Deploy & Hosting

Website launch checklist for an AI-built site

Before real users arrive, check ten things: your domain, your keys, your login rules, your forms and emails, your payments, consent before tracking, where personal information is stored, your Information Officer, whether search engines can find the site, and a way back if something breaks. Most items below link to the guide that explains them.

• Your domain works both ways. The bare domain and the www version both open the site, over https, with no warning. See Connect your own domain.
• Live keys, stored as secrets. Every key for a payment, email or other service is set on the live host, and test keys have been swapped for live ones. See Environment variables after deploy.
• Login and access rules tested. Log in as a second test user and make sure you can't see or change the first user's data. See Adding login to an AI-built app.
• Forms and emails arrive. Send every form once, and check the emails land in an inbox, not in spam. See Sending email from your app.
• Payments confirmed on the backend. An order is marked paid only after the gateway's message is checked, not when the customer reaches the thank-you page. See Adding a payment gateway.
• Nothing tracks before consent. Analytics loads only after a visitor agrees, and your privacy notice says what you collect. See Google Analytics and POPIA.
• You know where personal information goes. Every place it's stored, which company holds it and in which country. See Is Supabase POPIA compliant?.
• Your Information Officer is registered. A business task, not a setting in your app; see the POPIA section below.
• Search engines can find it. Each page has its own title and description, a sitemap exists, and nothing blocks indexing. See AI website not showing on Google.
• You have a way back. A saved version you can restore if a launch-day fix goes wrong. See Git and GitHub basics.

Connecting your own domain

Whichever service hosts your site, connecting a domain works in one of two ways: you add the records your host shows you wherever your domain's DNS is managed, or you move your domain's nameservers to the host. The first leaves your email alone; the second can break it if the email records aren't copied across. Old records left on the domain are a common reason a correct-looking setup fails, and a change can take anything from a few minutes to a day or more to reach everyone; your host's instructions give its own estimate. Connect your own domain covers both routes, and What Is DNS? explains the records themselves.

What POPIA asks of you when you go live

POPIA applies to your business as the "responsible party", not to the tools you build with. A backend provider can secure its own systems and sign an agreement with you, but it can't make your app compliant. What stays your job:

• Collect only what you need. The Act says personal information may only be processed if it is "adequate, relevant and not excessive" for its purpose.
• Know where it goes. If it's stored or processed outside South Africa, section 72 sets out when that's allowed, for example where the recipient is bound by a law or agreement giving adequate protection, or where the person consents.
• Put the right agreements in place with any company that handles the information for you, such as your database, email or analytics provider.
• Register your Information Officer. For a private business, the Information Officer is its head by law: a sole trader, or the chief executive or an equivalent person in a company. They must be registered with the Information Regulator before taking up their duties.

This is general information, not legal advice. For health, financial or other sensitive information, get advice for your own situation. Is Supabase POPIA compliant? works through these questions with a backend as the example, and the POPIA Compliance Checker turns them into a readout for your own app.

Does it have to be hosted in South Africa?

No. POPIA doesn't require a website to be hosted in South Africa, and it names no countries. What matters is where personal information is stored and sent, and whether section 72 allows that transfer. Moving your pages to a South African host doesn't change anything on its own if your database or email service stores the information abroad. Where to host an AI-built website covers what actually moves when you change hosts.

What isn't possible

• No platform or badge makes you POPIA compliant. A provider's security certificates describe its own systems, not your app or your business.
• A DNS change can't be made instant. You can shorten the wait by lowering the record's time-to-live (TTL) setting in advance, but not skip it.
• Your AI can't see your registrar, your host or your contracts. It can check your project's code, but the domain records, live settings and agreements are yours to check.
• A checklist isn't a guarantee. It catches what's most often missed; it doesn't replace testing the site the way a real user would.

A prompt for a pre-launch check

Paste this into your AI coding agent's chat a few days before launch, not on the day, so there's time to fix what it finds.

I'm not a coder and I'm about to put my app live
for real users. Go through my project and tell me,
for each item, whether it's done, not done, or
something you can't see and I need to check myself:

1. Every secret key is stored as a secret on the live
   host, not in the code, and any test keys have been
   replaced with live ones.
2. Login and access rules: a logged-in user can't see
   or change another user's data.
3. Forms: where each one sends its data, and whether
   the confirmation emails actually get sent.
4. Personal information: every place my app stores
   it, which company holds it and in which country.
5. Analytics or tracking: whether anything loads
   before a visitor agrees to it.
6. Each page has its own title and description, and
   nothing tells search engines not to index it.

Don't change anything yet. List what's missing first.

What to check in the AI's answer

• It separates what it checked from what it can't see. Live host settings, your domain and your agreements should be on the "check yourself" list.
• It names where personal information is stored. Each database, form service and email service by name and country, not "your backend".
• It found the access rules, or says there aren't any. "Users are logged in" isn't the same as "users can only see their own data".
• It doesn't fix everything at once. Work through the list one item at a time, testing each fix, with a saved version to go back to.