You built it in Replit and it runs. The step after that is less about hosting than about what sits underneath it — managed sign-in and roles, keys that never reach the browser, backups somebody has actually restored, and a check on every release. That is the part this page is about.
These come up again and again — not because the tool is bad, but because they are invisible until someone goes looking.
Anything the browser needs, the browser can be asked for — and an API key pasted into the frontend during a build session is readable by anyone who opens developer tools. Roughly one in nine scanned indie apps exposes database keys this way.
Secrets are encrypted per app and per environment and injected at runtime. They never enter the code, never reach the bundle, and never get pasted into a chat.
A screen can look private and still answer anyone who requests the data behind it. Sign-in that was scaffolded quickly tends to protect the interface rather than the records, which is why 45% of AI-generated code carries an OWASP Top-10 vulnerability.
A hosted sign-in page, your own user list, roles that decide who sees what, and multi-factor authentication — managed rather than hand-rolled, so the check happens on the server every time.
An export you took once is not a backup, and a backup nobody has restored is a guess. The first time most people test recovery is the day they need it.
Backups run on a schedule around the clock, are verified by actually restoring them, and are stored encrypted. Recovery is a single action.
Each change is another chance to publish a credential or a broken permission, and the deploy that does it looks exactly like the one before.
Automatic secret scanning runs on every deploy and blocks a release that would expose credentials — on every plan. Continuous automated penetration testing ships to Pro when it lands.
Replit stays a good place to build and try things. Softkiln is where the app goes once it has real users and a real address.
Your app and its backups run in the EU by default, on your own domain with the certificate renewed for you, watched around the clock with a public status page.
The production layer around it: a hosted sign-in page with your own users and roles, secrets encrypted per environment and injected at runtime, scheduled backups that are verified by restoring them, security scanning on every deploy, and monitoring with a public status page.
You bring your application as it is. Softkiln provisions the database, the separate development and production environments and the web address around it, and takes over the parts you would otherwise wire up by hand.
Yes, on Pro — for the app and for its status page — with the certificate issued and renewed automatically.
Figures from the research linked on the home page. More questions in the FAQ.