Vercel: DPA, subprocessors and data location
Where to find the Vercel DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: application hosting and deployment. The table is the short version; the sections below add detail.
Vercel at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | Not stated in the source we checked (2026-10-17). Details on subprocessors |
| Objection window and remedy | Window: 5 days Details on objecting |
| Data regions |
|
| Transfer mechanism |
|
| Vendor role | Both: processor for some data, controller for other data. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Vercel
Vercel's DPA applies to customers on Enterprise and Pro plans (section 1). The same section also describes it as part of the Enterprise Terms.
Email notice of a new subprocessor reaches you only if you subscribe by emailing privacy@vercel.com (section 7). The DPA states no advance-notice period in days. The objection window is 5 calendar days, and the only remedy is terminating the Agreement, with no refund and committed fees still owed.
Section 13 states that primary processing facilities are in the United States and names no regions.
Vercel DPA: where to find it and how it is accepted
Read the DPA on vercel.com. Binding when you enter the Agreement or sign the Addendum; both sides are deemed to have signed the SCCs by entering the Agreement (sections 1 and Schedule 3).
Source: vercel.com, checked 2026-10-16Plans covered: Enterprise and Pro plans
Section 1: the addendum applies to Vercel's processing "for Customers who are on Enterprise and Pro plans". The same section also describes it as forming part of the Enterprise Terms.
Source: vercel.com, checked 2026-10-16Vercel subprocessors: the list and how change notices reach you
Source: security.vercel.com, checked 2026-10-17How changes are announced: Update to the list at security.vercel.com; subscribe by emailing privacy@vercel.com or by another method Vercel communicates (section 7).
Source: vercel.com, checked 2026-10-17Not stated in the source we checked (2026-10-17).
Section 7: "Customer must email privacy@vercel.com, or other method as communicated by Vercel to Customer in the future, to subscribe to notice of new Subprocessors". Vercel "will notify Customer by updating the list of Subprocessors and, if Customer has subscribed ..." (the sentence is incomplete in the DPA text). The DPA states no advance-notice period in days.
Source: vercel.com, checked 2026-10-17You can object within 5 days. The parties discuss in good faith. If they cannot agree, your sole and exclusive remedy is to terminate the Agreement for convenience, with no refunds and any committed fees still payable (section 7).
Section 7: you must object in writing "within five (5) calendar days after such notice", based on reasonable data protection concerns. Calendar days, not business days.
Source: vercel.com, checked 2026-10-17Source: vercel.com, checked 2026-10-17Where Vercel stores data
- United States (primary processing facilities)
Section 13: "as of the Effective Date, Vercel's primary processing facilities are in the United States", and Vercel may process data anywhere it or its subprocessors operate. Schedule 2 names AWS, Azure and GCP but no regions. The DPA offers no region choice.
Source: vercel.com, checked 2026-10-17How Vercel moves data outside the EU and UK
- SCCs (Modules 1, 2 and 3)
- UK Addendum
- Swiss terms via the SCCs
Section 13 and Schedules 3 to 5. Schedule 5 is titled "UK IDTA" but contains the ICO's international data transfer addendum. The DPA does not mention the EU-U.S. Data Privacy Framework.
Source: vercel.com, checked 2026-10-16EU-U.S. Data Privacy Framework list: listed.
Listed on the Data Privacy Framework participant list as "Vercel Inc.": EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active. Vercel's own DPA does not mention the DPF and relies on the SCCs, so the listing is not a DPA commitment. Read from the list's own participant data on 2026-10-17.
Source: www.dataprivacyframework.gov, checked 2026-10-17Is Vercel a processor or a controller?
Both: processor for some data, controller for other data.
Section 4: Vercel is a processor for Customer Data and the controller for Service-Generated Data and Contact Data.
Source: vercel.com, checked 2026-10-16Is Vercel GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Vercel's own documents say:
- A DPA is published: Binding when you enter the Agreement or sign the Addendum; both sides are deemed to have signed the SCCs by entering the Agreement (sections 1 and Schedule 3).
- A subprocessor list is published.
- Transfer mechanisms named: SCCs (Modules 1, 2 and 3), UK Addendum, Swiss terms via the SCCs.
- Data locations named: United States (primary processing facilities).
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Vercel to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Vercel, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Vercel | Application hosting and deployment | United States (primary processing facilities) | SCCs (Modules 1, 2 and 3); UK Addendum; Swiss terms via the SCCs | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Vercel | Application hosting and deployment | United States (primary processing facilities) | SCCs (Modules 1, 2 and 3); UK Addendum; Swiss terms via the SCCs | [DPA](https://vercel.com/legal/dpa) | [Subprocessors](https://security.vercel.com) |
If you add or replace Vercel: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
In the source we checked, Vercel doesn't state a notice period in days, so you may learn of a change later than your own notice period requires; plan for that.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- Re-checked section 7 (subprocessing) and section 13 against the raw DPA text; notice, 5 calendar days, remedy and US primary processing confirmed. The DPA gives the list address as https://security.vercel.com (no /subprocessors path), so the recorded link now matches it. The Trust Center answers scripted requests with a Cloudflare challenge, so the list itself, its count and the subscribe flow beyond the DPA text could not be read automatically.
- Checked the Data Privacy Framework list: "Vercel Inc." is listed (EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active). dpf_listed set to true.
- First check: facts recorded from Vercel's own DPA (last updated March 17, 2026, effective March 31, 2026) and Trust Center.
Related vendors
Sources and method
- https://vercel.com/legal/dpa checked 2026-10-16
- https://security.vercel.com/ checked 2026-10-17
- https://www.dataprivacyframework.gov/participant/6847 checked 2026-10-17
Facts come from Vercel's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: vercel.com.