Part of Small software companiesSmall software companies · Hosting

When a side project needs production hosting, and how to move it in an afternoon.

Move a side project to production hosting the day someone pays for it, stores data you can’t recreate, or would notice it being down. From then on you need an app that never sleeps, your own domain, backups you have restored once, an alert when it breaks, and a written answer to the privacy rules that apply to your users.

Facts checked October 30, 2026

Create a free account Custom domains docs →

Six signs the hobby deploy has become a product

A free tier is the right home for an idea. It stops being the right home at a specific moment, usually earlier than people move. Any one of these is enough:

Someone pays you. A paying customer turns “it was down this morning” from a shrug into a refund request. Payment also means invoices, card data handled by a processor, and an email address you must be able to reach.
The data can’t be recreated. Demo rows you can reseed. A customer’s six months of entries you can’t. The day the database holds the second kind, you need a backup on a schedule and proof that it restores.
People notice outages before you do. If the first sign of trouble is a message from a user, you have no monitoring. A free uptime check and error alerts fix that in ten minutes.
The app sleeps and users wait. Free tiers often stop idle apps. The first visitor after a quiet spell waits for a cold start, and a webhook from a payment provider may time out while it does.
You hand out the URL. Once the address is on a business card, an invoice or an app-store listing, it should be your domain. Moving from myapp.somehost.app later breaks every link and bookmark.
You collect personal information. An email address and a name are personal information. Canadian privacy law applies from the first record, not from some user count.

What production hosting means for one person

Not Kubernetes, not multiple regions. For a solo developer, production means a short list of things that stop you losing customers or data:

The app stays up without traffic to keep it warm.
It answers on your own domain with HTTPS that renews itself.
The database is backed up at least daily, and you have restored one of those backups into a scratch database at least once.
Errors reach you by email, and something outside your host checks the home page every few minutes.
Secrets live in environment variables, not in the repository, and you keep a copy of them somewhere other than the host.
Your laptop’s database is not the production database.

The privacy duties that start with your first user

Most side projects skip this, and it is cheap to get right when the user table is small. PIPEDA covers private-sector businesses in most provinces; Quebec’s Law 25 applies to businesses that collect information about people in Quebec. Neither has a small-business exemption for the duties below.

Law	Duty	What it means for a solo founder
PIPEDA^†	Report breaches that create a real risk of significant harm to the Privacy Commissioner, and notify the people affected as soon as feasible	Know where your user data lives so you can tell what was exposed
PIPEDA^†	Keep a record of every breach, reportable or not, for two years	A dated text file in the repo is a start
Law 25^†	The person with the highest authority is in charge of personal information by default; publish that title and contact details	That is you. Put a privacy contact on the site
Law 25^†	Notify the Commission d’accès à l’information and the people affected of incidents with a risk of serious injury; keep an incident register	Same register as above, kept up to date
Law 25^†	Do a privacy impact assessment before building or redesigning a system that handles personal information, or before sending it outside Quebec	A page of notes on what you collect, why, where it is stored, and for how long

† Competitor details come from each vendor’s own published pages on the dates shown; prices and plans change, so check the vendor before you decide. PIPEDA (2026-10-30) · PIPEDA (2026-10-30) · Law 25 (2026-10-30) · Law 25 (2026-10-30) · Law 25 (2026-10-30)

The cutover checklist

This order keeps the old app serving until the new one is proven, and leaves you a way back at every step.

Two days before: lower the TTL on the DNS record you will change to 300 seconds. Resolvers that cached the old value need one old TTL to forget it, so a record that sat at 86,400 needs a full day. Cloudflare’s minimum is 60 seconds on non-Enterprise plans.
Copy the environment variables. List every variable on the old host and set each one on the new project. Generate new secrets where you can; a leaked old one stays leaked.
Deploy to the platform’s own URL first. Sign up, upload a file, trigger the payment webhook in test mode. Fix what breaks while nobody is watching.
Freeze writes. Put the old app in maintenance mode or switch it to read-only, so nothing lands in the old database after you dump it.
Dump, restore, compare. Use pg_dump -Fc, restore into the new database, and compare row counts on your main tables.
Back up the new database right away, before any user writes to it. That backup is your known-good starting point.
Switch DNS. Add the domain on the new host, point the record at it, and wait for HTTPS to be issued. Check from a phone on mobile data, which uses a different resolver from your laptop.
Keep the old host for a week, stopped but not deleted, with its final dump. Then raise the TTL back to an hour or more.
Restore once. Restore the newest backup into a scratch database and open it. Until you have done this, you have backup files, not backups.

# 2 days before: lower the TTL on the record you will change, then check it
dig +noall +answer app.example.com      # the second column is the TTL in seconds

# Cutover: stop writes on the old host, then dump
pg_dump -Fc --no-owner "$OLD_DATABASE_URL" -f backup.dump

# Restore into the new database and compare row counts
canner db import backup.dump
psql "$OLD_DATABASE_URL" -c "select count(*) from users"
psql "$NEW_DATABASE_URL" -c "select count(*) from users"

What to pay for first

Pay first for the things that lose customers when missing: an app that is awake and a domain. Most of the rest has a free tier that is fine until you have real traffic. Bootstrapping on a small budget works through a full monthly bill.

Item	Typical cost	Pay now or later?
Always-on hosting with a custom domain	$9/mo on Canner Live	Now: sleep and a borrowed domain cost you users
.ca domain^†	Porkbun lists $11.49 a year to renew	Now (a yearly Canner Live plan includes one free .com, .ca or .quebec registration)
Off-site copy of backups^†	Backblaze B2: first 10 GB free, then $6.95/TB a month	Now, while it is free
Uptime check^†	UptimeRobot free: 50 monitors at 5-minute intervals, commercial use allowed	Now, it is free
Point-in-time recovery	$9/mo per project for Canner’s dedicated Postgres instance	Later, when losing a day of writes would hurt

† Competitor details come from each vendor’s own published pages on the dates shown; prices and plans change, so check the vendor before you decide. .ca domain (2026-10-30) · Off-site copy of backups (2026-10-30) · Uptime check (2026-10-30)

Questions

When should a side project move off a free hosting tier?

When someone pays for it, when it holds data you can’t recreate, or when users would notice it being down. Any one of these means you need an app that doesn’t sleep, daily backups you have tested, and an alert when it breaks.

How do I move my domain to a new host without downtime?

Lower the record’s TTL to 300 seconds two days ahead, deploy and test on the new host’s own URL, freeze writes on the old app, copy the database, then change the DNS record. Keep the old host stopped but intact for a week.

Do privacy laws apply to a small side project?

Yes, from the first user record. PIPEDA requires breach reporting and a two-year record of every breach. Quebec’s Law 25 makes the person with the highest authority, usually the founder, responsible for personal information and asks for a published privacy contact and an incident register.

Keep reading

Production checklist for AI-built appsNine checks before real users arrive, each with the command that proves it.Databases and backupsBackup policies, restores, and what a backup does not contain.A stack you can maintain aloneFewer moving parts, upgrade dates, and hours per month.

Give the project a home that stays awake.

Deploy on Starter for free, move to Live when the first customer pays. More for one-person companies in small software companies.

Create a free account See full pricing →