If your team built an app in Lovable, or an agency handed you a TanStack Start app, and customers start using it next month, this is for you. The prototype works. What it runs on, and who can change it, is the part to settle now.
What did you actually build?
A TanStack Start app, whether you knew it or not. Vercel's docs say Lovable projects "use TanStack Start as their underlying framework".
TanStack Start is "a fullstack framework powered by TanStack Router for React and Solid". On Vercel it runs as functions that scale up and down with traffic, so you do not size or run a server.
That matters for one reason. It means your prototype is ordinary code in an ordinary repository. Any developer who knows React can read it, and you are not tied to the tool that wrote it.
How does it get from Lovable to Vercel?
Through GitHub, in two steps. You sync the Lovable project to GitHub, then import the repository at vercel.com/new. Vercel detects the framework and deploys it. From then on, "every change you make in Lovable syncs to GitHub and triggers a new deployment on Vercel".
One condition: zero-configuration detection needs @lovable.dev/vite-tanstack-config version 2.6.2 or later. An older project has to update that package first.
There is a shortcut, and it is a trap for anything customers use. Vercel's guide says you can download the project as a zip and drag it into Vercel Drop. Drop creates a new project and publishes it "straight to production". It has no Git connection, so later Lovable changes do not deploy on their own. Use it to show someone a demo. Do not run a business app on it.
What changes when real customers arrive?
Six things. A prototype gets away without them because nobody depends on it yet.
- 01The plan. Vercel's Hobby plan is for non-commercial, personal use only. Move the project to a Pro team in your company's name.
- 02The production branch. Vercel deploys merges to the production branch as production, and other branches as previews. Check which branch Lovable writes to, so an edit does not go live before someone checks it.
- 03The keys. Payment, messaging and database keys go into the team's environment variables, out of the code and out of the repository history.
- 04The region. Functions run in Washington, D.C. (iad1) unless you change it. There is no Vercel region in the UAE or Saudi Arabia; Mumbai (bom1) is the nearest. Put the app next to its database.
- 05A code review. Someone who did not write the prompts reads the server functions, the logins and every place customer data is read or written.
- 06Caching. Vercel's matrix shows no Incremental Static Regeneration for TanStack Start. Streaming and routing middleware are supported. Pages that must be cached and refreshed need another plan.
The second one surprises owners most. In a prototype, a change that goes live at once is the point. With customers logged in, it is how a half-finished screen reaches them on a Tuesday afternoon.
What does it cost to run, as of 16 October 2026?
The hosting is the small part. As of 16 October 2026, Vercel Pro is USD 20 a month with one deploying seat and USD 20 of usage credit. Extra deploying seats are USD 20 a month each, viewer seats are free, and usage above the credit is metered, from USD 0.128 per Active CPU hour (USD 0.14 in Mumbai). New teams get a default on-demand budget of USD 200, which you can change.
In one line: USD 20 a month for each deploying seat, and well under a dollar of usage for the sample below, inside the included credit. Our arithmetic for the portal below, from list prices at Mumbai rates, not a measured bill. Assume 20,000 requests a month, each 50 ms of Active CPU and 2 GB held for 200 ms. That is 0.28 CPU hours (USD 0.04), 2.2 GB-hours (USD 0.03) and USD 0.01 of invocations: under USD 0.10, inside the USD 20 credit.
We are not a Vercel partner and earn nothing from your Vercel bill. Our own site runs on Netlify. What stays portable: TanStack Start on Nitro builds for other hosts, and the code sits in your GitHub. What is Vercel's: the project, its previews and its settings.
Your other bills sit outside Vercel: the Lovable plan if your team keeps building there, the database, and any messaging or payment provider. Ask whoever built the prototype to list them, with the account each one sits in.
What would we do for a PRO services portal?
Take a sample Dubai PRO services firm whose operations manager built a client portal in Lovable over two weekends. Clients upload trade licence and passport copies and see where their visa or licence renewal stands. This is an illustration, not a client story.
- 01Move the repository into the firm's own GitHub organisation, and the Vercel project into a Pro team in the firm's name.
- 02Make main the production branch and protect it. Lovable and developers work on other branches, and each change gets a preview link.
- 03The operations manager approves each preview on a phone before it is merged.
- 04Take the storage and messaging keys out of the code and into environment variables, and rotate the ones that were ever committed.
- 05Read every server function that touches a client's documents, and test that one client cannot open another's files.
- 06Set the function region next to the database, and write down where the documents are stored.
If the portal exists mainly to track expiry dates on licences and visas, you may not need a custom app at all. See how we work with PRO services firms, and Mindcat Vault for papers with expiry dates.
What goes on the security questionnaire?
Vercel splits the answers in its shared responsibility model, read on 16 October 2026. Here is who writes each line.
If a contract says data must be processed inside the UAE, Vercel cannot meet it today. Say so before you sign, not after.
For a bad month, set Spend Management. Vercel sends alerts at 50%, 75% and 100% of the amount you set, and pauses production when you reach it if Pause Production Deployments is on. A budget alone does not stop usage, and the check can lag by several minutes. If a change breaks the site, Instant Rollback on Pro returns production to any earlier production deployment from the dashboard; environment variable changes are not rolled back with it.
Keep it, harden it or rebuild it?
Here is the rule we use after reading the code.
If only your own team will ever use the app, and it holds no customer data, keep it as a prototype and skip most of this.
What happens on the first call?
We call the method Preview every change: each change gets its own preview link, someone on your side approves it on a phone, then it goes live, and any release can be rolled back. Send us the repository, or the Lovable project, and tell us who will use it. The written assessment is free and says what to keep, what to fix and what it costs to run. The first build week is a fixed AED/SAR 14,900, and a Run plan keeps the app patched and changing afterwards. More on how we build and run apps is on our Vercel page.
