Overview
Vercel runs a cloud platform for software teams to build, deploy and operate web applications and AI agents without managing their own servers. Its tools connect code repositories to automated builds and give teams separate environments for testing changes before publishing them. The platform combines application hosting, global content delivery and security controls, while its AI Gateway connects applications to models from several providers. Developers start on a free plan, and professional teams pay subscriptions, metered infrastructure charges or negotiated enterprise contracts. Vercel was founded in 2015 and is headquartered in San Francisco, California, United States.
Work here?Claim your company
About Vercel
Industries
Company Size
501-1,000
Company Stage
Series F
Total Funding
$863M
Headquarters
San Francisco, CA
Founded
2015
Get referred to Vercel
See people who can refer or advise you
Simplify's take
What believers are saying
- Developer reach is broadening: Vercel reported nearly 280 million skills.sh installs in September 2026.
- Enterprise purchasing gets easier: Vercel's AI Gateway sells through AWS Marketplace using customers' existing cloud commitments.
- AI engineers build across layers: Vercel's Gateway role spans provider integrations, distributed systems, and open-source contributions.
What critics are saying
- Customer trust faces repair: Vercel's April 2026 breach exposed variables not marked sensitive for a limited customer subset.
- Framework adoption does not ensure hosting revenue: Next.js's MIT license permits free use, distribution, and competing deployments.
- Nearby CDN engineers face commutes: Vercel requires Monday, Tuesday, and Friday office days for this role.
What makes Vercel unique
- Framework authors also run the hosting: Vercel builds Next.js and optimizes deployment infrastructure around its features.
- Waiting costs less: Vercel's Fluid Compute shares instances across requests and bills active CPU instead of idle time.
- Model outages have a fallback: Vercel's AI Gateway automatically routes the same model to another provider.
Help us improve and share your feedback! Did you find this helpful?
Funding
Total Funding
$863M
Above
Industry Average
Funded Over
6 Rounds
Benefits
- Health Insurance
- Stock Options
- Company Equity
- Professional Development Budget
- Unlimited Paid Time Off
- Remote Work Options
- Home Office Stipend
Growth & Insights and Company News
6 month growth
2%1 year growth
2%2 year growth
2%Why benchmarks like BioBasicsBench reveal the hidden gaps in ai-driven lab automation. **Standfirst** - OpenAI's new BioBasicsBench shows that current AI agents still stumble on routine wet-lab tasks, a warning for clinics that plan to automate data-intensive workflows. The day's other stories reinforce the same theme: speed, retrieval, and safety are not enough without proven functional reliability. Standfirst - OpenAI's new BioBasicsBench shows that current AI agents still stumble on routine wet-lab tasks, a warning for clinics that plan to automate data-intensive workflows. The day's other stories reinforce the same theme: speed, retrieval, and safety are not enough without proven functional reliability. Lead story - OpenAI's BioBasicsBench exposes the limits of today's lab-assistant agents. OpenAI released BioBasicsBench, a 100-task benchmark that asks agents to interpret raw experimental data, select reagents, and troubleshoot common protocols OpenAI. The tasks are deliberately low-level - reading a plate-reader output, calculating a dilution factor, or flagging an out-lier in a PCR curve - because these are the steps that clinics and diagnostic labs automate most aggressively. The benchmark matters because it moves the conversation from "can an LLM generate a plausible answer?" to "can it reliably act on real, noisy lab data without human correction." In the first round of testing, top-performing agents missed or mis-interpreted roughly 30 % of the tasks, often due to a mismatch between the format of the raw file and the model's expectations. That failure rate is far higher than the sub-5 % error tolerances required for clinical decision support or regulated diagnostic pipelines. For businesses, the practical implication is clear: benchmarks that surface end-to-end workflow errors should be a prerequisite before deploying AI assistants in any patient-facing or lab-automation context. Instead of trusting a model because it scores well on generic language-understanding tests, clinics should run a domain-specific suite like BioBasicsBench on their own data streams. The results can inform whether a model needs additional preprocessing, fine-tuning, or a human-in-the-loop safeguard before it touches patient samples. Speed alone won't fix the problem - DeepSeek's ultrafast model still needs validation. Vercel announced that DeepSeek V4.1 Flash 1017 Ultrafast is now available through its AI Gateway, capable of generating over 1,000 tokens per second Vercel AI. While the throughput is attractive for real-time chat or voice triage in busy clinics, the release does not address the accuracy gaps highlighted by BioBasicsBench. High token rates can amplify mistakes if the underlying reasoning is flawed, leading to faster propagation of erroneous recommendations. Clinics should therefore treat speed as a secondary metric, validating accuracy on domain-specific tasks before scaling up. Retrieval is necessary but not sufficient - agents still hallucinate even with perfect context. Pinecone's webinar recap reminded Iotalabs that an agent can retrieve *every* relevant document and still answer incorrectly Pinecone. The speaker illustrated cases where the retrieved evidence was correct, yet the model's reasoning produced a hallucinated conclusion. In a healthcare setting, a chatbot that pulls the latest clinical guideline but misapplies it could generate unsafe advice. The takeaway for clinics is to pair RAG pipelines with post-retrieval verification layers - such as rule-based checks or secondary LLM passes - that explicitly test the logical consistency of the answer against the source material. Formal verification can close the safety loop for AI-generated code. Microsoft Research introduced PDD Kit, a framework that automatically creates formal specifications for code written by AI agents and verifies that the implementation satisfies those specs Microsoft Research. For healthcare software, where regulatory compliance (e.g., FDA's Software as a Medical Device guidance) demands provable correctness, such tooling offers a practical path to audit AI-generated integrations - whether they stitch together an EMR API or automate lab-result ingestion. Clinics considering custom AI agents should embed a verification step like PDD Kit into their CI/CD pipelines to catch logic errors before they reach production. IOTA's take. Clinics and SaaS health platforms can't rely on raw model speed or generic LLM benchmarks when automating lab or patient-interaction workflows. Deploy a domain-specific test suite (e.g., BioBasicsBench), reinforce retrieval with logical validation, and lock AI-generated code behind formal verification. Those disciplined steps turn AI from a flashy add-on into a trustworthy engine for diagnosis, scheduling, and data integration.
Vercel introduces DBSC: how it protects against cookie theft. Vercel is rolling out DBSC to make stolen session cookies harder to exploit. Learn how the protection works, its hardware requirements and security limits. Nov 6, 2026 Vercel brings DBSC to protect developers' sessions. Image: Generated via ChatGPT Stealing a session cookie can let hackers bypass passwords and multifactor authentication. Vercel wants to make that shortcut much harder to exploit. Session cookies are credentials that let a website recognize a user is still authenticated, so the user doesn't have to log in every time they revisit the site or take an action. While convenient, it creates a security weakness: attackers can steal valid session cookies through infostealer malware and replay them from another device to impersonate their victims. To help end that, Vercel is rolling out Device Bound Session Credentials (DBSC), a technology that ties authenticated browser sessions to cryptographic keys stored securely on the original device. This means that even if attackers steal a session cookie, they ordinarily can't reuse it on another device without also possessing the corresponding private key. Vercel joins the fight against session-cookie theft. The development was announced on Tuesday, Nov. 3, in an X post by Vercel's CTO, Malte Ubl. The technology binds an authenticated browser session to a cryptographic key pair, requiring the browser to prove possession of its private key before the server renews the session. For instance, an infostealer infects a developer's computer and extracts their Vercel session cookie. The attacker could then try importing that cookie into another browser to access the developer's account without entering their password or passing MFA again. With DBSC enabled, however, the attacker's browser would now also need to prove possession of the private key associated with the original session. Since stealing the cookie does not automatically give the attacker that key, the server can reject the attempt to renew the session. Vercel's implementation follows Google's introduction of DBSC support in Chrome 146 for Windows and Chrome 148 for macOS, and only works on Chrome for now. Ubl also noted that the feature is rolling out gradually to Vercel users. The result is an additional layer of protection against cookie replay: even when attackers get their hands on a valid session cookie, transferring it to another device is no longer enough to maintain access to the victim's account. Vercel's new feature has a catch. However, a hardware requirement could limit who benefits from Vercel's new protection: a compatible Trusted Platform Module (TPM). DBSC relies on this security component to generate and protect the private cryptographic keys that bind browser sessions to individual devices. On Windows, Chrome uses TPM hardware to store these keys securely. This means users whose computers lack a compatible TPM, or whose TPM is unavailable to Chrome, may not benefit from DBSC. On macOS, Chrome uses Apple's Secure Enclave to provide the equivalent hardware-backed key protection. The requirement reflects a broader shift in computer security over recent years, with hardware-backed security becoming an increasingly important foundation for protecting devices, identities and sensitive data. Microsoft, for instance, requires TPM 2.0 for Windows 11 installation, partly because several of its security capabilities rely on the technology for secure key storage, encryption and device integrity checks. Features such as BitLocker and Windows Hello also use TPM capabilities to strengthen data and identity protection. Consequently, Vercel's protection is another example of how modern security measures increasingly depend on hardware capabilities, not just software updates. Users with older or unsupported hardware may therefore miss out on newer protections designed to keep their accounts safe. What Vercel's new feature means for enterprises and developers. For developers and organizations using Vercel, the new protection makes stolen session cookies a less reliable way for attackers to take over accounts. Even if infostealer malware extracts a valid Vercel session cookie, DBSC adds another verification requirement that makes replaying it from a different device substantially harder. However, the protection does not eliminate the broader threat posed by infostealer malware. Attackers may still steal passwords, API tokens and other sensitive credentials, while malware operating on an already compromised device remains a separate concern. Organizations should continue enforcing multifactor authentication, monitoring suspicious account activity, keeping browsers and devices updated, and restricting access to sensitive development environments. IT teams should also verify whether their managed devices support DBSC and whether the feature is active for their users as Vercel's rollout progresses. Ultimately, DBSC addresses an important weakness in browser authentication, but its effectiveness will depend on browser compatibility, device support and how consistently services enforce device-bound session renewal. In other news, hackers targeted outdated iPhones and Android devices through compromised websites, exploiting previously patched vulnerabilities to steal passwords, browser cookies, and sensitive data without requiring users to download files or click additional links. Joseph is a technical writer with about three years of experience creating clear, practical content across consumer technology, startups, tutorials, and cybersecurity. He is also advancing a career in cyber threat intelligence, driven by a strong interest in the responsible use of technology and its role in protecting people, organizations, and digital systems. His passion for cybersecurity grew out of a broader commitment to helping others understand technology safely and effectively. As an undergraduate at the National Open University of Nigeria, he leads a community of technology enthusiasts, guiding beginners, sharing learning resources, and helping students build confidence as they explore careers in tech. Joseph's writing combines technical curiosity with an accessible, beginner-friendly style. In addition to his editorial work, he periodically shares cybersecurity case studies and research reports on social media, covering threat trends, security lessons, and practical insights for readers interested in cyber awareness and digital safety.
Where a scheduled job lives: in the repo, in the platform, or in your app. November 5, 2026 On 4 November 2026 Vercel announced Schedules, now in public beta. The product is interesting, but the sentence Vercel used to explain why it exists is more useful to anyone who runs scheduled jobs. Describing ordinary cron jobs, the post says: "You define them once in code and then can update them by editing their config and redeploying." That sentence describes one place a schedule can live: the repository. There are at least two others. Where you put a schedule decides who can change it, how fast, and what you can see afterwards. This article compares the three and the trade-off each one makes. It is not about price; its earlier comparison with Vercel covered how the bills are built. This one is about when a schedule's definition can change. What vercel shipped. Vercel Schedules has two halves. In Vercel's words, "Static schedules keep the timing in vercel.json or Build Output API configuration and sync when you deploy," while "Dynamic schedules let your app create and manage schedules through the JS SDK, CLI, or API as it runs. They support one-time and recurring work through Queue topics." The stated goal is to let "agents and applications to create, change, or cancel one-time and recurring schedules through code, without redeploying." Two details are worth knowing before you read the example configuration. The static example marks its function with "experimentalTriggers": [{"type": "schedule/v1beta"}], and Vercel describes its Nitro 3 support as an "experimental integration". This is a beta, and the configuration format says so. Place one: the schedule lives in the repository. This is the model Vercel's sentence describes: a schedule written in a config file next to the code, applied when you deploy. * What you get: the schedule goes through the same review as the code. A change to when the database backup runs shows up in a pull request, can be diffed, and rolls back with the deploy. Nothing at runtime can quietly rewrite it. * What it costs: changing a time means a deploy. If your deploy path is blocked, for example by a failing test or a frozen release, the schedule change is blocked with it. And a schedule that belongs to one customer or one request cannot be written into a config file at all. Place two: the schedule lives in the platform. The classic crontab on a server works this way, and so does DeployBase. Cron jobs are added and removed from the cron section of each app's page in the dashboard, or through its API with an API token created in dashboard Settings. The change is written to the server's cron straight away; no deploy is involved. On plans that include SSH (Pro and above), crontab -e works too, and those entries appear in the same list. Schedules are standard five-field cron expressions. There are no one-time jobs. * What you get: you can move a nightly job from 02:00 to 04:00 in seconds, even when you cannot deploy. * What it costs: the schedule is not in your repository, so nobody reviews it, and it does not roll back when the code does. DeployBase does not keep a history of cron changes either. That can bite after a refactor. If a deploy renames scripts/nightly.js, the cron entry still calls the old path, and nothing in the deploy tells you. There is a common way to get most of the first model's benefits from the second: keep the timing in code and give the platform a single entry that never changes. Laravel's scheduler is the familiar example. One cron entry runs php artisan schedule:run every minute, and every real schedule is defined in the application, reviewed and deployed with it. The same pattern works in any language: one minute-by-minute entry that runs a script, and a script that decides what is due. Place three: the schedule lives in the application, at runtime. This is Vercel's dynamic half, and it covers a case the other two cannot serve well. Vercel's example is an agent asked, "Tomorrow morning, summarize the top five stories on Hacker News." The schedule is created by a user's request, belongs to that user, and runs once. Vercel describes the usual way to do this today: "storing the request and its schedule time in a database, then using a cron job to check for work that is due." That is exactly what you would build on a platform with only cron: a table of due tasks and one cron entry that checks it every minute. It works, but you own the table, the polling, the retries and the cleanup. Vercel's pitch is that the platform holds the schedule and delivers it to your code when it is due. * What you get: per-user and one-time schedules without your own polling table. * What it costs: the schedules are created by running code, so review happens on the code that creates them, not on each schedule. Your repository no longer tells you what will run tonight; the platform's list does. Choosing. * Fixed operational jobs (backups, sync, cleanup): keep the definition in code. Either a repo config, or a single platform cron that runs your own scheduler. * Jobs you may need to move in a hurry: a platform-stored cron changes without a deploy. Write down every change yourself, because the platform may not keep a record. * Schedules created by users or agents: these need runtime scheduling, either a platform feature built for it or your own table with a polling cron. Whichever you pick, check one more setting: the time zone a schedule runs in. Vercel's example puts it in the configuration ("timezone": "America/New_York"). A classic crontab uses the clock of whatever machine runs it, which can differ between two crons on the same platform and shifts with daylight saving time where the zone observes it. Sources: Vercel, "Introducing Vercel Schedules", Elliot Dauber, published 4 November 2026, read in full 6 November 2026. DeployBase behaviour checked against its own code and server configuration on 6 November 2026.
Best static site Hosting 2026: Vercel vs netlify vs Cloudflare Pages. By Digital Lab Editorial Team - Updated November 2026 · 9 min read · Some links are affiliate links; Digital Lab 247 may earn a commission at no extra cost to you. Static site hosting (Jamstack) delivers pre-built HTML at CDN speed - perfect for marketing sites, documentation, and content-driven sites. In 2026, Vercel dominates the Next.js world, Netlify remains the pioneer, Cloudflare Pages wins on price + performance, and Render + Railway serve fullstack needs. Here's its 2026 ranking. Best for Next.js: Vercel - creators of Next.js, best DX. Best all-framework: Netlify - the Jamstack pioneer. Best price-performance: Cloudflare Pages - free unlimited bandwidth + edge network. Best fullstack: Render - static + server + databases + workers. The contenders at a glance. 1. Vercel - Best for Next.js + modern React. Best for: Next.js projects, React apps, teams committed to Vercel's ecosystem. Pricing: Free (Hobby, generous limits) | Pro $20/user/mo | Enterprise custom Site: vercel.com Vercel created Next.js and their platform is optimized around it. Best-in-class deploy previews on every git push, automatic HTTPS, edge functions, serverless functions, image optimization, and analytics. The developer experience is what makes Vercel dominant despite premium pricing. Pros. * Best DX for Next.js projects * Deploy previews on every git commit * Edge Functions + Serverless Functions * Built-in analytics + speed insights Cons. * Pro tier $20/user adds up for teams * Egress pricing can surprise at scale Verdict: Vercel is the default choice for Next.js projects. 2. Netlify - Best all-framework Jamstack pioneer. Best for: Any static site generator or framework - Gatsby, Hugo, Astro, Next.js, Nuxt, SvelteKit. Pricing: Free (Starter, 100 GB bandwidth) | Pro $19/mo | Business $99/mo | Enterprise custom Site: netlify.com Netlify pioneered the Jamstack category. Framework-agnostic, deep git integrations, forms, identity, split testing, and Netlify Functions (serverless). Great DX across every framework. Still the reference platform for Jamstack sites not tied to Next.js. * Framework-agnostic (unlike Vercel's Next.js focus) * Netlify Functions for serverless * Built-in forms + identity + split testing * Great DX across all frameworks * Bandwidth pricing surprises at scale * Feature velocity slower than Vercel Verdict: Netlify is the pick for framework-agnostic Jamstack. 3. Cloudflare Pages - Best price-performance. Best for: Sites wanting free unlimited bandwidth on Cloudflare's global edge network. Pricing: Free (unlimited bandwidth + requests) | Workers Paid $5/mo Site: pages.cloudflare.com Cloudflare Pages runs on Cloudflare's edge network with UNLIMITED bandwidth on the free tier. Combined with Cloudflare Workers ($5/mo) for serverless, this is the most cost-effective static hosting. 275 PoPs globally. * FREE unlimited bandwidth (no other platform matches this) * Cloudflare's edge network (275 PoPs) * Workers ($5/mo) adds serverless * Simple pricing * Framework support less mature than Vercel * Deploy previews less polished than Netlify Verdict: Cloudflare Pages is its top price-performance pick. 4. Render - Best fullstack. Best for: Fullstack apps needing static site + backend server + database + workers in one platform. Pricing: Free (static sites) | Starter $7/mo for services | Pro $19-85/mo per resource Site: render.com Render is the pragmatic fullstack platform - deploy static sites (free), Node/Python/Go/Ruby servers, PostgreSQL databases, Redis, and background workers all in one place. Simpler pricing than Heroku, more capable than pure static hosts. * Fullstack - static + servers + databases + workers * Simpler pricing than Heroku * Auto-scaling * Free static hosting * More complex than pure static hosts * Server pricing scales with resources 5. GitHub Pages - Best simple free. Best for: Documentation sites, personal blogs, open-source project pages. Pricing: Free (100 GB bandwidth, 1 GB storage) Site: pages.github.com GitHub Pages is the simplest free static hosting - push to a repo, get a live site. Jekyll built-in, custom domains supported, HTTPS free. Perfect for docs sites + personal projects. Doesn't compete with Vercel/Netlify on features but wins on simplicity. * Absolutely simple - push to git = live * Free forever * Native Jekyll support * Custom domains + HTTPS free * Static only (no serverless) * 1 GB repo limit Verdict: GitHub Pages is the pick for docs sites + simple projects. 6. Railway - Best usage-based fullstack. Best for: Developers wanting simple usage-based pricing for fullstack apps. Pricing: $5 free credit | Hobby $5/mo | Pro $20/mo | usage-based on top Site: railway.app Railway offers extremely simple deployment for fullstack apps - deploy Docker containers, static sites, databases with a few clicks. Usage-based pricing (only pay for what you use). Great for indie developers running side projects. * Extremely simple deploy workflow * Usage-based pricing (no idle costs) * Deploy databases + services together * Great indie developer experience * Usage-based can be unpredictable * Smaller than Vercel/Netlify Verdict: Railway is the pick for indie developers wanting simple fullstack. How to choose. * Next.js project: Vercel. * Any other framework: Netlify. * Free + best price-performance: Cloudflare Pages. * Fullstack (static + server + DB): Render. * Docs + personal projects: GitHub Pages. * Simple fullstack usage-based: Railway. Related reading. Frequently asked questions. Vercel vs Netlify - which one? Vercel for Next.js projects (native optimization). Netlify for anything else (Gatsby, Hugo, Astro, SvelteKit). Both have generous free tiers - try both. Is Cloudflare Pages really free with unlimited bandwidth? Yes, genuinely. Cloudflare monetizes via Workers (serverless) at $5/mo and enterprise deals. Their unlimited bandwidth free static hosting is the most generous offering in the space. Can I run a WordPress site on these platforms? No - these are for static/Jamstack sites. WordPress requires PHP + MySQL. Use dedicated WordPress hosting for WP sites. See Best WordPress Hosting 2026. What about serverless functions? Vercel Serverless + Edge Functions, Netlify Functions, Cloudflare Workers, Render Cron Jobs. All support running server-side code on-demand. Cloudflare Workers has the best price-performance. Which platform for a documentation site? GitHub Pages (free + simple) for basic docs. Vercel or Netlify if using Docusaurus/Nextra/MkDocs with advanced features. Cloudflare Pages if you want the fastest globally. Bottom line. For Next.js in 2026, Vercel is the default. Netlify for other frameworks. Cloudflare Pages for free unlimited bandwidth. Render for fullstack. GitHub Pages for simple docs. Railway for indie fullstack. Need help picking the right stack? Digital Lab helps businesses evaluate + implement modern tech stacks - no vendor bias. Talk to its team
Vercel rolls out new protection against stolen session cookie attacks. Incident overview. Vercel recently introduced enhanced security protections specifically designed to thwart session hijacking attempts, a technique where adversaries use stolen session cookies to gain unauthorized access to user accounts. This proactive measure addresses the growing prevalence of information-stealing malware which exfiltrates browser cookies, enabling attackers to bypass multi-factor authentication (MFA) and gain persistent access. While not tied to a specific breach event, the update arrives as a systemic response to the increasing sophistication of session-based exploitation that targets developers and corporate environments using web-based platforms. The new protections include tighter cookie validation protocols that link active sessions more strictly to the original client environments, thereby rendering intercepted cookies ineffective for unauthorized use. Vercel has prioritized this update to stabilize the platform's security posture against ongoing credential harvesting campaigns that utilize automated malware toolkits to compromise session tokens. Strategic implications. The introduction of these protections highlights a significant shift in the cybersecurity landscape, as session hijacking continues to emerge as a primary vector for bypassing traditional perimeter defenses and MFA. Organizations must recognize that relying solely on static authentication methods is no longer sufficient, as session tokens are now considered high-value targets for threat actors. This move by Vercel underscores a broader industry imperative for platforms to adopt contextual authentication and browser-based binding technologies to protect identities. For businesses, this necessitates a reassessment of third-party risk management, particularly for cloud-based development environments. Failure to address session-based vulnerabilities could lead to severe consequences, including unauthorized source code access, data exfiltration, and non-compliance with data protection mandates. Companies must transition toward 'Zero Trust' identity strategies that treat session tokens with the same level of security rigor as initial login credentials. Critical insights. Security teams should prioritize the implementation of robust endpoint detection and response (EDR) solutions to identify and neutralize information-stealing malware capable of harvesting browser data. Organizations should enforce strict device health monitoring and consider utilizing hardware-backed security keys or browser-level session binding where possible to mitigate the risk of stolen token reuse. Monitoring for anomalous login patterns, such as sudden geographical shifts or changes in browser fingerprints, remains a vital detection strategy. Security administrators should educate employees on the dangers of downloading software from unofficial sources, which is a common delivery mechanism for cookie-stealing malware. Future defense strategies must shift focus from simple password management to comprehensive session management and lifecycle enforcement. Security teams are encouraged to keep platform-specific security settings at the highest level of strictness to ensure that newly released protections, like those from Vercel, are fully utilized.
Vercel is Hiring for 87 Jobs on Simplify!
Find jobs on Simplify and start your career today
Don't see your dream role? Check out thousands of other roles on Simplify.Browse all jobs
About Vercel
Industries
Company Size
501-1,000
Company Stage
Series F
Total Funding
$863M
Headquarters
San Francisco, CA
Founded
2015
Vercel is Hiring for 87 Jobs on Simplify!
Find jobs on Simplify and start your career today
Don't see your dream role? Check out thousands of other roles on Simplify.Browse all jobs