Does Vercel have a SOC 2 Type 2 attestation?

Yes. Vercel holds a SOC 2 Type 2 attestation for the Security, Confidentiality, and Availability Trust Services Criteria. On its own, a yes tells you little; the useful part is the report scope and the shared responsibility boundary that sits underneath it.

Here's how to read that scope, access the report, and work out what your own audit still needs to cover.

Copy link to headingWhat does a SOC 2 Type 2 attestation cover?

SOC 2 is an attestation, not a certification. A licensed CPA firm examines an organization's controls and issues a report with an independent opinion. The AICPA designs the standards but grants no certification, so any vendor claiming to be "SOC 2 certified" is using the term loosely.

The Type matters as much as the framework. The three report formats differ in what they test and who can read them:

A Type 2 report is the one enterprise procurement asks for, because it proves controls operated over time rather than existing on paper for a day.

There are five Trust Services Criteria in total. Security is required in every report, and Availability, Processing Integrity, Confidentiality, and Privacy are optional additions an organization scopes in based on the service it runs. A Type 2 report can still contain exceptions, and opinions range from unqualified through qualified, adverse, or a disclaimer, so read the report itself before relying on the badge.

Copy link to headingWhich Trust Services Criteria does Vercel's SOC 2 report cover?

With the mechanics in place, the scope is the specific answer. Vercel's SOC 2 Type 2 attestation covers the Security, Confidentiality, and Availability criteria. Processing Integrity and Privacy are out of scope, which matches what a hosting platform controls. Vercel runs the infrastructure layer, and you control your data processing logic.

The attestation sits inside a wider compliance portfolio. The frameworks below cover the standards enterprise reviewers check most often:

The Data Processing Addendum is public and confirms that third-party audits, including SOC 2 Type 2, run at least once annually.

Vercel also discloses security incidents publicly through its Security Bulletin. The April 2026 incident is documented in full, including scope and remediation, in the security bulletin.

Copy link to headingHow to access Vercel's SOC 2 attestation

Once you know the scope, the report itself lives in the Trust Center. Vercel's Trust Center hosts the reports behind a Get access flow.

Access depends on your plan and the report you need:

• SOC 2 report: Available on request for Pro and Enterprise plans.
• Penetration test report: Available on Pro and Enterprise plans.
• HIPAA report: Available on Enterprise plans.

Open the Trust Center, go to Reports, select the report, and use the Get access flow. The SOC 2 report is also available for preview and download in the Vercel dashboard’s under Team Settings > Compliance.

Copy link to headingHow Vercel platform features map to SOC 2 criteria

The attestation answers the question about Vercel. Several platform features then support the controls your own auditor tests, which is where the platform reduces your audit work. Vercel documents this mapping directly for the firewall in Supporting compliance with Vercel WAF; the rest of the table reflects how the remaining features line up with common criteria:

These features don't grant you SOC 2 status, but they give your auditor documented, testable evidence for the criteria above.

Copy link to headingHow Audit Logs give auditors an evidence trail

Audit Logs turn platform activity into the record an auditor samples. They're available on Enterprise plans to team members with the owner role, and each record captures the timestamp, action, actor ID, actor name, actor email, IP location, user agent, request ID, and the previous and next state as JSON.

The dashboard retains 90 days of events, and owners export a CSV from Team Settings > Security & Privacy > Audit Log. For continuous delivery, Audit Log Drains stream events to Amazon S3, Splunk, or a custom HTTP endpoint, which replaces the earlier Custom SIEM Log Streaming feature.

Auditors sample event names such as shared_env_variable.decrypted, project SSO protection changes, and auditlog.export.requested, which supply the logical-access and change-management evidence that CC6.x and CC8.1 sampling asks for.

Copy link to headingDoes hosting on Vercel make your product SOC 2 compliant?

No. Hosting in an attested environment doesn't transfer that attestation to your product, so your own security requirements stay in place.

In your SOC 2 audit, Vercel is a subservice organization. Under the carve-out method, the standard approach, your auditor excludes Vercel's internal controls from your scope. You still name the Complementary Subservice Organization Controls you expect Vercel to run, and you name and operate the Complementary User Entity Controls (CUECs) on your side. If a CUEC isn't operating effectively at your organization, a control failure can happen even with Vercel's attestation in place. Obtaining the SOC 2 report, reviewing it, and documenting that review is itself a tested control in your audit, typically under CC9.2.

The split follows Vercel's shared responsibility model:

• Vercel's scope: Physical security, network segmentation, employee access management, platform change management, and infrastructure patching.
• Your scope: Application access control, secrets management, code review, customer data handling, application-level encryption, and your own change management.
• Shared: Incident response, where Vercel handles infrastructure and you handle your application code and configuration.

Working through that split is what turns Vercel's attestation into fewer controls you have to build, document, and evidence alone.

Copy link to headingNext steps

To take this into your own review, request the reports and view current certificates in the Vercel Trust Center. Then confirm who owns each control by reading the shared responsibility model before you scope your audit.

Copy link to headingRelated resources

• Security and compliance measures
• Attestations and Compliance Report
• Shared responsibility model
• Supporting compliance with Vercel WAF
• Audit Logs
• Secure Compute

Copy link to headingFrequently asked questions

Copy link to headingIs Vercel SOC 2 certified or SOC 2 attested?

Attested. A licensed CPA firm examines Vercel's controls and issues an independent opinion in a SOC 2 Type 2 report. The AICPA sets the standards but issues no certification, so "SOC 2 certified" is a common but imprecise phrasing. The accurate term is a SOC 2 Type 2 attestation.

Copy link to headingWhich Trust Services Criteria does Vercel's SOC 2 report cover?

Security, Confidentiality, and Availability. Processing Integrity and Privacy are out of scope, which is consistent with a hosting and deployment platform. Vercel controls the infrastructure layer, and you control your data processing logic, so those two criteria fall to your own application audit.

Copy link to headingHow do I get Vercel's SOC 2 report?

The SOC 2 report is available on Pro and Enterprise plans, and is available for preview and download in the Vercel dashboard’s under Team Settings > Compliance. You can also visit the Trust Center, open Reports, select the SOC 2 report, and use the Get access flow.

Copy link to headingDoes using Vercel make my product SOC 2 compliant?

No. Your team passes its own audit. Vercel is a subservice organization in that audit, so you implement the Complementary User Entity Controls from the report and document an annual review of it. That review is itself a tested control, typically under CC9.2.

Copy link to headingWhich Vercel plan do I need for the compliance-relevant features?

Enterprise covers Audit Logs, Audit Log Drains, Directory Sync (SCIM), the Security role, Trusted IPs, Secure Compute, and HIPAA. SAML SSO is available on Enterprise or as a Pro add-on at $300/month. WAF protection and DDoS mitigation cover all plans, with mitigation notifications on Pro and Enterprise.