Snapshot 244286
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Node.js, PHP, and eMudhra Security Advisories Trust Center Start your security review Overview Welcome to Vercel's Trust Center. Here you can find information about our security and compliance program and request access to security documentation. Vercel’s platform provides the tools and self-driving infrastructure to build, scale, and secure intelligent applications. As the most popular DX platform for frontend development and the team behind v0, Next.js, and AI SDK, we help customers like OpenAI, PayPal, Ramp, and Supreme build for the AI-native web – and ship at the speed of ideas. To experience the future of AI application development, visit vercel.com. Compliance SOC 2 ISO/IEC 27001 PCI DSS HIPAA HITECH GDPR CCPA CPRA EU-US DPF Swiss-US DPF UK Extension to EU-US DPF PIPEDA DSA NIS2 DORA nFADP SOC 3 TISAX Vercel is reviewed and trusted by OpenAI Under Armour HashiCorp Adobe The Washington Post Okta Documents REPORTSHIPAA Report REPORTSNetwork Diagram REPORTSOther Reports and Documents REPORTSPCI DSS REPORTSSecurity Whitepaper REPORTSSOC 2 Report REPORTSSOC 3 Report COMPLIANCEHIPAA COMPLIANCEISO/IEC 27001 COMPLIANCEPCI DSS COMPLIANCESOC 2 COMPLIANCESOC 3 Reports Architecture Diagram HIPAA Report Network Diagram View more Legal Subprocessors Data Processing Agreement Data Subject Requests View more Risk Profile Impact LevelSubstantial Critical DependenceYes Third Party DependenceYes View more Product Security Audit Logging Data Security Integrations View more Data Security Access Monitoring Data Backups Data Erasure View more App Security Responsible Disclosure Application Penetration Testing Bot Detection View more AI AI Training Data and Bias AI Security AI Monitoring View more ESG Anti-Modern Slavery Health & Safety Standards Supplier Code of Conduct Data Privacy Cookies Data Breach Notifications Data Privacy Officer View more Access Control Data Access Internal Single-Sign-On (SSO) Least Privilege View more Infrastructure Status Monitoring Amazon Web Services Anti-DDoS View more Endpoint Security Anti-Malware Disk Encryption Mobile Device Management Network Security Firewall Spoofing Protection Virtual Private Cloud View more Corporate Security Asset Management Practices Email Protection Employee Training View more Policies Acceptable Use Policy Access Control Policy Anti-Malicious Software Policy View more Security Grades SecurityScorecard Vercel HSTS Preload List Vercel.com Qualys SSL Labs vercel.com A+ vercel.app View more Incident Response Incident Reporting Process Risk Management Risk Assessments Supply Chain Risk Management Third-Party Dependence Asset Management Asset Inventories (Hardware/Software) Asset Tracking Automated Asset Detection View more Business Continuity Plan (BCP) Business Continuity Plan (BCP) Data Backup/Backup Protection Disaster Recovery Plan (DRP) View more Change Management Change Management Program Continuous Monitoring Automated Alert Response Automated Compliance Monitoring Event & Audit Log Management View more Subprocessors Trust Center Updates Node.js, PHP, and eMudhra Security Advisories Vulnerabilities In October 2026, Vercel published three advisories affecting runtimes and certificates: a compromised eMudhra certificate authority (October 17), a Node.js Brotli vulnerability (October 21), and the php2shell PHP vulnerabilities (October 21). Where needed, Vercel has applied protections to the platform. What to do: Projects on Vercel: Redeploy to get the patched Node.js and Vercel's added protections. Projects on Node.js 20.x must switch to 22.x or 24.x and redeploy. PHP, anywhere: Upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Your own runtimes and servers: Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. Update certificate bundles, such as certifi 2026.10.19 or later, and rebuild on updated container base images. Full details: eMudhra security advisory Node.js security advisory php2shell security bulletin ISO 27001 Certification Compliance Vercel completed its recertification audit for ISO 27001:2022. Our updated ISO 27001 certificate is now available. Vercel completed its second surveillance audit for ISO 27001:2022. Our updated ISO 27001 certificate is now available. Vercel is pleased to announce that we recently migrated to the ISO 27001:2022 framework! Our updated ISO 27001 certificate is available for download. Vercel is pleased to announce that we recently completed our ISO 27001:2013 certification! Our ISO 27001 certificate is available for download. For more information, see our blog post at https://vercel.com/blog/vercel-iso-27001-security. We also updated our Policies and 2023 SOC 2 Type 2 Report for download. SOC 2 Type 2 Report Compliance Vercel's 2026 SOC 2 Type 2 report is now available for download. This audit was completed by Schellman and covers our audit period July 1, 2025 to June 30, 2026. Our updated policies and pen tests are also available for download. Vercel's 2025 SOC 2 Type 2 report is now available for download. This audit was completed by Schellman and covers our audit period July 1, 2024 to June 30, 2025. Our updated security and compliance policies are also available. Vercel's 2024 SOC 2 Type 2 report is now available for download. This audit was completed by Schellman and covers our audit period July 1, 2023 to June 30, 2024. We also added our updated policies. Vercel's SOC 2 Type 2 report is now available for download. This audit was completed by Schellman and Company LLC and covers our audit period July 1, 2022 to June 30, 2023. HIPAA Compliance Compliance We completed our annual audit to support compliance with the the HIPAA Security Rule and HITECH Breach Notification Requirements as a Business Associate. Our HIPAA report is available for download. We completed our annual audit to support compliance with the the HIPAA Security Rule and HITECH Breach Notification Requirements as a Business Associate. Our HIPAA report is available for download. We’re pleased to announce that we recently completed an independent third-party report to ensure that we support compliance with the HIPAA Security Rule and HITECH Breach Notification Requirements as a Business Associate. Our HIPAA report is available for download. For more information, see our blog post at https://vercel.com/blog/vercel-supports-hipaa-compliance. Subprocessor Update Subprocessors We have updated our subprocessor list, as it pertains to services utilized for our AI products. Additional Subprocessors The following subprocessors are being engaged to support our Vercel products and have been added to the subprocessor list: SpaceXAI LLC (fka xAI) to provide Generative AI services Updated Descriptions for Existing Subprocessors The following subprocessors are already in use, and have updated descriptions to reflect their role in supporting both the Vercel platform and products: Baseten Labs Inc to provide Generative AI services and AI model inference services Cerebras Systems Inc to provide Generative AI services and AI model inference services Fireworks AI to provide Generative AI services and AI model inference services Groq LLC to provide Generative AI services and AI model inference services To review our complete subprocessor list, visit our Trust Center. If you have any questions or require further information, please do not hesitate to contact us at privacy@vercel.com. We have updated our subprocessor list, as it pertains to services utilized for our AI products. Additional Subprocessors The following subprocessors are being engaged to support our v0 product and have been added to the subprocessor list: Cerebras Systems Inc. to provide model inference services. Baseten Labs Inc. to provide model inference services. Invisible Tools Inc. (dba Raindrop.ai) to provide AI monitoring and analytics services. To review our complete subprocessor list, visit our Trust Center. If you have any questions or require further information, please do not hesitate to contact us at privacy@vercel.com. We have updated our subprocessor list, as it pertains to services utilized for our AI products. Additional Subprocessor The following subprocessor is currently engaged to support our v0 product and has been added to the subprocessor list: Groq, Inc. to provide AI services. To review our complete subprocessor list, visit our Trust Center. If you have any questions or require further information, please do not hesitate to contact us at privacy@vercel.com. If you need help using this Trust Center, please contact us. Contact support If you think you may have discovered a vulnerability, please send us a note. Report issue