Why Arino One Builds on Lovable

Choosing a development platform is a long-cycle decision. The wrong one shows up two years in as brittle integrations, unclear residency, and a team that can't move quickly enough to answer buyers' questions. This is why Arino One builds conversational infrastructure on Lovable — and the honest limits of that choice.

Conversational infrastructure is slow to build and slower to change

A production WhatsApp, RCS or web-calling integration is not a weekend project. It is provider onboarding, sender registration, template approval, opt-in and opt-out logic, delivery-receipt reconciliation, retry policy, message-state persistence, GDPR-grade consent and erasure flows, audit logging, an admin console for the operations team, and a report pack the compliance team will accept. Each of those has edge cases that only surface at production volume.

Rewriting any of it — a new provider, a new region, a new consent regime — takes months on a conventional stack, because the code that has to change is spread across services that were never designed to move together.

How an AI development platform changes the economics

An AI development platform collapses the distance between intent and running code. A change that would previously take a two-week ticket becomes a same-day pull request, and the parts of the stack that used to be untouchable — the schema, the RLS policies, the edge functions — become things the team edits and ships with the same care as the UI. The result is not "less engineering". It is engineering that spends its time on the parts a customer actually notices.

That economic shift is what makes per-region, single-tenant deployments practical. Standing up a dedicated instance for a US healthcare buyer used to be a quarter of work. On this stack it is measured in days.

Why Lovable specifically

There is more than one AI development platform. Arino One builds on Lovable for reasons that are specific and verifiable:

• EU-headquartered. Lovable Labs AB is registered in Stockholm, Sweden. The company operates under EU corporate and employment law, which matters for European buyers who scrutinise the jurisdiction of every party in the chain.
• SOC 2 Type 2 and ISO 27001:2022. Independently audited controls for the platform itself. The reports are available on trust.lovable.dev under NDA. See Is Lovable secure enough for enterprise? for what the certifications do and do not cover.
• EU, US and Australia regional hosting. Application data at rest stays in the region we select, per client. This is what makes per-region deployment a real option rather than a marketing claim.
• Security scanning inside the build loop. Dependency and code scanning runs as part of the development cycle, not as a quarterly audit. Findings land in the same interface the code is written in, which is the only way they get fixed.
• No model training on customer code. Client project code is not used to train Lovable's models. This is a written commitment on lovable.dev/security; verify the current wording at the time you sign the DPA.

What Solutions Partner status gives clients

Arino One is a Lovable Solutions Partner. In practical terms, that means:

• A direct escalation path into Lovable's engineering and security teams when a client review needs an authoritative answer on platform behaviour.
• Early visibility on platform changes — new regions, new sub-processors, feature deprecations — before they land in production, so client instances aren't surprised.
• Working relationships with the people who write the DPA, the sub-processor list, and the security report, which materially shortens the questionnaire cycle for regulated buyers.

Partner status is a working relationship, not a warranty. It does not transfer Lovable's certifications to the client's application, and it does not remove the need for the client to review the platform on its own merits.

Honest limitations

A page about why we build on a specific platform is worth reading only if it tells you where the choice is harder, not just where it's easier. Three trade-offs are worth naming plainly:

• Lovable's certifications are not the client's. SOC 2 Type 2 and ISO 27001:2022 cover Lovable's platform operations. They do not certify the application Arino One builds on top, they do not certify the client's own operations, and they do not answer the buyer's questionnaire on their own. A client pursuing their own SOC 2 or ISO certification still has to do that work — inheriting the platform's controls is not the same as inheriting the audit.
• The application layer is still real engineering work. Data model, RLS policies, authentication scoping, consent capture, erasure flows, audit tables, retry and idempotency behaviour, sub-processor mapping — all of it is designed and reviewed by humans. An AI development platform makes the writing faster; it does not make the design decisions for you. A team that treats it as a shortcut around design ships fragile systems faster, which is not an improvement.
• AI-assisted development needs review, not blind trust. Generated code can be subtly wrong in ways that pass a superficial reading. That is why every change to a client instance goes through code review, an automated scan pass, and a human sign-off on security-sensitive surfaces (auth, RLS, payment, personal-data flows). The productivity gain is real; the review discipline it demands is non-negotiable.

Choosing Lovable is a bet that a platform with strong primitives, honest documentation and an EU corporate home is worth more than the flexibility of building everything from scratch. It is a bet we are willing to explain in detail because we've made it deliberately.