Vercel · Security
A bank, a hospital group or a master developer wants to know who can see the data, how it is encrypted and where it lives. Vercel blocks attack traffic on every plan and publishes its own audit reports. We set up the sign-in, roles and protection on your team, then write down plainly what Vercel covers and what your app still has to cover.
Salesforce consulting partner since 2010 · MVP Hall of Fame · 200+ agents in production · UAE, India and US desks
The problem
What Platform Security is
Facts from Vercel’s own pages, checked on 16 October 2026. The sources are at the end of this page.
How it works
Five layers. The first runs on its own. The rest we set up on your team, then write down for the reviewer.
Infographic
Step by step
Filter
Attack traffic is filtered first
DDoS mitigation and the platform firewall run on every request, on every plan.
Rules
Custom rules, bot rulesets and BotID on the routes that matter.
Lock
Previews stay behind sign-in
Test builds need a Vercel sign-in, a password or a trusted IP before anyone sees them.
People
Your team signs in with roles
Each person gets their own access. SSO on Pro, audit logs and SCIM on Enterprise.
Evidence
Reports ready for the review
SOC 2, ISO, PCI AOC and pen test reports, requested through security.vercel.com.
How it fits together
Traffic passes Vercel’s firewall before it reaches your app. Your app talks to Salesforce and your database. Your team signs in with roles to change any of it. Vercel’s reports cover the platform. Your app, your Salesforce org and your forms need their own checks.
Infographic
Use cases · worked examples
How Platform Security fits into the work of the industries we serve, one step at a time.
Example 1 · Financial services, Mumbai · Infographic
Today: Our partner bank sent a vendor security questionnaire about the new client portal. It is due in two weeks, and half the questions are about hosting.
After: Every hosting question gets an answer that points to a Vercel report or a setting on the firm’s team. The shared duties are written down, so the bank sees what Vercel covers and what the firm covers.
Worked example, step by step
The bank gets evidence, not promises, and the firm never claims a certificate that belongs to Vercel.
Example 2 · Clinics, Houston · Infographic
Today: We want online patient intake. Our compliance lead will not sign off until every vendor that touches patient data has signed a BAA.
After: The clinic’s Pro team adds Vercel’s HIPAA BAA. We check the intake form, logs and error reports so patient details only go where the clinic expects.
Worked example, step by step
The BAA covers Vercel’s side. The clinic’s own controls cover the app, and both are on paper.
Example 3 · Real estate, Dubai · Infographic
Today: The master developer will only share unit inventory once we show who can see buyer data and where it is stored.
After: Each person on the brokerage team gets a role. Every preview sits behind sign-in. The data location answer is written down, with buyer records kept in Salesforce.
Worked example, step by step
The developer gets straight answers, including the one about data location, before any inventory is shared.
Is it for you
Good fit
Not for you yet
What Mindcat does
The assessment is free: a short read of the org and a written note. If you go ahead, the first build week is a fixed AED/SAR 14,900 (about USD 4,050), credited in full when you sign the build within 60 days. After go-live, we keep it patched, watched and changing every month.
FAQ
Sources
Checked against Vercel’s own pages on 16 October 2026. Vercel changes fast, so we check again before any plan we write for you.
Vercel is a product of Vercel Inc. Mindcat builds and runs work on it for clients; we are not affiliated with or endorsed by Vercel.
Start here
One or two lines is enough. You hear back within 24 hours from the person who signs the work.
