Where to host a vibe-coded app so it stays private

Quick answer

If the app is for your team, not the public internet, do not put it on a public deploy host and hope a password field is enough. You want a private server, company login in front of every app, and access you grant by person. That is what Croft is for.

What people mean by “host a vibe-coded app”

Vibe coding is building software by chatting with an AI assistant. Cursor, Claude, ChatGPT, and Grok can all produce a working app in an afternoon. The hard part is the next step: where does it live?

Most guides answer that with a public platform or a DIY VPS:

Public hosts (Vercel, Replit, Lovable-style deploy) give you a live URL anyone can open unless you build and maintain login yourself.
A raw VPS (nginx, Docker, Let’s Encrypt) keeps the box yours, but you own auth, backups, SSL renewals, and every next app.

Neither matches the job most small businesses have: a roster, a stocktake, or a quotes tool for their people.

Private hosting vs a public URL

Need	Public host	DIY VPS	Croft
Live URL for your team	Yes, if you add auth	Yes, if you wire auth	Yes, login is the platform
Company login / SSO	You build it	You build it	Built in
Who can open which app	You build it	You build it	You grant per app
Database and backups	Extra services	You run them	Included
AI can deploy updates	Sometimes	Manual or DIY	Cursor / Claude over MCP

When a public host is the wrong answer

Use a public host when the product is meant for customers on the open internet. Do not use one when:

The data is staff schedules, margins, customer notes, or inventory
Users should sign in as themselves, not share one password
Someone leaving the company must lose access the same day
You do not want every new AI-built app to reinvent login

Those are internal apps. They need a gate in front of the code, not a login page the model might forget.

What private hosting for vibe coding should include

Login before the app runs. The app should not contain a fragile auth page. The host checks identity first.
One place to invite people. Add staff once; they reach every app you allow.
A real database on your server. The roster lives in the app, not in a chat transcript.
Deploy from the assistant you already use. Point Cursor or Claude at the host over MCP and keep iterating.
Rollback. A bad AI change should be one click to undo.

How Croft does that

Croft is opinionated hosting for vibe-coded internal apps. You get a private server with your name on it. Every app sits behind company login. Connectors hold API keys so secrets stay out of the code. Point Cursor, Claude, or ChatGPT at your croft, or use Croft Build if you do not want to connect an assistant yet.

If you already built something in Cursor, start here: Host a Cursor app behind company login.

FAQ

Can I just put a password on a Vercel app?

You can, but you are still responsible for building and maintaining that auth, and a public host is designed for public traffic. For team tools, platform-level login is safer than hoping each AI-built app gets auth right.

Is a VPS private enough?

A VPS can be private, but privacy is not the same as access control. Without SSO, invite lists, and per-app grants, you still have a box anyone with the URL or a leaked key can reach. Croft is for people who do not want that project.

Who is this for?

The person who knows the work - roster, stocktake, quotes - and can now build the app with AI. Not an IT buyer assembling an internal developer platform, and not a founder shipping a public SaaS.

How much does Croft cost?

Solo from $24/month on annual billing, Team $99/month on annual. 7-day free trial, no card to start.

Get your croft → · See how it works →