Changelog

Deploy checks reach private sites

The check your AI agent gets after a ship now works on team-only previews and private sites too. It used to report them as not fully served, and offer a rollback, because it stopped at the sign-in page.

Stay signed in to the dashboard

Fixed the dashboard signing you out about every 12 hours, and sometimes right after switching teams. You now stay signed in for up to 90 days, as long as you use it at least once a month.

Deleting a branch removes its preview

When you delete a branch in your repository, its preview now goes with it, on every plan and every connected Git provider. You no longer need a script to clean up previews of merged branches. Deleting your default branch never touches production.

Clearer help when a domain is blocked at our CDN

When a domain you add, or one of its subdomains, is already linked to another bunny.net account (often your own), the domain page now explains why it cannot connect and gives you a ready-made support request to send to Bunny, instead of a bare error.

Prices now exclude VAT: new plans cost individuals more

Plans now cost €9, €19 and €49 a month, or €84, €180 and €480 a year, excluding VAT. If you buy a new plan as an individual, this is a price increase: your country's VAT comes on top, so Starter is €10.89 a month with 21% Dutch VAT, where it was €9. The reason: EU businesses with a VAT number paid the VAT-inclusive price without being charged VAT, because the payment provider could not lower it for them. They now pay exactly the listed price. A subscription you already have keeps its price, also when you change plan.

Your _headers and _redirects files stay private

Fixed the _headers and _redirects files at the root of your site being downloadable by anyone. They now return 404, as on Netlify and Cloudflare Pages, and their rules still apply.

Folder settings mean the same however you type them

Fixed a root folder written as /site being refused, which could publish your whole repository: /site, site/, ./site and site now mean the same folder. A project published as it is now needs an index.html at the top of that folder, or the deploy stops before anything goes online.

Security headers on every site by default

Every response from your site now carries HSTS, X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin, on sites.deploybase.eu addresses, previews and custom domains. To change one, set it for the path in your _headers file and your value wins. Of the three, only HSTS counts in scanners such as internet.nl.

Plain HTML repositories deploy as they are

A repository with no framework and no build command now publishes its top-level index.html as it is, instead of running npm run build and failing. When a repository holds no site at all, the build stops with "No site found", and when a build produces no output folder, the run page offers any folder holding an index.html as a one-click fix.

Connect a private GitHub repository from setup

When setup cannot read a repository, it now says plainly that the repository is private or the address is wrong. For a private GitHub repository, owners and admins can connect GitHub right there and carry on with the same repository, and every failed read offers dropping a folder of built files instead.

Fixes and improvements

Smaller changes from the last few days.

• At your site limit, upgrade from the new-project page and carry on with setup
• One reminder email when a checkout you started is still unpaid a day later
• A getting-started note when a new team has no site yet, off under Settings → Notifications

Unpaid extra teams pause deploys, then are removed

An extra team that is back on Free while you already own a Free team keeps its sites online, but can no longer deploy or add projects. Its owners get a reminder after 60 days, and the team is removed after 90 unless it is paid for again. Paying lifts the pause at once.

Pages refresh at the edge within an hour

The CDN now keeps your HTML for an hour instead of 30 days. A deployment still clears it right away, so this changes nothing day to day. It only bounds the rare case where one location misses that clear: it now catches up within the hour. Hashed assets keep their one-year cache, and your own Cache-Control rules still win.

Pay for several teams with one billing email

One billing email can pay for several teams, each on its own subscription, and the billing portal lists them all. Invoices in the dashboard carry the VAT breakdown and billing period of each payment. Checkout and payment handling are hardened, so a payment is never started or recorded twice.

Ownership transfers need the new owner's consent

Transferring a team now sends an offer that the other person accepts or declines within 7 days, and nothing changes until they accept. You can withdraw an open offer on the Members page.

Custom domains redirect HTTP to HTTPS

Fixed custom domains answering plain HTTP requests unencrypted instead of redirecting them to HTTPS. Every custom domain with a certificate now redirects to HTTPS, including domains you added before today.

Redirects no longer pass on another visitor's query

Fixed a redirect being cached with the query string of the first visitor who triggered it, so a later visitor could land on a URL carrying someone else's query. Redirects for requests with a query string are no longer cached at the edge.

Faster deploys and instant domain checks

Builds start sooner and upload your site faster, and direct uploads and promotions finish quicker. Checking a custom domain now answers right away instead of after 10 seconds, and you can check again every 15 seconds.

Faster dashboard pages and a per-endpoint API limit

Dashboard pages load faster, and a request that takes too long now ends with a clear message instead of a page that keeps loading. The API rate limit now counts per endpoint: 300 requests a minute per team, and 1,200 for file uploads.

Build logs show the package manager version

Your build log now names the package manager and version that installed your dependencies, and whether it came from packageManager in package.json or the platform default. pnpm projects without a packageManager pin now build with pnpm 12.15.0 instead of picking up each new pnpm release.

Server-rendered deploys no longer pile up

Server-rendered deployments nothing serves any more are now stopped to free resources, so new deploys no longer fail when old ones pile up. Rolling back to one of them starts it again first, which can take a minute or two; your three newest production deployments stay ready for an instant rollback.

New projects get an on.deploybase.dev address

Projects you create from today get an address like name.on.deploybase.dev, on a domain that is separate from the deploybase dashboard. Existing projects keep their sites.deploybase.eu address and custom domains are not affected.

Fixes and improvements

Builds deploy the commit you asked for, and certificate checks give the right advice.

• Fixed some builds since 19 October building the branch's newest commit instead of yours
• Fixed the certificate check telling correct domains to delete an AAAA record of the CDN
• Fixed server-rendered sites not publishing on 23 October; live sites kept serving

Free teams can add three viewers

Viewers no longer use a member seat. Free teams can add up to three, and every paid plan has unlimited viewers.

Certificate errors name where your domain points

Fixed a custom domain still pointing at another host being told its DNS was correct while its certificate never arrived. The dashboard now names the address your domain resolves to and the record to change, and after a day it checks every 6 hours until you click Retry the certificate.

Connecting a private GitLab repository is guided

Connecting a private GitLab repository now starts with one question: deploy every push, or only when you click Deploy. You then get three steps and a link to a GitLab token form that opens filled in. Self-hosted GitLab is recognised and gets a token for just that project. Deploy tokens work too, with their username. If GitLab turns a token down, the message says why and what to tick.

See exactly which commit was built

The build log now names the commit it checked out, and a deployment's page links that commit on your Git host. A retry rebuilds the same commit.

A current Hugo, with Dart Sass

Hugo sites now build with a current Hugo release, with Dart Sass included. The other build images are up to date too, and from now on they follow new releases. Details are in the Hugo guide at docs.deploybase.eu/guides/hugo.

Removed team members stay removed

Fixed a member you removed, or one who left, getting back into your team the next time they signed in. This could happen to the person who created the team and to members who joined through single sign-on. A removed person now lands in another team they belong to, or on a page saying they no longer have access, until someone invites them again. Team API keys keep working after a member leaves, so rotate any key they had.

Viewers no longer see personal data or build logs

Viewers on your team, such as a client's staff, still see projects, deployments and domains, but no longer see form submissions, the addresses a form notifies, build logs, function runs or other members' email addresses. Invoices are now visible to admins and owners only. The same limits apply in the API and to AI agents, and a viewer sees a short note where a panel is hidden. If a viewer needs any of this, give them the Member role under Settings, Members.

Fixes and improvements

Adding your own records to a domain whose DNS deploybase hosts works for every record type.

• Fixed A records always failing with "Invalid request body" when you added one
• A record that cannot be added now says why, not just "Failed to add DNS record"
• Entering @ as the record name now adds it to your root domain

Longer build time limits, with an early warning

Builds that time out or fail in your own build step now count toward build minutes, as successful builds always have. A failure on the platform's side and a cancelled build still never count. In return, a build can now run for 15 minutes on Free and 30 on every paid plan, up from 10. A build that uses 70% of its limit is flagged on its deployment page with its slowest step, so you hear about it before a build fails. A build that does reach the limit names the step that was running and how to speed it up.

Fixes and improvements

Signing in is safer. If you were signing in while this update went out, sign in once more.

• Fixed a flaw that let a hosted site sign you into someone else's account
• The API no longer stores or logs your visitors' IP addresses when it rate-limits requests
• Fixed the privacy policy saying access logs are kept 30 days; it is 7

Agent API keys expire after 90 days

Keys made on the Connect your agent screen now expire after 90 days, so an agent you forgot about does not keep access forever. Agent keys you already have get the full 90 days, counted from this update, and keys you create on the API keys page still never expire. Rotating a key is now one click: same name, new secret, and the old one stops working at once. API keys now lists agent keys apart from CI keys and flags any that are about to expire or have not been used in 30 days.

On-demand Astro pages on your custom domain

Astro pages that render on demand now work on your custom domains too. Sites already using @deploybase/adapter-astro get this without a redeploy.

Functions are open to every paid plan

Starter, Pro and Scale teams can now serve HTTP functions without applying for the beta, at their plan's memory and concurrency. Requests are not counted while functions are in beta. Teams already in the beta keep their access, whatever their plan.

Links outside your output folder are no longer published

A symbolic link in your build output is now published only when it points to a file inside the output folder. Other links are left out and listed on the deployment. Sites without such links are not affected.

Fixes and improvements

Two failed deploys now say what went wrong.

• A functions folder that fails to bundle shows the bundler's error instead of "Upload failed"
• An output folder that links outside your repository stops with a message that says so

Fixes and improvements

Signing in from the command line works again. If it failed for you, run deploybase login once more.

• Fixed deploybase login showing "This page didn't load" when you pressed Allow in the browser

Change your account email yourself

You can now change the email address you sign in with from Profile, without writing to support. If your team signs in through single sign-on, your address is managed there instead.

Team email addresses confirm before they get mail

A new team notification address now has to confirm by email before it gets anything, because that mail carries form submissions and billing. Your owners still get failed payments, security warnings and account notices directly.

A redesigned dashboard, built around your deploys

The dashboard is rebuilt around what you came to do. A project opens on its live site and what is left to set up, a deployment reads as a timeline with the log beside each step, and a failed build shows the reason and the fix, plus a copy for your AI assistant. Every page was checked against WCAG 2.1 AA; if something fails your keyboard or screen reader, email support@deploybase.eu and it is fixed first.

• New projects start from a repository, a folder or your AI agent
• Setup shows every value it read from your repository, and where from
• A form's messages, spam and trash sit in one inbox
• Usage shows each plan limit and what happens when you reach it

New accounts confirm their email before they deploy

A new account can sign in and look around straight away, but deploying, adding a domain, creating a form or inviting someone now waits until its email address is confirmed, and until then it gets no team mail. A banner says what is waiting and resends the link. Accounts created before 3 October are not affected. This keeps every site on deploybase tied to an address someone actually owns.

Fixes and improvements

Builds that would publish nothing now stop, and a few pages say what they mean.

• A repository that looks like a code library gets a warning in Setup before you deploy
• A build with no index.html in its output fails instead of publishing an empty site
• A build stopped by a platform restart says so, and that your code was fine
• Opening the bell marks every update read, at any time of day
• Free team owners get a way to hand over the team that works on Free

Signing out ends your session, in one click

Sign out in the account menu no longer asks you to confirm. It now also ends the session with the identity provider, not only in your browser, so it can no longer be renewed. A sign-in link you copied, bookmarked or finished in another tab starts a fresh sign-in instead of failing after your password. Fixed a crafted link that could use a sign-out address to send you to another site.

Emails that say what to do next

Every email from deploybase now has one readable design: the thing it is about up front, then the one next step. A failed build's email names the step that failed, the reason and, when a setting would fix it, the change to make, applied in one click on the build's page. Sign-up codes, password resets and the notice that your password changed now come from deploybase too, from one address, and a reply reaches a person. If a sign-up code expires, you can now ask for a new one. Your notification settings are unchanged.

A calmer sign-in, and sign-up in three fields

Sign-in, sign-up and every page you reach from an email or your terminal now share one calm, readable shape. Signing up asks for your email, your name and a password, with a Show button instead of typing the password twice. When your session ends, signing back in takes you to the page you were on, and the sign-in page lists what changed recently. How you sign in is unchanged.

Sign-up no longer reveals who has an account

Signing up with an address that already has an account now shows the same "Check your inbox" as a new sign-up, so nobody can use the form to find out whether someone uses deploybase. The owner of that address gets an email instead, with links to sign in or reset their password, at most once a day.

Fixes and improvements

Fixed email confirmation links, and links that no longer work now say why.

• Fixed email confirmation links sending you to sign-in instead of confirming your address
• An ended invitation now names its team and who can send a new one
• A share link that stopped working says whether it expired or was turned off

Fixes and improvements

Fixed problems with environment variables that could give a build the wrong value or break an import. Nothing to change on your side.

• Fixed builds sometimes getting the All value of a key also set for Production or Preview
• Fixed .env imports turning the lines of a multi-line value, like a PEM key, into variables
• Tightened access checks on environment variables

Auto-deploy pauses after ten identical failures

When ten builds in a row fail with the same error, deploys on push now pause for that project and your team gets one email, so a coding agent pushing to a repository that cannot build no longer triggers failing build after failing build. Your live site keeps serving, and deploys you start yourself still run. Failures caused by the platform or a timeout never count. Auto-deploy resumes after the next successful build or a change to your build settings, or with Resume auto-deploy on the project page.

See HTTPS traffic for each function

Each function's page now shows its HTTPS traffic over the last 24 hours: requests, typical response time, the slowest 1% and the server error rate. Until now only queued invocations were counted, so a function answering live traffic looked idle.

Cancelled builds no longer show as failed

Fixed cancelling a running build marking the deployment as failed and emailing you that the build had failed. A cancelled build now stops straight away and shows as cancelled, with no failure email. Builds you did not cancel fail and notify you as before.

Confirm your code before approving a CLI sign-in

Signing in to the deploybase CLI now shows the code from your terminal and asks you to confirm it matches before you approve. Until now the approval page never showed the code, so a link sent by someone else could have approved their terminal on your account. If the codes differ, deny access and nothing is signed in. The same release closes several other findings from a security review.

• Form CSV exports can no longer run spreadsheet formulas typed by a visitor
• Saved git credentials are only ever sent to the host they belong to
• Git repository URLs must use https; http and internal addresses are refused
• Deleting your account now erases every record, not just the main ones

Fixes and improvements

Fixed problems with CLI sign-in and branch previews, and finished rolling out one-year caching for hashed framework assets. Nothing to change on your side.

• Fixed approving a CLI sign-in failing with a server error
• Fixed HEAD requests to preview URLs returning 502, which tripped uptime monitors
• Fixed two projects' branch previews being able to claim the same address
• Hashed framework assets now cache for a year on sites.deploybase.eu and previews too

Chain build steps in your build command

Your build command now runs as a shell command, so you can chain steps with &&, pipe one command into another and set a variable inline, as in npm run lint && npm run build or NODE_ENV=production pnpm build. Until now anything beyond letters, digits and a few symbols was refused, which forced multi-step builds into a package.json script. The command still runs in your root directory after dependencies install, and a failing step fails the build. Existing build settings keep working unchanged.

Fixes and improvements

Fixed builds failing for reasons the dashboard did not explain. Build settings are now checked when you save, and a failed build names what actually went wrong. Nothing to change on your side.

• Fixed Static HTML build commands failing with "command not found"; they now run with Node
• Fixed invalid build settings saving silently, then failing your next deploy; saving now says why
• Fixed failed builds showing two contradictory summaries; you now see one, with the real reason
• Fixed large uploads being cut off after 60 seconds on slow connections

Hashed framework assets cache for a year

Files your framework names with a content hash, under /_next/static, /_astro, /_app/immutable and /_nuxt, are now served with a one-year immutable cache, so returning visitors load them from their browser instead of asking the CDN again. HTML and every other file keep revalidating on each request, so a new deploy still shows up immediately. Custom domains get this first; sites.deploybase.eu and preview URLs follow in the next few days. Nothing to change in your build.

Fixed missing pages returning 200 instead of 404

Fixed unknown URLs returning 200 OK with your 404 page as the body. Search engines read that as a soft 404, which can hold back indexing. Every site on deploybase, including custom domains, now returns a real 404 for a path that does not exist, and still serves your own 404.html as the page when you have one. Single-page apps are unaffected and keep returning 200 on deep routes. Nothing to change on your side.

Fixed builds hiding the real reason they failed

Fixed builds failing with "Upload failed" and a hint to retry when the real problem was the output directory setting. The failure now names the directory that was missing and the one your build actually wrote to, so you can correct the setting instead of retrying a build that could never succeed. Fixed other build failures showing only the generic "Build failed. Check the logs above" line as well; the specific reason is shown again.

Get an email when a push breaks your build

Build succeeded emails are now off for everyone, including teams that had them on; turn them back on under Settings → Notifications if you want them. A build that fails after a push now emails your team, at most once per project every six hours while it stays broken. Until now only builds started from the dashboard sent a failure email, so a push that broke your site went unreported until you looked. A deploy you start yourself is still mailed to you directly, every time.

Fixed rollbacks not reaching custom domains

Fixed custom domains keeping the previous build when you promoted an older deployment from the dashboard or the MCP tool. Your deploybase URL switched right away, but the domain you actually share stayed on the old build until your next push. Every promotion now moves your custom domains with it, and a rollback puts them back at the same time. Nothing to change on your side.

Fixed uploads failing at the last step

Fixed folder and CLI uploads failing at the very last step. Your files reached storage intact, but the check that confirms they landed was broken, so uploads were marked failed seconds after they had already finished. Every attempt since 13 September hit this, whether you dragged a folder onto the dashboard or ran the CLI. If you tried and gave up, it works now: upload again, with nothing to change on your side. Sorry for the failed attempts and the time they cost.

Browse for your monorepo folder

The Root directory field now lists the folders in your repository so you can click the one you want instead of typing the path. It follows the branch you selected. Repositories connected by Git URL keep the text box, and so does a repository too large for us to list.

TLS 1.2 or newer on every site

Every site on deploybase, including custom domains, now accepts only TLS 1.2 and TLS 1.3. Connections using the older TLS 1.0 and 1.1 are refused. Those versions were deprecated in 2021, and any site still accepting them is capped at a B on SSL Labs. Nothing changes for visitors on any browser released in the last decade, and there is nothing for you to configure: the change is already live on every domain we serve, and new custom domains get it from the moment they are created. If an old script or embedded device stops reaching your site, TLS is the first thing to check.

Fixes and improvements

Fixed the billing page sending you to a page that did not exist when you hit your preview or share link limit. The Manage previews and Revoke a link actions now open your projects, where a preview is deleted from the project page and a share link is revoked from its deployment. If you have several projects, the new deployments page lists every open preview in one place and lets you retire them from there.

• Fixed the Manage previews and Revoke a link actions on the billing page landing on a missing page

New teams with a taken name could not sign in

Fixed sign-in failing with a server error for a new organisation whose name matched an existing team's. The first visit tried to create the team under a name that was already taken, failed, and every page after that showed the same error, so you could not get past it by trying again. New teams now get a slightly longer address when the short one is taken, and teams already set up are not affected.

New sites got no public URL

Fixed projects created since 1 September deploying without their sites.deploybase.eu address: the build finished, but the dashboard showed no URL and the site returned a 404. New branch previews and share links had the same problem, and single-page apps deployed in that window did not get their deep-link fallback. Existing sites were not affected. The cause was on our side: the deep-link fix from 1 September configured CDN rules in a way our provider accepts for updates but rejects for new sites. If a project you created this week has no public URL, deploy it once more and the address appears within a minute.

Reloading a deep link no longer 404s

Reloading or sharing a URL like yoursite.eu/dashboard/settings on a single-page app returned a 404 instead of your app. The first page load worked, so it only showed up on a refresh or a pasted link, and it affected production URLs, branch previews and custom domains alike. Custom 404.html pages had the same problem. The cause was on our side: the CDN rule that falls back to your app shell was configured in a way that never actually fired. If your build output has a 200.html, a _redirects catch-all, or a 404.html, redeploy once after this release and deep links will work.

Fixes and improvements

Eight fixes this round: five from the onboarding feedback you sent, three from our own audits. Thank you for the sharp reports.

• Fixed deleting a branch preview silently failing when the branch name contains a slash, so previews for feature/login-style branches can now be cleaned up like any other
• Fixed a project's shown production URL going stale after changing its subdomain: the site itself moved correctly, but dashboard links and the copy button kept the old address until the next deploy
• Fixed the repository picker swallowing the first click or two when connecting a GitHub repo: the panel closed without selecting anything. One click now selects
• Fixed the deploy wizard reading "Auto-detectfrom pnpm-lock.yaml" — the missing space is back
• The docs are now linked from the deploybase.eu header and a new Resources footer column, so finding them no longer depends on knowing they exist
• Fixed the copy button on docs code blocks sitting one line too low, sometimes spilling past the edge of the block
• Fixed account signup stalling on the bot check: it now starts solving the moment you click into the email field, instead of waiting until submit. Small trade: the cursor is no longer pre-placed
• Removed dead links from the framework deploy guides and the docs footer, which pointed at pages and repos that don't exist

Bot protection without a third party

Creating an account is now protected against automated signups, and the check runs entirely on our own infrastructure. There's no puzzle to solve and no images to click — your browser quietly does a small piece of maths while you fill in the form. Nothing about you is sent to Google, Cloudflare, or any other bot-detection service, because there isn't one in the path. Signing in and signing up were already free of third-party requests; this keeps them that way. One thing to know: signing up with email and password now needs JavaScript enabled. Signing up with GitHub works either way.

• No puzzle, no images, nothing for you to click
• Our subprocessor list did not change to make this work — check it at deploybase.eu/subprocessors
• Built on ALTCHA, an open-source project from Brno, Czechia, running on our own servers

Nameserver changes confirmed within a minute

When you point a domain at our nameservers, we now confirm the change by asking your domain's registry directly instead of waiting for public DNS caches to catch up. Delegation is typically confirmed within a minute of your registrar applying the change, where it could previously take hours. A new Check now button runs the same check on demand and, if your domain still points elsewhere, shows the exact nameservers we found so you know what's left to change. We also warn you when DNSSEC is enabled at your registrar, which silently blocks delegation until you turn it off there. Applies to domains using 'We host your DNS'; domains already connected are unaffected.

Fixes and improvements

Four fixes for problems you reported this week: three in custom domains, one in the docs. All four were reported within a day of someone hitting them. Thank you for the sharp reports.

• Fixed adding a domain with 'We host your DNS' never showing the two nameservers to set at your registrar: the domain looked connected seconds after you added it, before you had changed anything, leaving no way to complete the setup. The delegation step now stays visible until your nameservers actually point at us. If you tried the option since yesterday and hit this dead end, it works now
• Fixed the domains page counting your domains in the header while the list below stayed empty. Domains waiting on nameserver delegation or an SSL certificate now always show up, together with the setup steps needed to finish connecting them, and the page keeps refreshing itself until they are live
• Fixed the SSL status claiming your DNS was correct when your DNS provider had appended your own domain to the CNAME value, the classic missing-trailing-dot mistake. The error now names the exact record to fix instead of telling you to wait
• Fixed docs links without a trailing slash redirecting to an unreachable docs.deploybase.eu:8080 address, including every API reference link inside the docs

See exactly who processes your data

Every subprocessor we use is now listed publicly at deploybase.eu/subprocessors: what each one does, where it runs, and the legal basis for any data transfer. Each vendor has a stable deep link you can cite in your own privacy policy or DPA review. Most platforms bury this in a PDF or behind a sales call. We think you should be able to check it in ten seconds, no signup, no email gate.

Docs search is back

Fixed search on docs.deploybase.eu hanging on 'Searching…' forever — the search index was silently missing from our docs builds, and every release now verifies it exists before shipping. The docs also got a redesign along the way: a landing page that shows the path from git push to live, clearer navigation with visibly clickable links throughout, and full keyboard and screen-reader support meeting WCAG 2.1 AA. Thanks to the user who reported the broken search.

Open your live site straight from the projects list

Clicking a project's URL in the projects list now opens your live site, and clicking the repository name opens the repository — each in a new tab, marked with a small external-link icon. Clicking anywhere else on the row still opens the project itself. Projects with a failed or in-progress build now sort to the top of the list, so anything that needs your attention is the first thing you see. The framework badge is gone (the icon already told you), and the docs are now one click away from the top navigation, wherever you are in the app. Suggested by one of our first users.

Fixes and improvements

Reliability fixes across billing — mostly felt when a payment didn't go through cleanly the first time.

• Fixed usage periods staying frozen after you subscribe, so paid plan limits now reset every month as intended
• Fixed accounts keeping paid features indefinitely after a failed payment — access now pauses until the payment issue is resolved
• Fixed a completed payment occasionally leaving your subscription inactive; upgrades now apply reliably, even if a confirmation arrives out of order
• Clearer error messages from the payment provider when an action can't complete, instead of a bare 'Bad Request'

Change your plan without a new checkout

You can now upgrade, downgrade, or switch between monthly and annual billing directly from the billing page. Changes apply immediately: the unused portion of your current plan is prorated against the new price and settled on your existing payment method, with no new checkout. Previously, changing plans as an existing subscriber could start a second checkout and, in the worst case, charge you twice. That path is now closed: if you already have a subscription, starting a checkout is refused and the billing page routes you through the plan change instead. Moving to the Free plan works through cancellation, so you keep your paid features until the end of the period you've paid for.

• Upgrades and downgrades apply instantly, prorated to the day
• Switch between monthly and annual billing in one click
• Fixed plan changes creating a second subscription and double-charging in rare cases

Faster sign-in with passkeys

If your account has a passkey, deploybase now asks for it as soon as you've entered your email — one tap with Face ID, Touch ID, or your security key instead of typing a password. Password and two-factor sign-in keep working exactly as before. You can add a passkey any time in your account's security settings.

Fixes and improvements

Smaller updates from the past few weeks across billing, forms, builds, and domains.

• Fixed paid subscriptions occasionally staying inactive after a completed checkout — plan upgrades now apply as soon as your payment is confirmed
• Fixed form submissions from JavaScript-rendered sites being blocked by cross-origin checks
• Fixed the form endpoint URL showing a localhost address in the dashboard
• Fixed standard install commands being rejected by overly strict build validation
• Build failure emails now reach the team owner when no notification address is configured
• Custom domains are now verified end-to-end before being marked active, so an active domain is one that is actually serving your site
• Redesigned the billing page with a clearer statement view and usage meters

Automatic VAT for all EU countries

Correct VAT is now applied automatically for every EU country, with proper invoices for every transaction. No manual tax configuration needed.

Clearer build logs

Build output now shows distinct stages (clone, install, build, deploy) with error classification, so you can pinpoint failures faster.

Hosted in the EU

All data stored and processed in Paris, France — compute, database, and authentication. Sites delivered globally via Bunny.net CDN.

• Kubernetes compute in Scaleway Paris
• High-availability PostgreSQL with automated failover
• Global CDN delivery via Bunny.net (100+ PoPs worldwide)