You're halfway through the demo, the dashboard loads in a blink, and the client just said "wow" out loud (enjoy it, because that word has a short shelf life).
Then their operations lead asks how their team signs in, who sees which records, and where the data lives, and the prototype has nothing to say about any of it.
This scorecard grades nine of the best AI app builders on exactly those questions, plus what each one costs.
The scorecard in one minute:
Assembly is the best AI app builder once a prototype has to become a working client app, because sign-in, permissions, and branding are platform infrastructure, every app reads from one shared CRM, and there's nothing left to wire up before a client signs in.
Replit scores on full-stack reach, Lovable on chat-first speed, Base44 on all-in-one setup, and Bubble on deep visual logic.
Bolt.new is quick from chat to deploy, FlutterFlow aims at the app stores, v0 by Vercel builds polished Next.js front ends, and Figma Make turns design work into code-backed prototypes.
| Builder | Sign-in built in | Database included | Native mobile | Paid from (as of Nov. 2026) |
|---|---|---|---|---|
| Assembly | Yes, platform-managed | Yes, plus shared CRM | No | $49/mo |
| Replit | Yes | Yes | Yes, via Expo | $20/mo |
| Lovable | Yes, via Cloud | Yes, via Cloud | Not stated | $25/mo |
| Base44 | Yes | Yes | Web-view wrapper | $20/mo |
| Bubble | Yes | Yes | Yes | $39/mo |
| Bolt.new | Yes, via Bolt Cloud | Yes | Yes, via Expo | $25/mo |
| FlutterFlow | Yes | Yes | Yes | $39/mo |
| v0 by Vercel | Via integrations | Via integrations | Not stated | $30/user/mo |
| Figma Make | Via Supabase or Payload | Via Supabase or Payload | Not stated | $20/mo per Full seat |
Each column is a question someone asks the week after a good demo, and each cell comes from the vendor's own pages.
Sign-in built in. "Yes" means the platform ships a working login you don't assemble yourself. "Via" means you connect a service such as Supabase, and a strong answer pairs sign-in with per-user permissions the platform enforces.
Database included. A managed database that comes with the app scores well, because nobody has to provision, secure, or pay for a separate one.
Native mobile. "Yes" means App Store and Google Play builds, "Web-view wrapper" means a native shell around a web app, and "Not stated" means the vendor's pages don't confirm store output. Native mobile only matters if your users live on their phones.
Paid from. The lowest monthly-billed paid plan as of November 2026, before credits, seats, and overages.
No builder sweeps every column (sports fans call that a perfect game, and software buyers call it a sales pitch), so weight the columns by what your project needs.
Scorecard read: Yes on sign-in, yes on data, no on native mobile, and the strongest showing here on the questions clients ask after the demo.
In practice: You describe the app, answer a few clarifying questions, and approve a one-page plan before anything gets built. Logins, permissions, and branding are platform infrastructure that the AI doesn't have to write, and each new app arrives in your logo and colors.
The data answer is the built-in CRM. Contacts, companies, and custom fields sit behind every app, so a new app already knows your clients and shows each one only what you allow.
Clients sign in with Google, a one-click email link, or a password, and MFA is available on every plan. Each app runs in its own sandboxed environment with a dedicated database scoped to your workspace, and new apps stay hidden from clients while you test.
Secrets stay encrypted and out of generated code, and a build fails if code tries to pull one into the browser. The platform is SOC 2 Type II certified, stores data in the United States with encryption in transit and at rest, and never uses workspace or client data to train AI models.
Ditto by DBC, a marketing firm, runs a white-labeled portal for data intake, approvals, and asset delivery here, with 118K+ assets generated. The firm chose the platform partly because a rival's SOC 2 wasn't ready.
Cost: Free is $0 for 5 active contacts, 1 internal user, 75 build credits a month, and 3 apps. Starter is $49/month, Professional is $139/month, Advanced is $599/month, and Enterprise starts at $2,000/month, and live apps never use build credits.
Where it scores lower: The HIPAA BAA is available only on Advanced ($599/month), and AI features, including building new apps with the AI builder, aren't covered.
Ready-made non-AI apps such as messaging, file sharing, and contracts can handle patient data, so healthcare teams should map which apps touch it before building.
Scorecard read: Three yeses, with native iOS and Android through Expo and a pricing model that rewards simple requests.
In practice: Replit Agent builds from chat in Free, Power, or Max mode, and Plan Mode starts on Core. Every app gets a fully managed PostgreSQL database, object storage, and built-in auth through Replit Auth or Clerk Auth.
Clerk gives client apps a fully customizable login with your app's name, icon, and colors, which matters once real clients see it. You can connect GitHub or GitLab repos and have the Agent open pull requests.
For mobile, Replit's Launch feature builds, signs, and uploads your app to App Store Connect, with TestFlight supported. Replit holds SOC 2 Type II certification, and every customer gets an isolated Google Cloud project, even on the free tier.
Cost: As of November 2026, the free Starter plan publishes one app that goes down after 30 days. Core is $20/month, Pro is tiered from $100 to $2,050 a month for up to 15 collaborators, and Enterprise is custom.
Where it scores lower: The Replit Auth login page is Replit-branded, so a client-facing app needs Clerk for your own look. Replit also says its SOC 2 attestation doesn't automatically certify applications built on the platform.
Overage pricing is effort-based, so cost per request varies. SSO, SCIM, and audit logs are Enterprise-only, and App Store publishing needs your own Apple Developer account.
Scorecard read: Sign-in and data both score yes through Lovable Cloud, while native mobile output isn't stated in its docs.
In practice: Plan mode investigates your project and writes a structured plan you approve before any code is written, and Build mode implements and verifies the changes. Code mode lets you browse, edit, and download the source.
Lovable Cloud provides a database, storage, authentication, realtime, and functions on Supabase's open-source foundation, or you can connect your own Supabase project. Hosting is included, with regional hosting in the EU, US, and Asia Pacific.
Two-way Git sync covers GitHub, GitLab, and Bitbucket. A basic security scan runs every time you publish (about 10 to 15 seconds), deep scans run on demand, and Lovable's trust center lists SOC 2 Type II and ISO 27001:2022.
Cost: As of November 2026, Free is $0 with 5 build credits a day (up to 30 a month), Pro is $25/month for 100 credits, and Business is $50/month for 100 credits plus SSO and role-based access.
Where it scores lower: Lovable describes itself as a multi-tenant platform with logical isolation between workspaces and projects. SSO starts on Business, SCIM and audit logs are Enterprise-only, and Free and Pro users must opt out of training in settings.
Downloaded code and Git sync don't include database records or storage files, which migrate separately. Its mobile app is for building on the go, and app-store output isn't documented.
Scorecard read: Yes on sign-in and data, and phone apps reach the stores inside a web-view wrapper.
In practice: You describe the app in plain language, and Base44 builds the frontend, backend, database, user authentication, and payments. A responsive visual editor comes with every plan, and in-app code edits start on Starter.
End users can sign in through app SSO with Google Workspace, Microsoft, GitHub, Okta, or OIDC. Superagents automate workflows and connect your tools, and payments run through Base44 Payments powered by Wix or Stripe.
Base44 is owned by Wix and runs on Wix's security infrastructure, which it describes as SOC 2 Type II, ISO 27001, and GDPR compliant. Its enterprise page says every app runs through a built-in security scan before it can be published, and row-level security isolates data inside apps.
Cost: As of November 2026, Free is $0 with 25 message credits and up to 5 apps. Starter is $20/month, Builder $50/month, Pro $100/month, and Elite $200/month, each with larger message and integration credit allowances.
Where it scores lower: Because the mobile apps are web views, iOS apps can't sell digital content yet, and RevenueCat or in-app purchase plugins don't work. Downloading store files requires Builder or higher.
Editing code is paid-only, and the Free plan's 25 message credits disappear fast during a real build. In a trial, test the sign-in flow your clients would use, including SSO if you need it.
Scorecard read: Three yeses, with native iOS and Android built on React Native from the same editor as the web app.
In practice: One prompt generates an app with UI, logic, and a database, and the AI Agent (in beta) adds features and troubleshoots. From there, the visual editor covers frontend and backend logic in one place.
Bubble includes a built-in database, privacy rules, and user authentication with password hashing. You publish to the App Store and Google Play from Bubble, and over-the-air updates skip resubmission. Version control runs from Basic on Starter to 25 custom branches on Team.
A security dashboard flags exposed API keys and privacy rule gaps before you deploy. Bubble says it's SOC 2 Type II compliant and GDPR-ready, with DDoS protection through Cloudflare.
Cost: As of November 2026, Web Starter is $39/month per app, Growth is $134, and Team is $399. Web and Mobile plans cost $69, $249, and $649, and the free plan builds and tests without a live site.
Where it scores lower: There's no code export, since Bubble apps can only run on the Bubble platform. Bubble does say that if it's ever discontinued, its source code would be released under an open-source license.
Usage is metered in workload units with overages billed unless you cap them. Starter has one editor, mobile build submissions are capped per month (5 on Starter), and SSO, the SOC 2 report, and hosting-location choice sit on Enterprise.
Scorecard read: Yes on sign-in and data through Bolt Cloud, and native mobile through Expo if you choose it at the start.
In practice: You chat with the Bolt Agent, choosing "Plan" or "Build now", and start from a prompt, a Figma frame, a Google Stitch design, a GitHub repo, or a template. A code view handles direct edits.
Bolt Cloud covers hosting, domains, a built-in database with authentication, file storage, and server functions, or you can connect Supabase. GitHub integration syncs commits and branches, and design systems import from a GitHub repo, an NPM package, Storybook, a website, or files.
While you build, code runs in an isolated WebContainer inside your browser. Bolt says it's SOC 2 Type 2 certified and compliant with GDPR and CCPA, and Enterprise customers can deploy into their own AWS or Azure tenant with full infrastructure isolation.
Cost: As of November 2026, Free is $0 with 1M tokens a month, Pro is $25/month starting at 10M tokens, and Teams is $30 per member a month.
Where it scores lower: Bolt's docs say web projects don't easily switch over to mobile, so a late change of mind costs a rebuild. Free sites stop serving when they hit monthly data limits.
SSO and audit logs are Enterprise-only, and Teams members don't share tokens. Before you commit, ask in the first prompt for the platform you'll ship on.
Scorecard read: Yes on all three for the new AI-first FlutterFlow, which ships a managed database, sign-in, and file storage.
In practice: FlutterFlow is now two products: the classic visual builder is FlutterFlow Studio, and the FlutterFlow name belongs to a new AI-first builder that turns a description into a mobile app.
In the new one, an AI agent plans, builds, and checks screens, with a first version in about five minutes.
Studio keeps the hands-on tools: an Action Flow Editor, Firebase or Supabase (or any REST API) for data and auth, custom Dart code, an AI Agent that edits the project, and Test Pilot for AI testing. It publishes to the App Store, Google Play, and the web.
Studio lets you download the Flutter project on any paid plan, and you can bring your own Claude, Codex, Antigravity, or Gemini account into the desktop app.
Cost: As of November 2026, Free is $0, Basic is $39/month, Pro is $80/month, and Max is $150/month, with one AI allowance shared across both products.
Where it scores lower: FlutterFlow Studio states SOC 2 Type 1 certification only, so ask for details if a client's security review expects Type II. Studio expects you to bring your own backend, projects can't move between the two products, and the new FlutterFlow doesn't support Team accounts.
Scorecard read: Sign-in and data arrive through integrations you connect, and native mobile isn't stated, so the strength here is the front end.
In practice: You chat with an agent that plans, creates tasks, and connects to databases as it builds, and Design Mode adds visual controls with a live preview. New chats start with a Next.js app using shadcn/ui and Tailwind CSS.
The backend comes through Vercel Marketplace integrations such as Neon, Supabase, and Upstash, plus Stripe and AI platforms, with one-click deploys to Vercel. You can push code directly to a GitHub repository, even on the free plan.
Custom shadcn registries keep output on your design system, and chats can move between personal and team scopes with their linked Vercel project. Vercel's enterprise page lists SOC 2, ISO, GDPR, and HIPAA, with inference on AWS Bedrock.
Cost: As of November 2026, Free gives new users $5 in one-time credits, Plus is $30/user/month, and Business is $100/user/month with training opt-out by default.
Where it scores lower: Output is Next.js web, and no native mobile builds turned up in the docs. Chat history and source files count as input tokens, so long projects get pricier per prompt.
Plus doesn't opt out of training by default, and SSO and role-based access are Enterprise-only. Design Mode isn't available on mobile viewports. If clients will log in, scope the auth integration and test it before the first demo, while you still have time to fix it.
Scorecard read: Sign-in and data come through Supabase or a Payload backend it scaffolds, and native mobile isn't stated.
In practice: You prompt on a canvas, and everything you build is code-backed and visually editable, so you can jump between code and canvas. Figma Make generates functional prototypes or web apps and publishes them as a website with a dedicated URL.
For a backend, you can connect Supabase to add user authentication, store user data, and reach private APIs. Figma Make can also scaffold a Payload backend with a database, APIs, auth, and an admin panel.
Make kits sync your npm packages, library styles, and guidelines, which keeps output close to a team's design system. Figma holds SOC 2 Type 2 and SOC 3 reports plus ISO 27001.
Cost: As of November 2026, Make comes with Figma seats. Starter is free with up to 500 AI credits a month, and the Professional Full seat is $20/month with 3,000 AI credits a month.
Where it scores lower: GitHub push is one-way, so edits made in GitHub get overwritten on the next push. Code view and download need a Full or Dev seat, and working on a local codebase is still listed as coming soon.
Figma positions Make around prototypes, so plan a separate path if the prototype has to carry real client data at scale.
If clients sign in to see their own work, weight the sign-in and database columns most, and look for permissions the platform enforces. A login the AI wrote is one more thing to audit.
If customers live on their phones, the native mobile column decides the shortlist: Replit, Bubble, Bolt.new, and FlutterFlow all score yes, and Base44 offers a web-view wrapper.
If your team already designs in Figma, Figma Make is the natural starting point, and Bolt.new can start from a Figma frame.
If budget is the hard limit, read the paid-from column as a floor, since credits, seats, and usage push most bills above it. Scoring well where your project needs it beats scoring well everywhere.
Sometimes the right answer is the tool that hands you a repository. If you have developers on staff, Lovable's two-way Git sync, Replit's GitHub and GitLab connections, and Bolt's GitHub integration let them keep working in their own tools.
The same goes for public consumer apps. The #1 builder here is made for apps people log into, so a logged-out storefront or a public marketing site belongs on a code-first tool.
And if owning the source is a requirement, FlutterFlow Studio's Flutter download and Lovable's codebase download are the clearer paths. Just budget for the hosting, auth, and upkeep those tools leave in your hands (the prototype was the cheap part).
Replit, Lovable, Base44, Bubble, Bolt.new, and the new FlutterFlow all include a managed database. Vercel's v0 and Figma Make connect to one through integrations such as Supabase, and Figma Make can also scaffold a Payload backend.
It can, but the platform's certification doesn't cover your app automatically, so plan to test permissions and data rules yourself. Replit says as much about its own SOC 2 attestation, and Lovable runs a basic security scan every time you publish.
Figma Make works natively inside Figma, Bolt.new can start from a Figma frame, and Lovable has a Figma plugin for exporting designs. FlutterFlow's Max plan adds Figma frame import in Studio, up to 100 frames a month.