0 Concern2 Mixed2 Positive
B72 / 100
In Plain English
Vercel collects your account data, professional info, and — critically for developers — your source code and deployment content to run the platform. They don't run an ad business and explicitly prohibit staff from viewing your code except to fix support issues. The main caveats are AI product data collection, third-party marketing partners, and a California-specific admission that they may 'share' data for cross-contextual advertising for their own marketing.
Category Breakdown
Known data breaches
No known public data breaches
Vercel Inc. does not appear in the Have I Been Pwned database of publicly disclosed data breaches.
How Vercel Inc. could earn a higher grade
Recommended changes
- Publish a specific retention period for build logs and deployment metadata — current language covers runtime data well but is less specific on CI/CD artefacts.
- Provide a machine-readable subprocessor list that is versioned and includes change history, so customers can track additions over time.
- Offer a data residency option (EU or US) for all tiers, not only Enterprise — this is increasingly important for GDPR compliance for smaller teams.
Compare with
Embed this grade
Display Vercel Inc.'s privacy grade on your own site. The badge links back to this analysis page.
<iframe src="https://privacy-decoded.com/badge/vercel" width="240" height="72" frameborder="0" scrolling="no" title="Vercel Inc. Privacy Grade — Privacy Decoded" ></iframe>