--- title: "From Prototype to Production" description: "How to turn an AI-built prototype into production-ready, compliant infrastructure." lastUpdated: "2026-06-23" canonical: "https://anvilstack.eu/en/insights/prototype-to-production" --- > Sitemap for agents: https://anvilstack.eu/llms.txt # From Prototype to Production A prototype built with Lovable, v0, Bolt or Cursor proves an idea can work – it does not make it a **production platform**. Between a running prototype and a system that stays secure and reliable under load, in failure scenarios and after months in operation lies substantial engineering work. ([AxisOps: From Prototype to Production, What Founders Get Wrong](https://www.axisops.com/insights/from-prototype-to-production-what-founders-get-wrong)) This guide lays out the five concrete phases between an AI-generated prototype and a production-ready system: realistic timelines, costs and decision criteria. - **95%** – of enterprise AI pilots fail to reach measurable ROI (MIT 2025) - **74%** – of fast-growing startups fail due to premature scaling - **45%** – of AI-generated coding tasks contain vulnerabilities (Veracode) - **6–14** – weeks typical duration: prototype → production ## Phase 1: Assessment – understanding the status quo Before a single line of code is changed, the existing prototype has to be evaluated systematically. At AnvilStack this is the job of the Analysis – the first working step of every project after the free initial consultation – and the basis for a binding quote. **What gets reviewed:** - **Architecture:** Component structure, dependency graph, data flow, state management. Is the architecture modular, or a monolith with implicit coupling? - **Security:** Authentication, authorization, input validation, secret management, OWASP Top 10. Escape.tech found over 400 exposed secrets across 5,600 vibe-coded apps, including API keys hardcoded into the frontend. ([Escape.tech: 2,000+ Vulnerabilities in Vibe-Coded Apps](https://escape.tech/blog/methodology-how-we-discovered-vulnerabilities-apps-built-with-vibe-coding/)) - **Dependencies:** Count, currency, known CVEs, license compatibility. AI-generated code tends toward oversized dependency trees. - **Scalability:** Database queries, N+1 problems, missing indexes, caching strategy, connection pooling. - **Compliance:** GDPR conformity (Art. 25 Privacy by Design), NIS2 requirements, data storage locations, data processing agreements. > **Info:** **Assessment outcome:** A prioritized action plan with categories (critical / high / medium) and a clear recommendation for the shortest path to production. Typical assessment duration: 3–5 working days. ## Phase 2: Architecture – redefining the foundation Prototypes rarely have a deliberate architecture. AI tools optimize for "works now," not "scales tomorrow." Phase 2 defines the target architecture. **Core decisions:** - **Clean architecture:** A clear separation of presentation, business logic and data access. AI-generated code almost always blends these layers. - **Database schema:** Normalization, indexing, migration strategy. Prototype schemas often have missing constraints, no foreign keys and redundant data. - **API design:** RESTful or GraphQL with consistent error handling, versioning and rate limiting. Prototypes often expose internal data structures directly. - **Auth system:** OAuth 2.0 / OIDC with proper token management, RBAC and session handling. Home-grown auth systems in prototypes are a common security risk. [Supalabs: Prototype to Production – Scaling Startup Architecture](https://www.supalabs.co/en/blog/prototype-to-production-scaling-startup-architecture/) ## Phase 3: Engineering – hardening is mandatory The validated prototype is the most precise requirements document there is: it defines what the product needs to do, and saves weeks of requirements workshops. The engineering phase puts exactly that functionality on a production-ready foundation – following the target architecture defined in phase 2, with consistent error handling and a codebase in which every line passes a senior review. **These steps are mandatory in every case:** - **Security hardening:** Input validation, output encoding, parameterized queries, CORS configuration, security headers, secret rotation - **Testing strategy:** Unit tests for business logic (>80% coverage), integration tests for API endpoints, E2E tests for critical user flows - **Code quality:** Linting, formatting, type safety (TypeScript strict mode), no `any` types, consistent error-handling patterns [Veracode: GenAI Code Security Report – Security Flaws in AI Code](https://www.veracode.com/blog/genai-code-security-report/) ## Phase 4: Infrastructure – EU-sovereign and automated Prototypes run on Vercel, Netlify or Replit – platforms optimized for demos, not for production with European compliance requirements. ([SoftwareSeni: DORA, NIS2 and the AI Act Make Sovereign Cloud Mandatory](https://www.softwareseni.com/dora-nis2-and-the-eu-ai-act-are-making-sovereign-cloud-mandatory-for-some-workloads/)) **Production infrastructure includes:** - **EU-sovereign hosting:** Deployment on Hetzner (Germany) – a privately held German GmbH, no CLOUD Act, GDPR-native. Comparable servers cost a fraction of hyperscaler prices there (details in the [Hetzner vs. AWS cost comparison](https://anvilstack.eu/en/compare/hetzner-vs-aws.md)). - **CI/CD pipeline:** An automated build-test-deploy chain with branch protection, required reviews and automated security scans before every merge. - **Monitoring:** Application performance monitoring (APM), structured logging, alerting for error rates, latency spikes and resource utilization. - **Backup & recovery:** Automated database backups, point-in-time recovery, documented and tested restore procedures. - **Staging environment:** A production-identical staging environment for QA, performance testing and deployment validation. > **Warning:** **CLOUD Act risk:** AWS Frankfurt, Azure Germany and Google Cloud Europe are subject to the CLOUD Act as US companies. For GDPR-compliant production systems, an EU-owned provider like Hetzner is the legally sound choice. ## Phase 5: Launch & Operations – going live in a controlled way Go-live is not a switch you flip once. It runs in a controlled fashion, with defined fallback options should problems arise. **Deployment strategy:** - **Blue/green deployment:** Two identical production environments – switch over with zero downtime, instant rollback if problems occur - **Health checks:** Automated verification of application endpoints, database connections and external services after every deployment - **Incident response plan:** Documented escalation paths, defined responsibilities, runbooks for common scenarios **Ongoing operations:** - **Dependency updates:** Automated checks for new CVEs, monthly dependency updates with automated testing - **Performance monitoring:** Continuous measurement of Core Web Vitals, API latency and database performance - **Capacity planning:** Regular review of resource usage, proactive scaling ahead of bottlenecks ## The 5 most common founder mistakes **1. Skipping the assessment.** "We already know what's wrong" – no, you don't. Without systematic analysis, the most critical problems get overlooked precisely because they are invisible (missing security headers, exposed secrets, race conditions). ([nFlo: Security Audit for Startups – A Practical Checklist](https://nflo.tech/knowledge-base/security-audit-for-startups-practical-checklist/)) **2. Premature scaling.** Introducing Kubernetes clusters and microservices before your first 1,000 users creates complexity without benefit. According to Startup Genome, 74% of fast-growing startups fail due to premature scaling. ([Startup Genome: Why Startups Fail, Premature Scaling (3,200+ Startups)](https://s3.amazonaws.com/startupcompass-public/StartupGenomeReport2_Why_Startups_Fail_v2.pdf)) **3. Ignoring compliance.** GDPR violations cost up to 4% of global annual revenue. ([GDPR Art. 83: Fines up to 4% of Annual Revenue](https://gdpr-info.eu/art-83-gdpr/)) Since December 2025, Germany's NIS2 implementation act has required documented cybersecurity measures. ([OpenKRITIS: NIS2 Implementation Act in Germany](https://www.openkritis.de/it-sicherheitsgesetz/nis2-umsetzung-gesetz-cybersicherheit.html)) Retrofitting compliance after the fact is far more expensive than building it in from the start. **4. Just "building on top of" the prototype.** Without an architecture review, technical debt grows exponentially. What costs an hour to fix today costs a week in six months. ([Martin Fowler: Bottleneck #01 – Tech Debt](https://martinfowler.com/articles/bottlenecks-of-scaleups/01-tech-debt.html)) **5. Treating testing as optional.** Prototypes rarely have tests. Without test coverage, any change can break existing functionality without anyone noticing before deployment – regressions then surface only in production. ## Timeline and cost: realistic expectations Duration depends on the complexity of the prototype and the target state. AI-assisted development primarily shortens routine tasks such as coding, testing and documentation, but the engineering work – review, security, load testing – remains. ([Ideas2IT: MVP Development Cost 2026](https://www.ideas2it.com/blogs/mvp-development-cost)) | Phase | Duration | Included in engagement | | --------------------------- | -------------- | ------------------------------------------------ | | 1. Assessment | 3–5 days | free (upfront, part of the initial consultation) | | 2. EU migration & hardening | 2–4 weeks | ✓ | | 3. Engineering | 4–10 weeks | ✓ | | 4. Infrastructure | 1–2 weeks | ✓ | | 5. Launch | 1 week | ✓ | | **Total** | **6–14 weeks** | **€6,000/month × 6 (€36,000 total)** | > **Tip:** **Cost comparison:** A data breach costs companies in Germany an average of €3.87M per incident (IBM Cost of a Data Breach 2025). ([IBM: Cost of a Data Breach 2025, Germany €3.87M](https://de.newsroom.ibm.com/2025-07-30-IBM-Studie-Kosten-von-Datenlecks-sinken-in-Deutschland-erstmals-seit-funf-Jahren)) The investment in systematic engineering is an order of magnitude cheaper than the alternative. ## Technical due diligence: what investors check For startups heading into a funding round, technical due diligence is a decisive gate. Investors increasingly commission external TDD reviewers to evaluate the entire tech stack: ([26lights: Tech Due Diligence Guide for Startups 2025](https://www.26lights.com/blog/tech-due-diligence-guide-for-startups/)) - **Code quality:** Modular structure, test coverage, consistent style, no obvious anti-patterns - **Architecture:** Scalability, maintainability, clear layers, documented decisions (ADRs) - **Security:** Vulnerability scans, dependency audit, penetration test results, incident response plan - **Infrastructure:** CI/CD automation, monitoring, backup strategy, disaster recovery - **Team capability:** Can the team explain, extend and maintain the code? [Sphere: Technical Due Diligence Checklist for Startups](https://www.sphereinc.com/blogs/technical-due-diligence-checklist-startup/) [madewithlove: Technical Due Diligence for SaaS Startups](https://madewithlove.com/technical-due-diligence/) A prototype that meets none of these criteria is a **red flag** in any funding round. A documented run through these five phases is effectively a pre-emptive TDD record and shortens the review in the funding process. ## Conclusion: method beats speed The fastest route to production does not run through more features, but through the right order: assessment first, then architecture, then hardening. Founders who treat the path from prototype to production as five defined phases rather than chaotic add-ons save time and money and avoid the mistakes that sink the majority of failed startups. You have an AI-generated prototype and want to go to production? In a free initial consultation, we clarify your entry path; the Analysis then evaluates your prototype and maps out the path through all five phases – down to sovereign deployment on Hetzner. We deliver the full build at €6,000 per month over 6 months (€36,000 total). [Book a no-obligation initial consultation](https://anvilstack.eu/en/contact) ## Frequently asked questions ### How long does it take to make a prototype production-ready? Typically 6–14 weeks, depending on complexity. The assessment takes 3–5 days, the engineering phase 4–10 weeks, and infrastructure and launch 1–2 weeks each. ### What does the path from prototype to production cost? The initial consultation is free; every project then begins with the paid Analysis (audit report, roadmap, cost plan). We deliver the full build from prototype to a production-ready, EU-hosted platform at €6,000 per month over 6 months (€36,000 total). ### What happens after launch? After go-live in month 3, we support your app through month 6: bug fixes and a monthly 20-hour change budget are included in the engagement. Afterwards, an optional operations and security retainer takes over from €1,200/month. ### What do investors check in technical due diligence? Code quality, architecture, security, infrastructure and team capability. A prototype with no tests, no CI/CD and hardcoded secrets is a red flag that can drag the valuation down by as much as 20%. ### Can I keep using my AI-generated prototype? Your prototype is valuable groundwork: it shows more precisely than any requirements document what your product needs to do, and saves weeks of requirements workshops. The Analysis evaluates it and determines the shortest path to a production-ready platform. ### Why do I need EU-sovereign hosting? Prototypes often run on Vercel, Netlify or AWS – all US providers subject to the CLOUD Act. For GDPR-compliant production systems, an EU-owned provider like Hetzner is the legally sound choice, at significantly lower cost. ## Sources - [AxisOps: From Prototype to Production – What Founders Get Wrong](https://www.axisops.com/insights/from-prototype-to-production-what-founders-get-wrong) - [Escape.tech: 2,000+ Vulnerabilities in 5,600 Vibe-Coded Apps](https://escape.tech/blog/methodology-how-we-discovered-vulnerabilities-apps-built-with-vibe-coding/) - [Supalabs: Prototype to Production – Scaling Startup Architecture](https://www.supalabs.co/en/blog/prototype-to-production-scaling-startup-architecture/) - [Veracode: GenAI Code Security Report 2025](https://www.veracode.com/blog/genai-code-security-report/) - [SoftwareSeni: DORA, NIS2 and the AI Act – Sovereign Cloud Mandatory](https://www.softwareseni.com/dora-nis2-and-the-eu-ai-act-are-making-sovereign-cloud-mandatory-for-some-workloads/) - [nFlo: Security Audit for Startups – A Practical Checklist](https://nflo.tech/knowledge-base/security-audit-for-startups-practical-checklist/) - [Startup Genome: Why Startups Fail, Premature Scaling](https://s3.amazonaws.com/startupcompass-public/StartupGenomeReport2_Why_Startups_Fail_v2.pdf) - [GDPR Art. 83: Fines up to 4% of Annual Revenue](https://gdpr-info.eu/art-83-gdpr/) - [OpenKRITIS: NIS2 Implementation Act in Germany](https://www.openkritis.de/it-sicherheitsgesetz/nis2-umsetzung-gesetz-cybersicherheit.html) - [Martin Fowler: Bottleneck #01 – Tech Debt](https://martinfowler.com/articles/bottlenecks-of-scaleups/01-tech-debt.html) - [Ideas2IT: MVP Development Cost 2026](https://www.ideas2it.com/blogs/mvp-development-cost) - [IBM: Cost of a Data Breach 2025, Germany €3.87M](https://de.newsroom.ibm.com/2025-07-30-IBM-Studie-Kosten-von-Datenlecks-sinken-in-Deutschland-erstmals-seit-funf-Jahren) - [26lights: Tech Due Diligence Guide for Startups 2025](https://www.26lights.com/blog/tech-due-diligence-guide-for-startups/) - [Sphere: Technical Due Diligence Checklist for Startups](https://www.sphereinc.com/blogs/technical-due-diligence-checklist-startup/) - [madewithlove: Technical Due Diligence for SaaS Startups and VCs](https://madewithlove.com/technical-due-diligence/)