Two new layers of protection for Vercel deployments
Vercel is expanding its security portfolio with two Enterprise-focused offerings: Vercel Secure Compute and the Vercel Firewall. Both are designed to close gaps between application code and the backend infrastructure it depends on, without asking developers to leave the Vercel workflow.
Private networking for functions and builds
Every Vercel project already gets free, always-on SSL to encrypt data in transit and at rest by default. For customers with stricter compliance requirements, though, that may not be enough—especially when Serverless Functions need to talk to backend cloud infrastructure.
Vercel Secure Compute addresses that by placing deployments and builds in a private network with dedicated IP addresses, logically separated from other networks. That allows connections between Serverless Functions, deployment builds, and backend infrastructure to be restricted to authorized sources only.
Vercel notes that teams requiring VPC peering or VPN connections should contact its sales team directly.
Firewall: DDoS mitigation and IP control
Distributed denial-of-service attacks remain one of the most disruptive threats to web applications, causing downtime and eroding user trust. The Vercel Firewall adds automated DDoS mitigation to defend frontend cloud deployments against large-scale attacks, helping keep applications available and responsive under pressure.
Alongside that automated protection, the Firewall now supports custom rules for IP blocking. Enterprise users can restrict access to their applications or websites based on the IP addresses of incoming requests, blocking malicious actors from viewing content or generating unwanted traffic. Combining the two capabilities gives organizations a stronger security posture while maintaining control over who can reach their applications.
Auth and observability round out the picture
Access control also depends on authentication and authorization. Vercel points to integration with developer-first tooling such as Auth.js, Clerk, and Auth0 to manage identity with minimal code.
"As a team and as a business we need to keep evolving with our customers and the threat landscape to ensure we are at the forefront of identity and security for our customers."
Jameeka Green Aaron, Chief Information Security Officer at Auth0
Security also requires ongoing visibility, not just one-time configuration. Vercel Monitoring and Logs provide insight into application behavior, performance, and security. Teams can use them to identify and diagnose issues, and to spot bandwidth spikes or performance degradation across Serverless Functions, API endpoints, or static assets—supporting data-driven decisions about how the application runs.
