If a client's security questionnaire lands on your desk the week your web app on Vercel is meant to go live, this is for you. It is not for you if every record you hold may legally sit in the US or the EU and the reviewer only wants platform reports: request them from Vercel and answer the app rows yourself.
Which questions do Vercel's own reports answer?
The platform questions. Vercel's compliance docs list a SOC 2 Type 2 attestation for Security, Confidentiality and Availability, ISO 27001:2022 certification, PCI DSS v4.0 attestations of compliance (one as a service provider, one as a merchant), GDPR support with a data processing agreement, EU-U.S. Data Privacy Framework certification and TISAX AL2. You request the reports through security.vercel.com.
The same docs give the answers for the encryption rows: AES-256 at rest and TLS 1.3 in transit. Vercel says it mitigates L3, L4 and L7 DDoS attacks on every plan, and does not charge for traffic its firewall blocks. Pro and Enterprise customers can ask for penetration test reports, and there is a HackerOne bug bounty.
One detail to check before you paste anything. Vercel's own pages disagree on the ISO version: the security FAQ says ISO 27001:2013, while the compliance docs say ISO 27001:2022. Quote the certificate you are sent, not a web page.
What stays your answer?
Everything about your app. Vercel's certifications are Vercel's. A reviewer who asks "is the application SOC 2 compliant" is asking about your code, your sign-in, your secrets and your data handling, and a Vercel report answers none of those.
Three rows catch teams out:
- Backups. Vercel backs up every two hours and keeps each backup for 30 days, but its docs say these backups are not available to customers. If the questionnaire asks how you restore your data, the answer is your database's backup, not Vercel's.
- Payments. For PCI scope Vercel says customers should pick a payment gateway that provides an iframe. Card data then goes to the gateway, and the gateway's attestation covers it. Do not write "PCI compliant app" on the strength of Vercel's attestation.
- Health data. Vercel supports HIPAA as a business associate and signs agreements with eligible Pro and Enterprise customers; on Pro it is a USD 350 a month add-on, as of 16 October 2026. That is a US rule. It says nothing about a UAE or Indian health data law.
Who can deploy, and what do the logs keep?
These are the rows reviewers ask next, and Vercel's docs answer most of them.
- Who shipped what. On Pro, a Git deployment only goes through when the commit author is a member of the Vercel team, and each person who deploys has a deploying seat (USD 20 a month each after the first, as of 16 October 2026). The deployment history then names a person. Audit logs and Directory Sync are Enterprise items.
- Keys and settings. Vercel encrypts environment variables at rest. A Config value stays readable to anyone with project access; a Secret value is write-only after you save it. Build logs redact a Secret only when it is 32 characters or longer, so do not count on redaction for short keys.
- How long logs last. Without Observability Plus, Vercel keeps observability data for 1 day on Pro and 3 days on Enterprise; with Plus, 30 days. The docs we read do not say where logs are stored. If a log line can carry personal data, assume it leaves the region.
Where does the data live?
Not in the Gulf. Vercel's regions page lists 19 compute regions, from Stockholm to Sydney. None is in the UAE, Saudi Arabia or anywhere else in the Middle East. The nearest is bom1, Mumbai. Vercel Functions run in iad1, Washington, D.C., unless you change the region, and the page tells you to run them in the same region as your database.
The compliance page adds the line your legal team will read twice: "Vercel may transfer data to and in the United States and anywhere else in the world where Vercel or its service providers maintain data processing operations." We found no UAE PDPL, Saudi PDPL or India DPDP statement on those pages.
So for a Gulf buyer the residency row has one honest answer: Vercel does not keep data in the UAE. The useful question is which data has to stay, and how you keep it off Vercel.
How do we split a UAE clinic's site?
The front goes on Vercel and the records stay in the UAE. Our Clinic page cites the rule: UAE Federal Law No. 2 of 2019 on ICT in health fields, Article 13, does not allow health data about care in the UAE to be stored or processed abroad without the health authority's approval. So we set up a UAE clinic's database in the UAE. That rule decides the split, not the hosting bill.
The test we apply: make a test booking with a made-up patient name, then search the Vercel project's logs, its environment variables and any error tracker or analytics script on the page for that name. If it shows up anywhere, the split leaks. The same test applies to any model or third-party service the app calls: each one is another place the record can go. Check this with your own lawyer for your licence; we set the line, we do not give the legal opinion. The same pattern fits the other businesses on our clinics page and anyone whose records have a home country.
Which plan does the questionnaire push you to?
Usually Pro with one or two add-ons, and Enterprise when the reviewer asks for audit logs or an SLA. Prices are Vercel's, as of 16 October 2026.
Pro itself is USD 20 a month for the platform fee, which includes one deploying seat and USD 20 of usage credit; usage after that is metered. So never quote a client a fixed monthly hosting price. Quote the plan, the add-ons and a usage budget, and set Vercel's spend limit to match.
What happens on the first call?
If every record you hold may legally sit in the US or the EU, and your reviewer only wants the platform reports, you do not need us: request them from Vercel and answer the app rows yourself.
If not, send the questionnaire. In the written assessment we mark each row as Vercel's, yours or a gap, with the source for each Vercel answer. We call the method Preview every change: every fix to the app or its settings runs first on a preview deployment, a copy of the site your reviewer can open, and only then goes to production, so the reviewer sees the change before your customers do. For the rest of what we build on the platform, see everything we build on Vercel. The assessment is free, and the first build week is a fixed AED/SAR 14,900, credited in full if you sign the build within 60 days. Run plans are on What you get. We are not a Vercel partner; Vercel is the product we build on.
