You built an app with AI. It works. People want it. Before you launch, here is the checklist we run through with founders. Think of it as the difference between a car that drives and a car that’s safe to drive on the motorway with passengers.
Security gets its own checklist. This one is about everything else that keeps an app running.
1. Separate “testing” from “live”
What it means: Have at least two copies of your app: a staging copy where you try changes, and a production copy that real customers use, each with its own database.
Why it matters: When you change things straight on the live app, one bad prompt can break it for everyone or delete real data.
Good enough for launch: A staging environment that mirrors production, and a habit of trying changes there first.
2. Keep secrets out of the code
What it means: Passwords and API keys live in environment variables, settings stored with your hosting provider, not written into the code.
Why it matters: Code gets copied, shared and pushed to GitHub. Secrets in code eventually leak.
Good enough for launch: No secrets in your code or Git history, and different keys for staging and production.
3. Backups you have actually restored
What it means: Automatic, regular copies of your database, stored somewhere separate.
Why it matters: Databases get deleted, corrupted or overwritten, often by accident. A backup you’ve never tried to restore is a hope, not a backup.
Good enough for launch: Daily automated backups, kept for at least a week, and one test restore done end to end.
4. Know when it’s down before your customers do
What it means: Uptime monitoring checks your app every minute and alerts you if it stops responding.
Why it matters: Without it, you find out about outages from angry emails.
Good enough for launch: A free uptime monitor sending alerts to your phone.
5. Know when it errors
What it means: Error tracking (tools like Sentry) records every crash with enough detail to fix it.
Why it matters: Most users don’t report bugs; they just leave.
Good enough for launch: Error tracking on both the website and the server, with alerts for new errors.
6. Your own domain, with HTTPS
What it means: Your app lives at yourcompany.com, not a builder’s subdomain, and the padlock shows in the browser.
Why it matters: Trust, email deliverability, and not being locked into one tool.
Good enough for launch: Custom domain, HTTPS everywhere, and email sending set up with proper verification (SPF, DKIM) so your emails don’t land in spam.
7. Repeatable deploys and a way back
What it means: Putting a new version live is a single, repeatable step. And so is going back to the previous version.
Why it matters: Every launch eventually ships a bug. What matters is how fast you can undo it.
Good enough for launch: Deploys from your code repository, and a tested “roll back” button or command.
8. Know what it costs at 10× the users
What it means: Understand what you pay for hosting, database and AI calls per user.
Why it matters: AI features in particular can get expensive fast, and some pricing jumps steeply at certain limits.
Good enough for launch: A rough cost-per-user figure and billing alerts on every paid service.
9. Write down how it works
What it means: A one-page description of where the app is hosted, what services it uses, and who has access.
Why it matters: When something breaks at 2am, or when you hire your first developer, this page saves hours.
Not sure where you stand?
Many AI-built apps launch with only two or three of these in place. That’s normal. The point is to know which gaps matter for your app and fix them in the right order.
That’s what our free audit does: a 30-minute call and a short written summary of your top risks. Book yours here.