Bolt.new
Provider: StackBlitz, Inc. · Based in: StackBlitz, Inc., 1160 Battery Street, Suite 30W, San Francisco, CA 94111, USA · Provider website
- Plans
- 4
- Sources
- 8
- As of
- 18 Oct
As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.
Incomplete. 7 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.
At a glance
- Hosting
- US only: all 4 plans
- Training on inputs
- opt-out available: Free, Prono: Teams, Enterprise
- DPA
- not publicly documented: all 4 plans
- Provider
- StackBlitz, Inc.
- Based in
- StackBlitz, Inc., 1160 Battery Street, Suite 30W, San Francisco, CA 94111, USA (q2, q3)
Values from 4 plans, each listed with the plans it applies to. Details and evidence are in the plan table.
Compare Bolt.new
Compare with another toolCompared plan by plan with other tools in the category Software development:
Details per plan
Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.
| Feature | FreeCompare Bolt.new Free with another tool | ProCompare Bolt.new Pro with another tool | TeamsCompare Bolt.new Teams with another tool | EnterpriseCompare Bolt.new Enterprise with another tool |
|---|---|---|---|---|
| differs by plan | 0 USD | 25 USD/mo… (further prices in the details) | 30 USD/user/mo… (further prices in the details) | custom |
| Details: Price | 0 USD (pricing page; net/gross not stated) | 25 USD per month with monthly payment or 18 USD per month with annual payment (pricing page; net/gross not stated) | 30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated) | Individual (pricing page: 'Custom') |
| yes | yes | yes | yes | |
| Details: AI features included | yes (AI app builder; 300,000 tokens per day, 1 million tokens per month) | yes (no daily limit, from 10M tokens per month, unused tokens roll over); according to the Help Center, Bolt Forge (agent using open-source models) was included at no extra cost during the research preview from 2026-09-14 to 2026-10-14, after which Pro no longer has Forge access | yes (features of Pro plus centralised billing, team management, admin controls) | yes (features of Pro plus SSO, audit logs, compliance support, data governance and retention policies) |
| not publicly documented | not publicly documented | not publicly documented | not publicly documented | |
| Details: DPA | not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found) | not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found) | not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found) | not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found) |
| differs by plan | opt-out available | opt-out available | no | no |
| Details: Training on inputs | Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active. | Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active. Help Center 'Bolt Forge': when Forge is used, prompts, code, project files, configuration, tool calls and edit histories are stored in de-identified form and used by Bolt's partners to train open-source models (consent before first use of Forge); sessions from the EEA, UK and Switzerland are exempt; switching to another agent only stops future collection, data already collected is removed only on request to privacy@stackblitz.com. | Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general. | Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general. |
| Privacy policy section 11: storage as… | Privacy policy section 11: storage as… | Privacy policy section 11: storage as… | Privacy policy section 11: storage as… | |
| Details: Data retention | Privacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented. | Privacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented. | Privacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented. | Privacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented. Enterprise: retention policies configurable according to the pricing page (details not publicly documented). |
| US only | US only | US only | US only | |
| Details: Hosting | Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. | Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. | Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. | Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. For Enterprise, the pricing page mentions 'Data governance & retention policies'; location options are not described. |
| list available | list available | list available | list available | |
| Details: Sub-processors |
|
|
|
|
| differs by plan | 5 sources | 7 sources | 5 sources | 5 sources |
| Details: Sources with retrieval date |
|
|
|
|
Compare Bolt.new Free with another tool
Price and scope
- differs by plan
- 0 USD
0 USD (pricing page; net/gross not stated)
- yes
yes (AI app builder; 300,000 tokens per day, 1 million tokens per month)
Contract and data use
- not publicly documented
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
- differs by plan
- opt-out available
Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active.
- Privacy policy section 11: storage as…
- Privacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.
Hosting and sharing
- US only
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
- list available
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
Evidence
- differs by plan
- 5 sources
- PricingPricing page, retrieved 18 Oct 2026
- StackBlitz Privacy Policy (as of 2026-09-22)Privacy notice, retrieved 14 Oct 2026
- StackBlitz Terms of Service (as of 2026-09-22)Terms and conditions, retrieved 14 Oct 2026
- Bolt.new Customer Assurance Profile (Trust Center)Trust Center, retrieved 18 Oct 2026
- Bolt SecuritySecurity page, retrieved 14 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
Third-country transfers
Privacy policy section 9: StackBlitz, Inc. is based in the US; personal data may be transferred to countries outside the jurisdiction of origin, including the US. Where required by law, StackBlitz relies on appropriate safeguards such as standard contractual clauses or other permitted mechanisms. DPF List (retrieved 2026-10-18): no entry for StackBlitz. According to the Trust Center, hosting (AWS US-West-2) and the named AI providers (Anthropic, Google) are in the subcontractor register; their processing locations are not shown.
- StackBlitz Privacy Policy (as of 2026-09-22) (Privacy notice), retrieved 14 Oct 2026
- Bolt.new Customer Assurance Profile (Trust Center) (Trust Center), retrieved 18 Oct 2026
- Data Privacy Framework List (search for StackBlitz) (Official register), retrieved 18 Oct 2026
Certifications (as stated by the provider)
The Trust Center profile (published 2026-07-08) lists SOC 2 Type 2, GDPR and CCPA under 'Certifications'; one tile additionally mentions a completed SOC 2 Type 1 audit by an independent auditor. Annual penetration test reports (summary) on request. ISO 27001: not publicly documented. The reports themselves were not inspected.
- Bolt.new Customer Assurance Profile (Trust Center) (Trust Center), retrieved 18 Oct 2026
AI Act
Functions: AI agent that creates and modifies web and full-stack applications from prompts (code generation, files, AI image editing, security agent). Models according to the Trust Center: Anthropic and Google Gemini.
Provider’s statement: not publicly documented(no mention of the EU AI Act found in the privacy policy, Terms, Trust Center or security page). The Trust Center refers to a 'Bolt AI Policy' document that is not publicly accessible.
Classification (for review, not legal advice): To be reviewed: customer is typically a deployer (Art. 3 No. 4 AI Act) of the code generation function. Applications built with Bolt may trigger their own obligations depending on their intended purpose (review Annex III). Not legal advice.
- StackBlitz Privacy Policy (as of 2026-09-22) (Privacy notice), retrieved 14 Oct 2026
- Bolt.new Customer Assurance Profile (Trust Center) (Trust Center), retrieved 18 Oct 2026
Current notes 2026
The privacy policy and Terms were first published on 2026-09-14 and updated on 2026-09-22; for existing accounts they apply from 2026-10-07. New: training of its own models and licensing of de-identified datasets based on Bolt content for accounts outside the EEA/UK/CH (opt-out), plus 'Bolt Forge' as a consent model without opt-out while active. Help Center: Forge was a research preview from 2026-09-14 to 2026-10-14, included at no extra cost in individual Pro plans, not in Teams and Enterprise. 'Bolt Lite' was a standalone plan at 9 USD per month with Forge only (access via waitlist); sign-ups closed on 2026-10-14, existing Lite subscriptions continue at the same price. Lite is therefore not listed as a separate plan.
Provider structure
According to the privacy policy and Terms, Bolt.new is operated by StackBlitz, Inc., which also offers StackBlitz.com and the WebContainer products.
Open points of the review
- No publicly retrievable DPA template found (Help Center and Trust Center without a DPA; the sub-processor link in the privacy policy leads to the Trust Center).
- Location of processing by the AI providers (Anthropic, Google; for Forge the partners for open-source models) not shown; EU region not documented.
- Specific deletion periods and retention period at the AI providers ('limited time') not quantified; 'Data Retention Policy' in the Trust Center only on access request.
- Trust Center documents (including the Bolt AI Policy and the SOC 2 report) only on access request, not reviewed; ISO 27001 not documented.
- Prices in USD without information on net/gross; Enterprise custom.
- A Forge note on the pricing page ('included until Oct 18', retrieved 2026-10-18) is no longer visible when retrieved on 2026-10-19 and is therefore not confirmed; the Help Center remains authoritative (end for Pro: 2026-10-14).
- Provider statement on the AI Act not found.
Frequently asked questions
Where does Bolt.new store data?
US only (plans: Free, Pro, Teams, Enterprise). According to the provider, as of 18 Oct 2026.
Is there a DPA for Bolt.new?
not publicly documented in: Free, Pro, Teams, Enterprise. Based on our research, as of 18 Oct 2026.
Does Bolt.new use inputs for AI training?
opt-out available in: Free, Pro; no in: Teams, Enterprise. According to the provider, as of 18 Oct 2026.
Where is the provider based?
StackBlitz, Inc., 1160 Battery Street, Suite 30W, San Francisco, CA 94111, USA. According to the provider, as of 18 Oct 2026.
All sources
- 01PricingPricing page · retrieved 18 Oct 2026
- 02StackBlitz Privacy Policy (as of 2026-09-22)Privacy notice · retrieved 14 Oct 2026
- 03StackBlitz Terms of Service (as of 2026-09-22)Terms and conditions · retrieved 14 Oct 2026
- 04Bolt.new Customer Assurance Profile (Trust Center)Trust Center · retrieved 18 Oct 2026
- 05Bolt SecuritySecurity page · retrieved 14 Oct 2026
- 06Help Center: Bolt ForgeHelp Center · retrieved 18 Oct 2026
- 07What is Bolt Forge? (Bolt blog)Provider blog · retrieved 18 Oct 2026
- 08Data Privacy Framework List (search for StackBlitz)Official register · retrieved 18 Oct 2026
More tools in Software development with an EU hosting option (in at least one plan)
- Amazon Q Developer · Based in: Depending on the account country: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
- GitHub Copilot · Based in: According to the GitHub General Privacy Statement
- IONOS AI Model Hub · Based in: IONOS Cloud GmbH, Elgendorfer Straße 57, 56410 Montabaur, Germany
- Lovable · Based in: Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden
All tools in Software development · Tools with an EU hosting option
Further reading
All tools in the category: Software development. Figures across all tools: Data report.