Vercel
hosting-paas · vercel.com · last checked 2026-09-19
Identity
| Legal entity | — |
|---|---|
| HQ | US |
| Ultimate ownership | US |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | direct |
| Source | security.vercel.com · 2026-09-17 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| eu | Not stated | — | vercel.com | 2026-09-18 |
eu: No data-residency commitment found. The only regional documentation is the global network page, which describes 20 compute-capable regions for running code and caching content - where compute runs, not a commitment about where customer data is stored. Vercel's trust centre, which might say more, is gated.
Subprocessor chain
No subprocessor list transcribed. Either the vendor does not publish one where we could reach it, or it is gated — see the documents table below for which.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| DORA | claimed | Listed under Compliance on the Vercel trust centre | security.vercel.com | 2026-09-17 |
| GDPR | claimed | Listed under Compliance on the Vercel trust centre | security.vercel.com | 2026-09-17 |
| HIPAA | claimed | Listed under Compliance on the Vercel trust centre | security.vercel.com | 2026-09-17 |
| ISO27001 | claimed | Listed under Compliance on the Vercel trust centre | security.vercel.com | 2026-09-17 |
| NIS2 | claimed | Listed under Compliance on the Vercel trust centre | security.vercel.com | 2026-09-17 |
| PCIDSS | claimed | Listed under Compliance on the Vercel trust centre | security.vercel.com | 2026-09-17 |
| SOC2 | claimed | Listed under Compliance on the Vercel trust centre | security.vercel.com | 2026-09-17 |
| SOC3 | claimed | Listed under Compliance on the Vercel trust centre | security.vercel.com | 2026-09-17 |
| TISAX | claimed | Listed under Compliance on the Vercel trust centre | security.vercel.com | 2026-09-17 |
Claimed means the vendor asserts the certification on its own page and we have not seen the certificate. That is a distinction an auditor makes, so we make it too.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Vercel (SaaS) | — | Service only | unknown | vercel.com | 2026-09-18 |
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| trust-center | Gated | partial | 200 | 2026-09-17 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-09-19 | Note rewritten | we read a better page | vercel.com |