Vercel Inc.

United States · owned by Independent (United States) · vercel.com · 59 vendors

Vercel provides the developer tools and cloud infrastructure to build, scale, and secure a faster, more personalized web. The company offers a Frontend Cloud platform that enables developers to deploy web applications with AI capabilities, serverless computing, and global content delivery.

Resilience scores

Disruption prediction

Vercel Inc. has a 59% probability of disruption in the next 6 months.

All systems operational (last checked 2026-09-18 14:55 UTC)

25 of Vercel Inc.'s 59 vendors monitored for disruptions.

Technology vendors

Services catalogue

19 services in catalogue across 6 categories; runs on 59 sub-vendors.

Insights

Last updated 2026-07-12 · revision 57

59 direct vendors, 374 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Vercel exhibits very high migration readiness due to its inherently cloud-native, containerized, and microservices-oriented architecture. The internal tech stack, featuring Kubernetes, Docker, Serverless Functions, Edge Computing, and Infrastructure as Code (Terraform), means that Vercel's applications and infrastructure are designed for portability and agility across different environments. The company's existing multi-cloud strategy, utilizing both AWS and GCP, demonstrates a proactive approach to avoiding single-vendor lock-in at the infrastructure level and provides experience in managing diverse cloud environments. Extensive use of open-source technologies like Next.js, Turborepo, and the eve framework further reduces reliance on proprietary solutions, making components highly transferable. Financially, Vercel's strong and consistent revenue growth (US$200M+ ARR in 2024) ensures ample resources to fund complex migration initiatives. From a regulatory perspective, Vercel's comprehensive compliance with GDPR, HIPAA, SOC 2, ISO 27001, PCI DSS, and the Data Privacy Framework means that established processes and documentation are in place to manage data security, privacy, and international data transfer requirements during any migration. Their flexible approach to data residency, with a global edge network and DPF compliance, indicates an ability to adapt to varying data location requirements. The primary weaknesses impacting migration readiness are the 'Unknown' vendor lock-in risk and the contradictory vendor data ('Total Vendors: 0' versus detailed 'Vendor HQ Countries' and 'Vendor Geographic Diversity'). While the listed geographic diversity across 11 countries suggests a potentially low vendor lock-in, the explicit 'Unknown' status and the data anomaly prevent a definitive assessment. However, given Vercel's architectural choices and strategic use of open-source and multi-cloud technologies, the overall risk of significant vendor lock-in hindering migration is likely low. The company's modern development practices and robust operational framework position it exceptionally well for any future migration efforts.

Compliance

14 in-scope frameworks identified; showing 3.

HIPAA (source) — Compliant

Vercel is not a healthcare provider, health plan, or healthcare clearinghouse (Covered Entity), but it can act as a Business Associate when customers use its platform to process Protected Health Information (PHI). Vercel's Trust Center explicitly lists HIPAA as a covered compliance framework and provides a HIPAA Report available for download. Vercel also lists HITECH compliance. Risk is Low because: (1) Vercel has proactively addressed HIPAA compliance with documented controls and a published HIPAA Report; (2) HIPAA applicability is customer-driven — Vercel's role as a Business Associate is contingent on customers choosing to process PHI on the platform; (3) Vercel's enterprise tier and BAA availability (implied by HIPAA listing) provides the contractual framework required; (4) the security controls documented (SOC 2, ISO 27001, encryption, access controls) align with HIPAA Security Rule requirements. The primary residual risk is ensuring customers who process PHI execute appropriate Business Associate Agreements.

Evidence: https://security.vercel.com, https://security.vercel.com/?itemUid=aec41c33-0f3a-4030-ac59-49adfd4a975b&source=click, https://security.vercel.com/?itemUid=c41ff7d5-98e7-4d79-9594-fd8ef93a2838&source=click

nFADP — Compliant

The revised Swiss Federal Act on Data Protection (nFADP/revDSG) came into force on September 1, 2023, and applies to Vercel's processing of personal data of Swiss residents. Vercel's Trust Center explicitly lists nFADP as a covered compliance framework and is certified under the Swiss-US Data Privacy Framework. Risk is Low because: (1) Vercel has documented nFADP compliance in its Trust Center; (2) the Swiss-US DPF certification provides a lawful basis for data transfers from Switzerland to the US; (3) Vercel's GDPR compliance program substantially addresses nFADP requirements, as the revised Swiss law aligns closely with GDPR principles; (4) Swiss DPA enforcement is generally proportionate and Vercel's documented compliance program is robust.

Evidence: https://security.vercel.com, https://vercel.com/legal/privacy-policy

DSA — Assessment Required

The EU Digital Services Act (DSA) applies to intermediary services operating in the EU, including hosting services and online platforms. Vercel provides hosting and cloud infrastructure services to EU-based customers and end users, potentially qualifying as a 'hosting service' under DSA Art. 2(f). Risk is Medium because: (1) Vercel's Trust Center explicitly lists DSA as a covered compliance framework, indicating active compliance monitoring; (2) as a hosting service provider, Vercel has obligations under DSA including notice-and-action mechanisms, transparency reporting, and cooperation with authorities; (3) the specific tier of DSA obligations (hosting service vs. online platform vs. very large online platform) depends on user numbers and service classification, which is not publicly confirmed; (4) DSA enforcement began in February 2024 for all in-scope services, making this an active regulatory requirement.

Evidence: https://security.vercel.com, https://vercel.com/legal/terms, https://vercel.com/legal/acceptable-use-policy

Financials

Three-year financials

Financial Resilience Score: 7/10

Vercel is a well-funded, high-growth private technology company with strong developer mindshare through its stewardship of the open-source Next.js framework and an expanding AI product suite (v0, AI Gateway, AI SDK). The company has raised approximately US$800M+ in total capital, including a ~US$250M Series F in May 2025 at a ~US$9.3B valuation, providing substantial liquidity runway. ARR has grown rapidly from ~US$100M in 2023 to a reported ~US$200M+ in 2025, backed by blue-chip enterprise customers such as Notion, Stripe, Adobe, and Nike. However, financial transparency is limited. Vercel does not file with the SEC and does not disclose operating income, net income, or shareholders' equity. The company is widely assumed to be operating at a loss given heavy R&D and infrastructure investment. Cost of goods sold is highly dependent on AWS, exposing margins to hyperscaler pricing dynamics, and competition from Cloudflare, Netlify, AWS Amplify, and hyperscaler AI platforms is intense. Overall resilience is supported by strong cash reserves and tier-1 investors, but tempered by unproven profitability and lack of audited disclosures.

Key strengths: ~US$800M+ total capital raised, including ~US$250M Series F in May 2025, ~US$9.3B valuation (May 2025), ~3x jump in 12 months, Rapid ARR growth (~2x per year 2021-2024), Strong open-source moat via Next.js framework, Blue-chip customer base (Notion, Stripe, Adobe, Nike, Washington Post), Blue-chip investor syndicate (Accel, GIC, Khosla, Tiger Global, GV, Salesforce Ventures), Strategic positioning in AI infrastructure (v0, AI Gateway, AI SDK, Eve)

Risk factors: No public disclosure of operating income, net income, or equity, Heavy dependency on AWS for underlying infrastructure and margin exposure, Intense competition from Cloudflare, Netlify, AWS Amplify, and hyperscalers, Concentration risk tied to Next.js ecosystem trajectory, Unproven profitability; likely operating at a loss, Historical reputational issues with surprise bandwidth billing, No audited financial statements available to counterparties

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report