No. Bolt.new offers no Business Associate Agreement in any public document, and its own trust profile lists only SOC 2 Type 2, GDPR and CCPA. HIPAA appears twice in Bolt's materials, both times describing a self-hosted deployment in your own cloud. Bolt is fine for prototyping on invented data; moving a Bolt app onto a stack with signed BAAs typically runs 6–10 weeks at $13K–$25K.
| Fact | Value |
|---|---|
| Tool | Bolt.new |
| Verdict | No |
| Sources checked | August 2026 |
| Typical range | $13,000–$25,000 |
| Typical timeline | 6–10 weeks |
| Last updated | August 2026 |
What a BAA would need to cover, and what Bolt actually offers
Covered here means the vendor publicly offers to sign a Business Associate Agreement for that surface. We read Bolt's and StackBlitz's public documents in August 2026. We did not request a private quote, and a private answer could differ from the published one.
Your PHI
Your Bolt.new app
Outside it — PHI here is a gap
- bolt.new — the standard cloud builder
- Self-hosted BYOK deployment in your own AWS or Azure tenant
- Code-generation LLM subprocessors (Anthropic, Google Gemini)
- HIPAA on Bolt's published certifications list
- Wherever you deploy the finished app (Bolt is not a host)
| Service | Under the BAA | Condition |
|---|---|---|
| bolt.new — the standard cloud builder | Not covered | The strings BAA, Business Associate and protected health information return zero occurrences across the Terms of Service, Privacy Policy, Enterprise, Pricing and Security pages and the trust profile. |
| Self-hosted BYOK deployment in your own AWS or Azure tenant | Unconfirmed | This is the only configuration where Bolt's marketing names HIPAA. We found no BAA document for it either. Ask Bolt in writing what they will sign before treating this as settled. |
| Code-generation LLM subprocessors (Anthropic, Google Gemini) | Unconfirmed | Both are listed on Bolt's trust profile as Code Generation LLM Service Provider. Any agreement covering them would have to flow through Bolt, and nothing published says one does. |
| HIPAA on Bolt's published certifications list | Not covered | The trust profile lists SOC 2 Type 2, GDPR and CCPA. HIPAA is not on that list. A SOC 2 report is an audit of a company's controls, not a Business Associate Agreement. |
| Wherever you deploy the finished app (Bolt is not a host) | Unconfirmed | Bolt builds and previews in your browser; the shipped app runs on a separate hosting vendor you choose. The BAA question starts over with that vendor and is outside anything Bolt's documents cover. |
Vendor documents move. The Privacy Policy we read is dated May 12, 2026, the trust profile 2026-07-08, and the Terms of Service still carry January 10, 2024. Re-read them before you rely on any row here.
Two opposite conclusions are easy to reach about Bolt and HIPAA. Both are wrong.
What secondary sources say
A keyword search leads to one of two conclusions. The first: Bolt never mentions HIPAA anywhere — this is what an earlier draft of this very page said, and it was wrong. The second: Bolt does mention HIPAA on its own site, so patient data must be acceptable on bolt.new.
- Our own earlier draft of this page, corrected in August 2026
What the vendor's own documentation says
HIPAA appears twice in Bolt's materials, and both mentions describe a self-hosted, bring-your-own-key deployment inside your own AWS or Azure tenant. Separately, BAA, Business Associate and protected health information return zero occurrences across the Terms of Service, Privacy Policy, Enterprise, Pricing and Security pages and the trust profile, whose certifications list reads SOC 2 Type 2, GDPR and CCPA.
How we resolve it
The word HIPAA is on Bolt's site, and it does not describe the product you sign up for at bolt.new. For the hosted builder there is still no BAA on offer, and that is the fact that matters when you decide where real records may go.
Where PHI actually leaves your control in a Bolt project
The Bolt chat prompt
HighEverything you type into the chat, and the file contents Bolt pulls in as context, is sent to third-party code-generation model providers. Bolt's trust profile lists Anthropic and Google Gemini as subprocessors for exactly that purpose. Bolt's Privacy Policy asks users not to submit sensitive personal information in prompts, code or uploaded files.
How to check
Open the project and scroll your chat history back to the first message. Read your own prompts looking for names, dates of birth, addresses, record numbers or pasted rows from a real export. Anything you find there has already been sent.
Files and screenshots you attached to the chat
HighFounders paste a screenshot of a real chart or upload a sample export so the generated screen matches reality. Bolt's Privacy Policy names uploaded files alongside prompts and code as places sensitive data should not go.
How to check
Scroll the same chat history and look for attachment thumbnails and file chips. Open each one and check whether the sample was invented or came out of a live system.
The .env file sitting in the project file tree
HighBolt keeps environment keys in a plain .env file inside the project rather than in an encrypted secret store, so database URLs, service keys and API tokens are readable in the file tree like any other source file.
How to check
Open the file tree in your Bolt project and look for .env. Open it, list every key you see, then check in each vendor's dashboard whether those keys are still active.
Seed and fixture data committed into the project
MediumSample CSV, JSON or SQL files added to make the prototype look convincing sit in the project like any other file, are available to Bolt as context when it generates code, and travel with the project wherever it is copied or deployed.
How to check
In the file tree, open every .csv, .json and .sql file that is not configuration. Read the first ten rows of each and decide whether those are invented people or real ones.
The WebContainer preview, and the assumption it creates
MediumBolt executes the project client-side, in an isolated WebContainer in your browser, which is often read as nothing leaves my machine. The execution is local; the prompts and file contents used to generate that code are not, and they go to the code-generation providers named on the trust profile.
How to check
Open trust.bolt.new and read the subprocessor list. You will find Anthropic and Google Gemini there, each described as a code-generation LLM service provider.
The hosting provider you actually ship to
MediumBolt is a builder, not a host. The live app, its database connection and its logs run on whichever hosting vendor you deployed to, which is a separate company with separate terms and its own answer to the BAA question.
How to check
Open the dashboard of the host serving your production URL. Find your plan name, then search that vendor's own documents for Business Associate and see whether an agreement is offered on the plan you are actually on.
Six questions to answer before you talk to anyone, including us
Each one is answerable yes or no with your Bolt project and your hosting dashboard open. Four take a minute; the two chat-history questions take as long as your project is old. If none of them flags, you do not have a problem worth paying for yet.
01Scroll your Bolt chat history to the beginning: does any message you sent contain a real name, date of birth, address or medical record number?
02Does the chat contain an uploaded file or a screenshot taken from a live system rather than from test data?
03Does your project file tree contain a .env file holding keys that still work in production?
04For every vendor that stores or transmits your app's data, could you email a countersigned BAA PDF in the next five minutes?
05Are you using the standard bolt.new cloud builder rather than a self-hosted deployment inside your own AWS or Azure tenant?
06Open your production URL in a private browser window: can you reach any page showing record data without logging in?
What we would actually do about a Bolt app that has to handle records
Typical range
$13,000–$25,000
Typical timeline
6–10 weeks
- 01
Trace where real data has already been
1-2 weeksA written inventory naming every place PHI has touched the project: specific chat messages and their dates, uploaded files, keys found in .env, data files in the tree, and the hosting and database vendors currently in the path.
- 02
Rotate credentials and move secrets out of the project
1 weekEvery key that was readable in the Bolt file tree replaced with a new one, the new values held in your host's secret store, and the old ones revoked in each vendor dashboard.
- 03
Rebuild the data layer on a stack whose vendors sign BAAs
2-3 weeksThe application running on infrastructure whose vendors have countersigned agreements in your possession, with the Bolt project kept as a design reference on invented data only.
- 04
Put access control and record-level logging in front of the data
1-2 weeksAuthentication on every route that returns record data, role separation between staff and patients, and an append-only log showing which account read which record and when.
- 05
Hand it back documented
1-2 weeksA handover document listing each vendor in the finished system, which of them has a signed BAA and on what plan, where secrets now live, and the short list your team re-checks each quarter.
What moves the number
- How many vendors end up in the data path, since each one is a separate agreement to obtain and track.
- Whether real records already reached the prototype, which widens the trace stage considerably.
- How much Bolt-generated code is worth keeping versus rewriting once authentication and logging are real requirements.
- Whether you need per-record access history rather than ordinary application logs.
- Whether the app already has live users, which turns the move into a migration rather than a rebuild.
When not to hire us
- You are still prototyping on invented patients. Bolt on synthetic data needs none of this. Keep it synthetic and come back when real records are weeks away, not after they arrive.
- All you actually need is a BAA with a vendor that offers one. You sign those yourself, directly with the vendor — paying an agency to forward that email would be silly. Some vendors gate a BAA behind a paid plan or add-on, so check what tier yours requires. Note that Bolt is not one of the vendors that offers one.
- Your budget is below $13K. That is where our range starts, and we would rather say so on this page than at the end of a discovery call.
- You are looking for a certificate stating the app is HIPAA compliant. No such certification exists for HIPAA, so nobody can hand you one, us included.
Worth knowing either way
There is no government HIPAA certification
No authority certifies software as HIPAA-compliant. What exists is a signed Business Associate Agreement with every vendor that touches protected health information, plus the administrative, physical and technical safeguards you implement and document yourself.
SOC 2 is not a substitute for a BAA
Supabase states it plainly in its own documentation: “SOC 2 does not cover, nor is it a substitute for, compliance with the Health Insurance Portability and Accountability Act (HIPAA).” The same holds for every vendor here.
An absence of documentation is not a vendor promise
Several answers here rest on what vendor documents do not say. We name which documents we read and when. A vendor that has never published a HIPAA position may still decline to sign, and one that publishes nothing today may publish something next quarter.
The same question, for the other fifteen tools
Firebase
NoOnly the Google Cloud equivalents are covered — no Firebase-branded service is
Supabase
Yes, with conditionsBAA plus a paid HIPAA add-on, on the Team plan or above
v0 by Vercel
PartiallyVercel hosting is covered; v0 itself is contractually off-limits for PHI
Lovable
NoIts terms prohibit uploading protected health information
Bubble
NoIts own documentation says apps built on Bubble won't achieve compliance
Replit
NoIts Terms, Commercial Agreement and DPA carry no HIPAA or BAA terms
Bolt.new
NoNo BAA in the StackBlitz and Bolt documents we read; HIPAA is named only for self-hosted
FlutterFlow
NoIts terms bar processing HIPAA-protected data outright
Claude Code
Yes, with conditionsCovered only with zero data retention, on accounts Anthropic qualifies
Codex
Yes, with conditionsCodex Local on a Regulated or Healthcare tier; Codex Cloud is excluded
Cursor
Yes, with conditionsEnterprise only, with Privacy Mode locked organisation-wide
GitHub Copilot
NoNo BAA offered; the Data Protection Agreement tells customers not to send PHI
Devin
NoPHI is Prohibited Data under the acceptable-use policy
Hermes Agent
Not the right questionSelf-hosted — the agreement you need is with your model provider
OpenClaw
Not the right questionSelf-hosted — but the vendor-run router still receives prompts
Base44
NoNo BAA; its terms ask customers to keep PHI off the platform
Every claim on this page, with the document it came from
Quotes are copied exactly as printed on the source page. Where a claim rests on a word not appearing in a document, we say which pages we searched instead of quoting. Bolt's two HIPAA mentions are listed here too, in the last row: our verification captured the wording fragment but not the exact page URL, so that is the row to re-check first, and neither mention comes with an offer of an agreement. One entry below is marked as a partial capture: we recorded the fragment but not the exact page, and we say so rather than guessing.
No BAA is offered in any Bolt or StackBlitz document. The strings BAA, Business Associate and protected health information return zero occurrences across /terms-of-service, /privacy-policy, /enterprise, /pricing, /platform/security and trust.bolt.new. This row records an absence, so the quote column marks that absence rather than quoting wording.
no such statement found
StackBlitz ToS, Privacy Policy; Bolt Enterprise, Pricing, Security, Trust profileSource dated: ToS: January 10, 2024; Privacy Policy: May 12, 2026; trust profile: 2026-07-08Checked: August 2026Bolt's own compliance registry does not list HIPAA.
Certifications: SOC 2 Type 2 / GDPR / CCPA
Bolt's Privacy Policy asks users not to submit sensitive personal information, and names health information as a category Bolt does not intentionally process.
Bolt does not intentionally collect or process special categories of personal data (such as health information, biometric data, precise location data, or government-issued identifiers). Users should not submit sensitive personal information in prompts, code, or uploaded files.
Code runs in your browser, but prompts do not stay there: Bolt's subprocessor registry lists Anthropic and Google Gemini, each as a Code Generation LLM Service Provider.
Bolt executes your project client-side, inside your browser, in an isolated WebContainer environment.
Bolt Security page; Bolt Trust Profile (subprocessors)Source dated: Security page: date not shown; trust profile: 2026-07-08Checked: August 2026HIPAA is named twice in Bolt's marketing, both times describing a self-hosted bring-your-own-key deployment rather than the standard cloud product. Our verification captured only this fragment of the surrounding sentence, and did not record which of the two pages it sits on — re-read Bolt's enterprise and security pages before relying on it.
inside your own AWS or Azure tenant
Bolt — enterprise/security marketing (exact page not recorded at verification)Source dated: дата не указанаChecked: August 2026
Frequently asked questions
Bolt's site mentions HIPAA — doesn't that mean I'm covered?
HIPAA appears twice in Bolt's materials, and both mentions describe a self-hosted, bring-your-own-key deployment inside your own AWS or Azure tenant. Neither describes the hosted builder at bolt.new. And in neither case does Bolt publish a Business Associate Agreement, which is the document that would matter.
Can I just sign a BAA with Bolt and carry on?
We could not find one to sign. The strings BAA, Business Associate and protected health information return zero occurrences across Bolt's and StackBlitz's Terms of Service, Privacy Policy, Enterprise, Pricing and Security pages and the trust profile, as of August 2026. If you want certainty, ask Bolt sales in writing and keep the reply. Until a document arrives, treat the absence as an absence.
Bolt says it's SOC 2. Isn't that basically the same thing?
No. A SOC 2 report is an independent audit of how a company runs its own controls. A BAA is a contract about handling your patients' data. One does not stand in for the other, and there is no government HIPAA certification for either party to hold. Worth knowing: Bolt's certifications list reads SOC 2 Type 2, while a status tile on the same trust profile describes a completed SOC 2 Type 1 audit. We report the discrepancy rather than pick the flattering reading.
My code runs in the browser, so nothing leaves my machine — right?
Execution is local: Bolt runs the project client-side in an isolated WebContainer. Generation is not. Your prompts and the file contents used as context go to third-party model providers, and Bolt's trust profile lists Anthropic and Google Gemini as its code-generation subprocessors. The browser sandbox covers the running app, not the conversation that produced it.
I already pasted real patient data into the Bolt chat. What do I do now?
You cannot unsend it, so the first move is documentation, not code. Write down exactly what was pasted and on what date, ask Bolt in writing what their deletion process covers, and rotate any key that was in the project. Then give those details to whoever handles compliance or counsel for you — that call is theirs to make, and no rewrite of your app substitutes for it.
Do I have to abandon Bolt entirely?
No, and we would not suggest it. Bolt is genuinely fast at turning an idea into a working screen, and that value does not disappear. The split we use with clients is simple: Bolt stays the prototyping surface on invented data, and the version that touches real records runs on a stack whose vendors have signed agreements you can produce on request. Most of what RapidDev does in these projects is building that second half without throwing away the first.
Would self-hosting Bolt solve it?
It is the only configuration where Bolt names HIPAA, so it is a fair question to put to them. Two things to keep in mind. Running it inside your own tenant moves most of the responsibility onto you and your cloud provider. And we found no published BAA for that configuration either, so ask Bolt in writing what they would actually sign before you plan around it.
How long does moving a Bolt app onto a stack with signed BAAs take?
In our experience 6–10 weeks at $13K–$25K, and the spread is driven by how many vendors end up in the data path and whether real records already reached the prototype. Tracing where data has been and rotating exposed keys is the first two to three weeks; rebuilding the data layer and putting access control and record-level logging in front of it is the bulk of the rest.
This page reports what Bolt's and StackBlitz's own published documents said when we read them in August 2026: it is technical information rather than legal advice, HIPAA compliance is a property of your whole system and processes rather than of any single tool, and vendor terms change, so verify the current terms with the vendor before relying on anything here.
