Push your code.We build it, host it and protect it.
Connect a GitHub repository and Apply.Build builds, hosts and protects your app on European infrastructure. Attack filtering, security alerts, metrics and logs come with every plan, for a fixed monthly price that traffic spikes never change.
Free tier, no credit card.
Follow one app from first push to production.
acme-shop is a small Node.js web shop with a PostgreSQL database. Here's everything that happens to it on Apply.Build, without anyone writing a line of infrastructure config.
01 Deploy
From GitHub to a live URL in one push.
Connect your repository and pick a branch. Apply.Build detects your language and builds your app automatically. Node.js, Python, Go, Java, PHP, Ruby, Rust and 14 more are supported, or you can bring your own Dockerfile. Every push to that branch deploys a new version.
- HTTPS out of the box. Certificates are issued and renewed for you, on our domain or up to 10 of your own.
- Undo a bad release in one click. Roll back to any of your last five deployments. It's fast because nothing is rebuilt.
- Know when a build finishes or fails. Notifications go straight to Slack or Discord.
02 Protect
Bots start probing your app as soon as it's online.
Automated scanners crawl the internet looking for new sites. They search for exposed config files and password files, try common passwords on login forms, and send malformed requests hoping to reach your database. Apply.Build puts a web application firewall (WAF) in front of every app. It filters this traffic before it ever reaches your code, and there's nothing to configure.
- See who's attacking. A live view shows blocked requests, where they come from, and what they tried.
- Your app runs in its own sealed box. Each app gets its own micro-VM, a lightweight virtual machine. A compromised app next door can't reach yours.
Elsewhere: a separate firewall service with its own setup and bill.
03 Patch
Most of your app's code was written by someone else.
acme-shop depends on hundreds of open-source packages. When a security flaw is found in one of them, your app is exposed until you update, and nobody tells you. Apply.Build continuously checks every package your app ships with. When a flaw turns up, you're told which app is affected, which package causes it, how serious it is, and which version fixes it.
- A full list of what's inside your app. We record every package in each build, in a format known as an SBOM (software bill of materials). It's the inventory customers, auditors and the EU Cyber Resilience Act increasingly ask for.
- Alerts where you already work. Vulnerability alerts go to Slack or Discord.
Elsewhere: a separate dependency-scanning tool.
04 Observe
Find out something is broken before your users do.
Every app gets response times, request rates, error counts and logs from its first deploy. When acme-shop starts returning errors, you see the spike, the failing requests and the log lines that explain them, all in one place. There's no monitoring service to set up and nothing extra to pay.
- Build logs and app logs, live while things happen.
- Status alerts in Slack or Discord when an app goes down or comes back.
05 Store
Your database next to your app, on the same platform.
Create a managed PostgreSQL database from the same dashboard. Choose the version and size, and connect acme-shop to it. You get its logs, metrics and active connections in the same view as your app. The data never leaves the EU.
- PostgreSQL 14 to 16, run for you.
- Scale up when you need to, with up to 10 database replicas.
- Backups. Restore your database to any moment in the last 7 days. Point-in-time recovery is included on every plan.
Here, all of that is one service. Elsewhere, it's a stack.
You've just seen what acme-shop gets on Apply.Build. On most platforms, the same setup means signing up for extra services to block attacks and catch vulnerable dependencies, each with its own setup, its own bill, and often its own US jurisdiction.
Hosting
Somewhere your code runs and stays running.
Protection from attack traffic
Bots probe every public app for weak spots, around the clock.
Alerts on vulnerable dependencies
Most of your code is open-source packages, and new flaws are found in them every week.
Request metrics
Response times, status codes and request rates show something broke before your users tell you.
HTTPS and custom domains
Browsers flag sites without it, and certificates expire.
EU jurisdiction
Who can legally demand access to your data.
Hosting is each platform's closest plan to 1 vCPU and 1 GiB of memory, in its lowest-priced region. Other services are the cheapest paid plan of a common tool for each job. USD list prices, converted at the ECB reference rate (1 EUR = 1.1298 USD) and rounded. Checked October 2026. Full comparison with Heroku
One service. One invoice. One jurisdiction.
Where your servers are isn't the whole story. Who owns them matters too.
US law, including the CLOUD Act and FISA 702, lets US authorities demand data from US companies even when that data is stored in Europe. An EU region from a US provider doesn't change who they answer to. Apply.Build is run by Codebite Oy, a Finnish company, on European infrastructure. Your app, its database, its logs and its backups stay in the EU, under EU law and GDPR.
Visitors
Your users
GitHub (US)
Source code, pulled to build
EU · run by Codebite Oy · EU law
Firewall (WAF)
Filters attacks
Your app
In its own micro-VM
PostgreSQL
Your database
Logs, metrics
And backups
Stripe
Payments, EU and US. No app data.
Where data goes, specifically
Our full sub-processor list is public, and we tell you before adding or replacing one. See the sub-processor list
Exactly what you get, and what's not here yet.
21 languages detected from your repository, or bring your own Dockerfile. Static sites too.
- Node.js
- Python
- Go
- Java
- PHP
- Ruby
- Rust
- C#/.NET
- F#
- Elixir
- Deno
- Scala
- Clojure
- Swift
- Dart
- Haskell
- Crystal
- Gleam
- Zig
- COBOL
- Lunatic
Build and deploy
- Language detected automatically, or your own Dockerfile
- Every push to a chosen GitHub branch
- Roll back to any of the last 5 deployments
Security
- WAF on every app
- Dependency scanning with an SBOM for each build
- Each app in its own micro-VM
Monitoring
- Response times, status codes and request rates
- Build logs and app logs
Notifications
- Slack and Discord
- Builds, deployments, status changes and vulnerabilities
Data
- Managed PostgreSQL 14 to 16
- Up to 10 replicas, 7-day point-in-time recovery
- Ephemeral disk per app, 2.5 to 20 GB
Domains and sizes
- HTTPS on every app, up to 10 custom domains
- 0.25 vCPU and 256 MiB up to 2 vCPU and 2 GiB per app
Coming next
In the works
Managed Redis
Caching and queues next to your app and database.
In the works
Object storage
Files and uploads that persist across deploys.
Need something else?
Tell us. Early users shape what we build next.
See every feature. Full limits and runtime versions are in the docs.
Your bill is known before the month starts.
You buy resource packages at €5 a month each. One package is 1 vCPU, 1 GiB of memory and 10 GB of storage, and you split it across your apps and databases however you like. There's no usage billing, and traffic spikes don't show up on your invoice.
Free tier: 0.5 vCPU and 512 MiB
No credit card. It stays active when you add paid packages, and after you cancel them.
acme-shop · monthly bill
Same every month
Web shop
Medium · 1 vCPU, 1 GiB · 1 package
€5.00
Background worker
Tiny · 0.25 vCPU, 256 MiB · 0.25 of a package
€1.25
Staging copy
Tiny · 0.25 vCPU, 256 MiB · 0.25 of a package
€1.25
PostgreSQL database
Small · 0.5 vCPU, 512 MiB · 0.5 of a package
€2.50
Total
2 packages × €5.00
€10.00
Included, with no separate line on your bill
- Firewall
- Vulnerability alerts
- Metrics
- Logs
- HTTPS
- Custom domains
- EU hosting
Questions people ask before moving their app
Still have a question?
Ask the founders directly. Contact us
Push your next app. We'll take it from there.
Deploy free in a few minutes. Questions about moving an app from Heroku, Render or elsewhere? Talk to us.
- No credit card for the free tier
- Hosted and operated in the EU
- Live status and uptime history
- Questions? Join us on Discord