An app on your laptop only works while your laptop is open. A deployed app works on every phone and computer that should reach it, and on none that shouldn’t.
01Anyone with the link
Public on the web
A real address anyone can open on any device. Real HTTPS, sign-in where you need it, and a setup that keeps working after you close your laptop.
For exampleA product launch, a booking app for your clients, or a portfolio you share in a post.
Good for
Products and customer-facing apps
Client portals and booking tools
Anything you want to share widely
What we set up
Hosting on AWS (for example AWS Amplify) with your own domain
Sign-in, data storage and backups
Cost alerts and basic monitoring
What you look after
Who gets an admin account
Usage costs as traffic grows
Keeping content and dependencies current
How people get in
Anyone can visit. Accounts, roles and private pages are handled by the app’s own sign-in.
Worth knowing: Being public means being reachable by everyone, including bots. Sign-in rules, rate limits and data access need to be right from day one.
Typical building blocks: AWS Amplify, Amazon Cognito, Amazon DynamoDB
02Just your household
Private to your own devices
Your app stays off the public internet. Only the phones, tablets and computers you approve can open it, at home or away.
For exampleA family dashboard with the shared calendar, chores, meal plan and school reminders, on everyone’s phones and the kitchen tablet.
Good for
Family and personal dashboards
Home automation and media tools
Personal finance or health trackers
What we set up
A private network for your devices and people
The app on a small cloud server or hardware you own
A friendly private address so nobody types IP numbers
What you look after
Adding and removing devices
Keeping the private-network app installed on each device
Backups of anything irreplaceable
How people get in
Each approved device joins your private network (for example Tailscale or a VPN). Everyone else gets nothing to connect to.
Worth knowing: Every device needs the network app installed and signed in. It’s great for people you know and trust, but not for sharing with strangers.
Typical building blocks: Tailscale, WireGuard-based VPNs, a home server or small cloud instance
03Your team or organization
Behind your organization’s sign-in
Share an internal tool with your team without opening it to the internet. People sign in with the work account they already have.
For exampleAn operations dashboard, an internal admin panel or a reporting tool for staff and contractors.
Good for
Internal tools and admin panels
Staff dashboards and reports
Sharing with contractors for a limited time
What we set up
A tunnel from your app outward, so there are no open inbound ports
Access rules by email domain, group or named person
Session length and sign-in logging
What you look after
Who is in the allowed groups
Removing people when they leave
Reviewing who has signed in
How people get in
A secure tunnel (for example Cloudflare Tunnel) publishes the app, and an access policy (for example Cloudflare Access) asks for your company sign-in, such as Google Workspace or Microsoft 365, before anyone reaches it.
Worth knowing: Access is only as strong as the sign-in behind it. Use company accounts with multi-factor authentication, not shared passwords. Already on AWS? AWS Verified Access or a VPN can do the same job inside your account.
Typical building blocks: Cloudflare Tunnel, Cloudflare Access, AWS Verified Access
04Customers and your team
Public front, private back office
Customers use the public app. Your admin screens, reports and data tools stay private to your team.
For exampleA public ordering site, with the order-management and refund tools reachable only by staff.
Good for
Small businesses with a customer-facing app
Apps with powerful admin features
Teams that want fewer exposed screens
What we set up
A clear split between public and private parts
Separate access rules for each
Admin actions that can’t be reached from the public site
What you look after
Staff access lists
What moves from private to public over time
How people get in
The public part works like the first option. Admin areas sit behind your team’s sign-in or private network.
Worth knowing: This takes a little more planning up front, and it removes a whole class of “someone found the admin page” problems.
Typical building blocks: Combines the options above
Side by side
The four options at a glance.
Question
Public on the web
Private to your own devices
Behind your organization’s sign-in
Public front, private back office
Who can open it
Anyone with the link
Only approved devices
Only approved sign-ins
Public part: anyone. Admin: your team
How people get in
Visit the address
Join your private network
Sign in with a work account
Both, by area
App needed on each device
No
Yes, the network app
No, just a browser
Only for private admin, if used
Visible to the internet
Yes
No
Only the sign-in screen
Public part only
Typical fit
Products, client apps
Families, personal tools
Internal tools, staff dashboards
Small businesses
Security and compliance controls
Need tighter control? Lock it down further.
Any option above can be narrowed to meet a security policy, a client contract or a compliance requirement. Tell us what you need and we’ll set the rules to match.
IP allowlists
Only your office, VPN or partner networks can reach the app. Everyone else is turned away before the app loads.
Country and region rules
Allow or block traffic by country, for example to serve only the regions you operate in.
Rate limits and bot protection
Slow down scraping, password-guessing and sudden traffic spikes.
Password-protected previews
Share unfinished work with clients or testers before it goes public.
Stronger sign-in
Require company accounts, multi-factor authentication and shorter sessions.
Access logs
A record of who and what reached the app, for reviews, incidents and audits.
Built with tools such as AWS WAF for apps hosted on AWS, or Cloudflare’s firewall and Access rules. Location rules rely on IP addresses, which a VPN can disguise, so pair them with sign-in for anything sensitive. These controls support a compliance program; they don’t certify one.
Also possible
Run it on hardware you own
A mini PC, home server or NAS can host a private app. Pair it with a private network for your household or a secure tunnel for your team. Nothing needs to be opened on your router.
Start private, go public later
Test with family, friends or a few customers behind a private network or sign-in. When it’s ready, open it up without rebuilding.
Move what you already have
Already deployed on Vercel, Netlify, Supabase or similar? We can review that setup, tighten who can reach what, or plan a move to AWS if it fits.
Ready to leave localhost?
Tell us what you built and who it’s for.
We’ll recommend an access model, explain the trade-offs and agree a scope before any work begins.
