Skip to content

Vercel

The host behind Deploy a website. When you deploy, your site's files and any data it handles sit on Vercel's servers (US by default). For a static page or a small demo, this is almost always fine for this — the one thing worth a look is the AI-training setting, which a recent change turned on by default for free accounts.

Last verified: 2026-06-07 · Confidence: high on training tiers + opt-out; high on storage/certs.

Does it train AI on what you upload?

Vercel's training rules changed on 2026-03-31, and the default depends on your plan: [confirmed]

  • Free (Hobby) and trial Pro — on by default. Your code, build logs, and agent chats can be used for AI-model training and shared with AI partners, unless you opt out. [confirmed]
  • Paid Pro — off by default. Training only happens if you opt in. [confirmed]
  • Enterprise — off, and contractually so. Vercel "represents and warrants that it will not use v0 Customer Content to train its or its third-party AI providers' models." [confirmed]

Two things soften this for the free tier: it covers code and telemetry, not visitors using your live site, and Vercel says "all personal information, account details, environment variables, API keys, and other sensitive content is anonymized and redacted before use or sharing." [confirmed]

The setting to stop it (free/Pro): dashboard → Team Settings (top-left, not Account Settings) → Data Preferences → turn training off. One toggle, takes under a minute. [confirmed]

How long they keep it, and can you delete it

  • Delete your account from the dashboard and Vercel deletes or anonymizes data once there's no "ongoing legitimate business need." [confirmed]
  • Backups are kept 30 days then dropped; deleting a project's database auto-deletes its backups. Those backups are internal-only — not visible to you. [confirmed]
  • One honest caveat: anything already used for training before you opted out can't be pulled back out of a model — opting out only stops future use. [confirmed]

What enterprise adds

A signed Data Processing Addendum, the no-training warranty above, isolated build infrastructure separate from free/Pro accounts, and on request a BAA (for health data) plus Secure Compute (private, isolated environment). The DPA itself is published and applies to all customers, not just Enterprise. [confirmed]

Where your data lives (matters under GDPR)

  • Default is the US. Functions run in the US unless you pick a region; you can set an EU region to keep execution in Europe. [confirmed]
  • Even so, some data (IP addresses for DDoS protection, internal backups) still routes through the US — Vercel doesn't store data permanently inside EU regions. [confirmed] (Vercel docs note EU caching is ephemeral; permanent EU-only residency isn't offered — checked 2026-06)
  • For EU/UK transfers Vercel relies on Standard Contractual Clauses + the UK Addendum and is certified under the EU-U.S. Data Privacy Framework. It holds SOC 2 Type 2 and ISO 27001:2022. [confirmed]

The short version: fine for a public site or demo. If you're putting regulated EU personal data behind it, set an EU function region, sign the DPA, and read the Privacy Notice first.

Sources