
- Docs: GeographyDocumentation, retrieved 18 Oct 2026
- Replit's Trust CenterTrust Center, retrieved 18 Oct 2026
- Docs: Account InactivityDocumentation, retrieved 18 Oct 2026
- Docs: Deleting your dataDocumentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
Bolt.new compared with
Individual pages: Bolt.new, Replit. All tools in the category: Software development.