Methods, systems, and computer program products are provided that automatically scale an application between private and public cloud computing platforms, while simultaneous enforcing policies ensuring private data is persistently stored on the private cloud computing platform, but not the public cloud computing platform. A traffic manager on the public platform routes traffic to instances of a web app executing on a private platform. A traffic monitor on the private platform monitors performance criteria of the private platform, and reports traffic telemetry to the traffic manager. Based on the traffic telemetry, the traffic manager may instantiate one or more instances of the web app on the public platform to handle traffic. Private data gathered by such instantiated instance(s) is persisted to storage in the private platform, but not in the public platform.