Conditional: Vercel offers a BAA on the Pro plan (as a paid add-on) and on Enterprise, but not on Hobby. If your web developer proposes Vercel for an app that handles PHI, the team must be on Pro with the add-on or on Enterprise, and the BAA must be signed before any PHI is deployed.
Is Vercel HIPAA compliant?
Conditional BAA available on Pro and Enterprise; the main exclusion is the Hobby plan. Last verified 2026-10-28.
Pro teams get a BAA through a paid HIPAA BAA add-on, purchased self-serve in Billing settings. Enterprise teams request it through sales. Vercel Secure Compute, an Enterprise option, adds isolation on top of the BAA.
This page states "BAA available on plan X for services Y." HIPAA compliance is not a property of a product. It depends on the signed agreement, how you configure the platform and your own policies. See the section hub, Is it HIPAA compliant? All vendors, for other vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Hobby | Not available | Listed as not available on the pricing page | Not applicable |
| Pro | Available as a paid add-on | Purchase the HIPAA BAA add-on under Settings > Billing | $350/month |
| Enterprise | Available | Request through your Customer Success Manager, Account Executive or Vercel sales | Custom |
Pro is priced from $20/user/month, and the BAA add-on is charged on top of that. A Pro team with five developers therefore pays for five seats plus the $350/month add-on. The BAA is not included in Pro by default.
Vercel says the BAA is for customers who are covered entities or business associates. A clinic's marketing contractor hosting a brochure site with no PHI does not need one. A vendor building a patient portal on Vercel does.
What the BAA covers and what it excludes
Covered
- The Vercel deployment platform, for Pro and Enterprise teams that have the BAA in place.
- Vercel Secure Compute (Enterprise), the optional additional isolation layer.
Excluded
- The Hobby plan, where a BAA is listed as not available.
The vendor's published material names no other services. Do not assume the BAA extends to a specific feature such as storage, databases or AI products. Third-party services connected to a Vercel project are also outside the BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
Vercel's documentation cites AES-256 for data at rest and HTTPS/TLS 1.3 for data in transit.
How to use Vercel with PHI
The BAA covers Vercel's side only. The rest is your responsibility:
- Sign the BAA before any PHI is deployed or stored.
- Confirm the team is on Pro with the BAA add-on, or on Enterprise.
- Keep PHI out of Hobby projects, including preview deployments and test data copied from a production patient database.
- Configure access controls and SSO so that only named staff and contractors can deploy or view project settings. Remove access when a developer leaves.
- Review audit logs on a schedule and keep a record of the review.
- Keep PHI out of third-party services that have no BAA of their own. Automation tools such as Zapier need their own agreement before they handle PHI.
- Maintain written staff policies and training for everyone who touches the application or its data.
Compliance depends on the signed BAA, configuration and policies, not on the vendor name. Use Vercel's own HIPAA guide as the implementation reference. Our HIPAA guides cover the surrounding process, and the HIPAA glossary (BAA, PHI, business associate) defines the terms used here.
Alternatives with a BAA
These are other hosting and cloud options with a BAA path. Each has its own scope and exclusions, so read its check page before relying on it.
- Amazon Web Services: conditional. BAA entry point:
- Microsoft Azure: conditional. BAA entry point:
- Firebase: conditional. BAA entry point:
- Google Cloud Platform: yes. BAA entry point:
- Heroku: conditional. Shield Private Spaces on Enterprise.
See HIPAA-compliant software development tools for the full category.
Sources
- Security & Compliance Measures — Trust center, checked 2026-10-28. "Signing Business Associate Agreements (BAAs) with eligible Pro and Enterprise customers"
- Security & Compliance Measures — Trust center, checked 2026-10-28. "Pro teams can purchase the HIPAA BAA add-on from their team's Billing settings. Enterprise teams can contact us to request a BAA or add Secure Compute to their plan."
- Vercel Pricing — Pricing page, checked 2026-10-28. "HIPAA BAA | Not available | $350 / month | Custom"
- How to build and maintain HIPAA-compliant applications on Vercel — Help article, checked 2026-10-28. "The HIPAA BAA is available to Enterprise and Pro customers who are covered entities or business associates under HIPAA."
- Security & Compliance Measures — Trust center, checked 2026-10-28. "Vercel encrypts data at rest (when on disk) with 256 bit Advanced Encryption Standard (AES-256). While data is in transit (on route between source and destination), Vercel uses HTTPS/TLS 1.3."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-28. Other vendors are listed under Recent changes in vendor HIPAA status.
FAQ
Is Vercel HIPAA compliant?
Conditional. A BAA is available on the Pro plan (paid add-on) and on Enterprise, not on Hobby. A signed BAA, correct configuration and your own policies determine whether your use is compliant. Using Vercel does not make an app or organization compliant by itself.
Does Vercel sign a BAA, and on which plans?
Yes, for eligible Pro and Enterprise customers who are covered entities or business associates. On Pro you purchase the HIPAA BAA add-on under Settings > Billing. On Enterprise you request it through your Customer Success Manager, Account Executive or sales.
Can I put PHI on the Vercel Hobby plan?
No. A BAA is listed as not available on Hobby, so PHI should not be stored or deployed there.
How much does the Vercel HIPAA BAA cost?
On Pro it is a $350/month add-on, on top of the per-seat price that starts at $20/user/month. On Enterprise the cost is custom.