Vercel

Independent Sources

Shown for context — not merged with USAComplaints' own numbers.

Contacts

• Official website: https://vercel.com/
• Support center (billing cases: describe the problem to the AI chat, then 'Create Case'): https://vercel.com/help
• Report abuse (phishing or malware, DMCA, trademark, other): https://vercel.com/abuse
• Privacy requests: [email protected]
• Legal notices; arbitration opt-out (subject 'COMPANY ARBITRATION OPT-OUT'): [email protected]
• DMCA designated agent: [email protected]
• Security bulletins (Knowledge Base): https://vercel.com/kb/bulletin
• Service status: https://www.vercel-status.com
• Community forum (user posts; Vercel staff reply): https://community.vercel.com/

Locations

Billing, paused projects, cancellation or a security question? What to check

Vercel (vercel.com) is a hosting and deployment platform that developers and companies use to publish websites and web apps; its company also maintains the open-source Next.js framework. People who search its name with "complaints" usually have a billing, paused-site, cancellation or security question, or have found a suspicious site on a vercel.app address. This section collects what Vercel's own pages said when read on 2026-10-03; it is not legal advice and your account settings and any signed order form control.

• Plans and prices. The Pricing page lists Hobby at "$0/mo.", Pro at "$20/mo." with "$20 of included usage credit", and Enterprise as "Custom"; its plan-comparison table lists a Developer seat on Pro at "$20 / month" and unlimited viewer seats. The Pro Plan documentation (updated 2026-09-15) describes a "$20/month Pro platform fee" with one deploying team seat, additional Owner or Member seats at "$20/month each", unlimited free viewer seats, and billing "monthly based on the number of deploying team seats, paid add-ons, and any on-demand usage". It says the monthly credit "expires at the end of the month if you don't use it". Prices are stated in USD excluding taxes.
• Usage above the credit. The Pricing FAQ says "On top of your included credit on Pro, you can pay as you go, uncapped. If you have a free Hobby account, you are limited to the usage caps and cannot purchase additional usage." Terms of Service 17.1 says Vercel charges "in advance of each self-service subscription term" and "in arrears" for services used, and that "If Vercel detects elevated, irregular, high or anomalous use of the Services, as determined in Vercel's sole discretion, Vercel may automatically charge your payment method for the then accrued fees". Section 6 says that if you connect AI tools, agents or other third-party tools to your account, "You agree that you are responsible for any costs incurred through the Third Party Tools' use of the Services."
• Payments, overdue accounts and invoices. The Pro billing FAQ (updated 2026-09-17) says payment is by "Credit/Debit card only" and lists gift cards, prepaid cards, EBT cards and "some virtual cards" as invalid; that each invoice "charges for the upcoming billing cycle" and "includes any additional usage that occurred during the previous billing cycle"; and that "Delays and extensions are not available". It says an overdue account cannot create new projects, add team members or redeploy, and that "For subscription renewals, payment must be successfully made within 14 days, else all deployments on your account will be paused." Past invoices are under Settings, then Invoices; the FAQ says "Once an invoice is paid, it cannot be recharged with a different payment method, and refunds are not provided in these cases", and that deleting a team removes its invoice history, so download PDFs first. Since September 30, 2026 the usage metric formerly called Edge Requests is called CDN Requests on the usage dashboard and on invoice line items; Vercel's changelog says the change is "a naming change only: pricing, limits, and how usage is measured are all unchanged".
• Vercel Connect charges. The Vercel Connect pricing page (updated 2026-08-26) says Connect is billed by token requests and triggers: on Pro "$3.00 per 1,000 token requests" and "$0.95 per 1,000 triggers" (Hobby includes 500 token requests and 1,000 triggers per month), and that for Connect beta customers the updated pricing "will take effect on September 25, 2026". It says each trigger destination that receives a webhook counts as one trigger, and that "Removing trigger destinations alone does not stop billing" because the webhook URL must be removed at the provider; to stop token-request billing, stop calling the API, unlink projects and revoke or delete provider tokens.
• Spend limits. The Pricing FAQ says "All new teams have a default on-demand usage budget of $200 (which can be customized)" and that at 100 percent "you can optionally configure Vercel to automatically pause all projects with a hard limit". The Spend Management documentation (updated 2026-09-18) says "Setting a spend amount does not stop usage on its own. To stop incurring costs above your spend amount, turn on Pause Production Deployments", that Vercel checks spend "every few minutes" so pausing "can trigger several minutes after you cross your spend amount", and that the amount "does not include seats, integrations (such as Marketplace), or separate add-ons". The same page says pausing "does not stop AI Gateway API key usage or v0 usage billed to your team, which continue to count toward your spend amount". A Vercel changelog post of June 27, 2024 states "Spend Management now pauses production deployments by default when your set amount is reached"; the current documentation describes pausing as a setting to enable. Check your own team's Billing settings, which are controlled by the Owner or Billing role.
• If a project is paused or disabled. The documentation says a paused production deployment returns "503 DEPLOYMENT_PAUSED" and "Projects won't automatically unpause if you increase the spend amount, you must resume each project manually." Vercel's DEPLOYMENT_DISABLED error page lists "Error Code: 402" ("Payment required") and suggests checking usage limits, the account plan and Vercel's emails. For Hobby accounts the Hobby documentation says that in most cases, after exceeding limits, "you will have to wait until 30 days have passed before you can use the feature again". Terms 4 adds that Vercel "may shut down and terminate projects or deployments using the Hobby plan without notice for any reason or no reason".
• Contacting support about billing. The support center is vercel.com/help. A Vercel Community staff reply of March 16, 2026 says: "You can open a Billing support case from https://vercel.com/help", describing the problem to the AI chat and clicking "Create Case". The Support Terms (updated June 12, 2026) say Hobby customers can submit a ticket for billing or login/registration issues; that "we strongly encourage you to contact Vercel Support rather than filing a dispute with your card provider" because after a card dispute "the account associated with it and all deployments under it may be suspended until it has been resolved"; and that "Requests for billing amendments must be made within 1 month of the date of the invoice or billing receipt" (later requests may be declined), with "Deleted accounts are ineligible for refunds". The same terms say "We only commit to respond to Customers with an Enterprise subscription" within target times.
• Cancelling and refunds. Terms 17.1: "All fees are non-refundable, except as expressly stated otherwise in this Agreement." Terms 18.1: you may terminate your account or downgrade Pro to Hobby "by sending a cancellation request to Vercel Support via the Help page", effective "at the start of the next renewal period", and if Vercel terminates your account without cause on a self-service subscription it "will refund the pro-rated, unearned portion of any amount that you have prepaid". The Pro Plan documentation separately describes a self-service route: Settings, then Billing, then "Downgrade Plan" (stores and domains must first be transferred); the Pro documentation adds that "When you downgrade a Pro team, all active members except for the original owner are removed." The trial documentation (updated 2026-09-14) says "Your trial finishes after 14 days or once your team exceeds the usage limits, whichever happens first", that "Billing begins immediately after your trial ends if you have added a payment method" and that without a payment method the team reverts to Hobby and "you will not get charged"; it also says that when a trial team returns to Hobby "All team members will be removed from your team, and all Hobby limits will apply to your team". Domains: "All domain purchases and renewals are final and will not be refunded once processed" (Support Terms). AI products (v0, AI Gateway): payments are "final, non-refundable, and non-transferable, unless expressly authorized by Vercel in writing, in Vercel's sole discretion" (AI Product Terms, March 17, 2026).
• Vercel Agent charges. The Vercel Agent pricing page (updated 2026-08-28) says Chat, Slack and Code Review are billed at provider token cost "plus $0.25 per million tokens", Code Review lists included usage of "None", and Investigations include 10 per billing cycle with Observability Plus. To reduce automatic usage it lists disabling dashboard chat, turning off automatic Code Reviews and disabling automatic Investigations, and notes that manual requests "can create paid usage".
• Your content and AI training. Terms 3 says that on a Hobby plan or trial Pro plan "we may use Your Content to train our artificial intelligence ("AI") and machine learning models"; on a paid Pro plan "Model Training is not enabled by default and you may opt in", and you can opt out through Team settings or an Enterprise plan.
• Disputes with Vercel. Terms 22 chooses California law and San Francisco courts, requires a 60-day informal process and then JAMS arbitration before a sole arbitrator, includes a class action waiver, and keeps small-claims, injunctive-relief and intellectual-property disputes in court. It allows opting out of arbitration by emailing [email protected] with the subject "COMPANY ARBITRATION OPT-OUT" within 30 days of first use.
• A suspicious site on a vercel.app address. Vercel's documentation says "When you create a deployment on Vercel, we automatically assign it a domain based on your project name and ending in .vercel.app", so such addresses are created by Vercel's users. Vercel's Acceptable Use Policy (updated April 21, 2026) prohibits "Fraud, deceptive practices, or other scams" and "Impersonation, phishing" and says "To report a violation of this Policy, please visit https://vercel.com/abuse"; the abuse form offers "Phishing or malware", "Copyright infringement (DMCA)", "Trademark violations" and "Other". Fraud reports can also be filed with the FTC at ReportFraud.ftc.gov. Two old USAComplaints posts about such third-party sites are not linked to this page.
• If your credentials may have been exposed. See the security bulletins summarized in the company background section; Vercel's April 2026 bulletin recommends reviewing and rotating environment variables and enabling multi-factor authentication. Terms 9.1 says that if you identify an actual or suspected security incident or vulnerability related to the Services "you shall immediately report it to [email protected]", while Vercel's Security page directs researchers to its public HackerOne program to report vulnerabilities.
• Privacy requests. The Privacy Notice (updated June 1, 2026) says you can exercise privacy rights through your Account and Team Preferences, "a request via our Privacy Request Center", or [email protected]; that "You may have the right to appeal our decision regarding a request related to your privacy rights"; and that "We fulfill requests within 45 days of receiving your request". For personal information received in reliance on the Data Privacy Framework that cannot be resolved internally, the Notice says Vercel has agreed to take part in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, which provides recourse "free of charge".

Government actions

U.S. Department of Justice, District of Nebraska: compliance with a search warrant (stipulated dismissal, June 2026). The Justice Department's press release of June 9, 2026 (updated June 11, 2026) says Vercel Inc. "agreed today to a enter a Stipulated Dismissal with the United States to resolve civil contempt proceedings related to Vercel's failure to comply with a federal search warrant issued under the Electronic Communications Privacy Act." According to the release, a magistrate judge issued a warrant on Aug. 11, 2025 for the contents of a specified user account; three days after Vercel received it the user deleted the account; the data "was still located in Vercel's servers in a deletion queue"; and on Feb. 2, 2026 the magistrate judge found a prima facie case of civil contempt. The release says Vercel produced the files on Feb. 5, 2026, and it also states: "Vercel is not and never was a target of the underlying criminal investigation." The release's headline says the proceedings "Conclude with Vercel Inc., Admitting Wrongdoing and Agreeing to Pay Government's Costs", and its text says that "As part of the Stipulated Dismissal, Vercel admitted" that its legal process response tools were inadequate in two ways; it also quotes a Justice Department official as saying "We are pleased Vercel has belatedly complied and accepted responsibility for the unnecessary costs incurred by the Government in this matter."

The Stipulation of Dismissal published by the Department (D. Neb. No. 8:25-MJ-465, marked filed 06/09/26) is dated as submitted on June 5, 2026 (court stamp "Doc # 40-1", filed 06/09/26) and contains these agreed facts: "At the time Vercel received the search Warrant, Vercel's legal process response tools were inadequate in two ways"; "Vercel has since updated its legal process response tools and procedures to enable the preservation and production of certain content, such as build outputs related to customer deployments"; and "Vercel has agreed to pay the government's fees and costs for having to litigate this matter." Its conclusion states that "Vercel has now complied with the Warrant and this matter should accordingly be dismissed" and asks the court to "issue a separate order" on fees and costs. The amount was to be given to the court in a separate joint motion and is not stated in the documents read. The warrant concerned one user's account; neither document describes a consumer-protection violation. The copy published by the Department has an unsigned order block, and a signed order of dismissal was not found in the sources checked on 2026-10-03. A public statement by Vercel about the matter was not found in the sources checked on 2026-10-03.

No Federal Trade Commission, Consumer Financial Protection Bureau or state attorney general enforcement action naming Vercel was identified in the searches run on 2026-10-03; those searches were limited to a search-engine query restricted to those agencies' sites and to the California and Massachusetts data-breach lists, and are not an exhaustive review of every agency's records. The California Attorney General's breach list (page for notices involving more than 500 California residents; filtered URL oag.ca.gov/privacy/databreach/list?field_sb24_org_name_value=vercel) returned "There are currently no published reported breaches." for the organization name "vercel" when opened in a browser on 2026-10-03, and the Massachusetts 2026 data breach report (mass.gov/doc/data-breach-report-2026/download, a spreadsheet document with entries through October 2, 2026, read through a text renderer) did not list Vercel among reporting organizations.

Company background, funding and security bulletins

Who operates it. The Terms of Service (updated June 1, 2026) name Vercel Inc. as the provider. SEC EDGAR lists Vercel Inc. (CIK 0001893137) as incorporated in Delaware with a San Francisco business address, 650 California Street; its only EDGAR filing shown on 2026-10-03 is a Form D filed December 16, 2021. Vercel's Terms and Privacy Notice give 440 N Barranca Avenue #4133, Covina, CA 91723 for legal and privacy mail. The company was named ZEIT until April 21, 2020 ("ZEIT is now Vercel", company blog). Its own pages give differing starting points: the September 2025 Series F post refers to "our founding insight back in 2015", while the 2020 post says "In 2016, we started with a simple goal".

What it sells. The Privacy Notice says "Vercel is a frontend cloud for deploying and scaling frontend applications." Products named on its pricing and legal pages include the hosting and CDN platform, serverless functions, firewall and security tools, Domains, AI Gateway, v0 (v0.app) and Vercel Agent. Next.js is open source and, per the Terms, software provided "exclusively under open source licenses (including, without limitation, Next.js)" is "not covered by this Agreement". The Terms (June 1, 2026), Support Terms (June 12, 2026), AI Product Terms (March 17, 2026), Acceptable Use Policy (April 21, 2026) and Privacy Notice (June 1, 2026) are the current versions of the documents on Vercel's Legal pages.

Funding and recent company news (company statements). On September 30, 2025 Vercel announced "a Series F funding round valuing our company at $9.3 billion", a "$300M investment" co-led by Accel and GIC, with a "~$300M tender offer" for certain early investors and employees. On July 7, 2026 it announced that "Vercel is acquiring Better Auth", the open-source authentication library company. On September 24, 2026 it announced that its bug bounty program is now public.

Security incidents and bulletins (Vercel's Knowledge Base, read 2026-10-03).

• April 2026 incident. Vercel's bulletin says "We've identified a security incident that involved unauthorized access to certain internal Vercel systems" and that it engaged incident response experts and "notified law enforcement". It says the incident "originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee", whose access was used to take over the employee's Google Workspace account and then reach a Vercel environment, where the attacker was able to "enumerate and decrypt non-sensitive environment variables". It says it contacted "a limited subset of customers" first, later identified "a small number of additional accounts" compromised in the incident, and separately "a small number of customer accounts with signs of compromise that appear to be separate" and not originating on Vercel systems; and that, with GitHub, Microsoft, npm and Socket, it "confirmed that no npm packages published by Vercel have been compromised". Recommendations include enabling multi-factor authentication, rotating environment variables that were not marked "sensitive" (and noting that "Deleting your Vercel projects or account is not sufficient to eliminate risk"), reviewing the activity log and deployments, and contacting support through vercel.com/help. The bulletin's update table runs from April 19 to April 24, 2026, with the last row reading "No updates published." Media reported that a forum poster claimed to be selling stolen Vercel data (BleepingComputer, April 19, 2026); that claim is unverified and Vercel's bulletin text read does not address it. No state attorney general breach notice or court filing about the incident was identified in the checks described in this profile.
• Next.js security releases, July to September 2026 (Next.js project posts, read 2026-10-03). The Next.js blog (nextjs.org/blog) lists security releases on July 20, 2026 (v16.2.11 and v15.5.21; four High and five Medium items listed), August 25, 2026 (v16.3.3 and v15.5.24; "two Critical severity vulnerabilities", one of them remote code execution in the Image Optimization API when using AVIF, for which the patched releases "disable AVIF optimization until an upstream fix is propagated", and one remote code execution on Windows-hosted servers), an out-of-band update on September 22, 2026 (v16.3.6 and v15.5.26; a Critical remote code execution issue in the Node.js ImageResponse implementation for Next.js versions ">=16.2.0 <16.3.6", with Next.js 15.x "not affected by the remote code execution issue") and a September 30, 2026 release (v16.3.8 and v15.5.27; one High, five Medium and one Low severity item). The September 30 post says "A fix for one critical vulnerability and one high severity vulnerability was postponed due to upstream dependency delays", and the project's September 23 advance notice, as updated, says those two "will be addressed in a later Next.js release". For the September 30 item about cache poisoning in self-hosted applications the post states "Applications deployed on Vercel are not affected"; it does not say that for the other items, and each post asks users to upgrade their Next.js dependencies. Next.js is open source and is not covered by Vercel's Terms (see "What it sells").
• React2Shell (December 2025). The React team's December 3, 2025 post describes CVE-2025-55182 as an unauthenticated remote code execution vulnerability in React Server Components "rated CVSS 10.0". Vercel's bulletin says Next.js 15.0.0 through 16.0.6 were affected, that "Prior to the CVE announcement, Vercel worked with the React Team to design WAF rules" delivered to all Vercel users, that "WAF rules cannot guarantee protection against all possible variants", and urges upgrading "regardless of other protections in place". It announced a HackerOne bounty for platform-protection bypasses ($25,000 for high and $50,000 for critical) and advised rotating secrets if an application was online and unpatched on December 4, 2025.
• Follow-on React/Next.js vulnerabilities (December 2025). A Vercel bulletin dated December 26, 2025 covers CVE-2025-55184 (high-severity denial of service) and CVE-2025-55183 (medium-severity source code exposure), neither allowing remote code execution; its December 11 update says "The initial fix was incomplete" for denial of service, resulting in CVE-2025-67779.
• Next.js middleware bypass (March 2025). GitHub's advisory for CVE-2025-29927 rates it Critical (9.1) and says "Next.js deployments hosted on Vercel are automatically protected against this vulnerability." Vercel's March 25, 2025 postmortem says the issue was reported on February 27, 2025, that "triaging was delayed", that patches were released on March 17 and 18, 2025, and that, having verified that Netlify and Cloudflare Workers were not affected, "we should have communicated this with their team".

Security and compliance claims (Vercel's Security page). Vercel says it holds a SOC 2 Type 2 attestation and ISO 27001:2013 certification and is certified under the Data Privacy Framework; these are company statements, and reports are available on request. The ISO catalogue page for ISO/IEC 27001 (opened 2026-10-03) lists ISO/IEC 27001:2013 under "Previously" with status "Withdrawn" and ISO/IEC 27001:2022 as the current edition; the Security page read that day names the 2013 edition and does not say which edition the certificate covers.

Complaint and review record (as displayed 2026-10-03)

The snapshots below were read on 2026-10-03 from separate sources and are not combined or averaged.

• USAComplaints: 0 approved posts are linked to this page. Two older posts (published March and May 2025) concern websites on vercel.app subdomains that complainants describe as a "spam crypto platform" and a "likely crypto scam or phishing tool"; those sites are deployed by Vercel users and are third-party content, so the posts are not attributed to Vercel and no complaint themes are shown.
• BBB: "BBB profile for Vercel Inc., 440 N Barranca Ave, Covina, CA" (found by searching "Vercel Inc" near Walnut, CA; searches near San Francisco returned no Vercel profile). "Vercel Inc. is NOT a BBB Accredited Business." The rating is shown as F, with reasons "Failure to respond to 6 complaint(s) filed against business" and "6 complaint(s) filed against business". The Complaints tab shows "6 total complaints in the last 3 years" and "4 complaints closed in the last 12 months"; it lists six complaints dated between August 2024 and August 2026 (three product issues, two billing issues, one service or repair issue), each carrying the status label "Unanswered". The Reviews tab shows 1 of 5 stars, "Average of 2 Customer Reviews". The BBB file was opened November 14, 2023. The profile also shows "Business Started" October 4, 1999 and "Years in Business: 27", a date that differs from the 2015 and 2016 starting points in Vercel's own posts (see company background); BBB's page does not say where it comes from. The reasons BBB gives for the F rating are the unanswered-complaint and complaint-count lines quoted above; it is BBB's own grading and not a finding by a court or regulator. A handful of BBB entries is too few to describe a trend, and BBB does not verify the accounts.
• Trustpilot: "Trustpilot profile for vercel.com": a claimed profile, TrustScore 1.7, 123 reviews, "60 reviews in the last 12 months". Trustpilot notes "This company hasn't invited customers recently, so reviews may not be representative". The rating bars show 14 percent five-star, 4 percent four-star, 0 percent three-star, 3 percent two-star and 79 percent one-star reviews.
• ComplaintsBoard: a search for "vercel" on the site returned "No reviews matching “vercel”".
• Vercel's own forum (user-reported, unverified): posts on community.vercel.com describe disputes over refunds, Vercel Agent usage charges and paused deployments. In one thread a customer said on September 7, 2026 that a roughly $106 billing dispute opened August 27 had gone unanswered for 11 days while production deployments returned HTTP 402; a Vercel staff member replied on September 24, 2026 that "the support team was able to get you a refund last week". These are individual accounts and Vercel's replies, not findings.

The CFPB complaint database covers financial products and was not queried because Vercel does not offer one.

Court record

CourtListener (RECAP) searches run on 2026-10-03 and read through a text renderer (the "Vercel Inc" phrase search was ordered by date filed, newest first; page: courtlistener.com/?q=%22Vercel+Inc%22&type=r&order_by=dateFiled+desc) gave these results: a search for the case name "vercel" returned only unrelated surnames, and a search for the phrase "Vercel Inc" returned 16 cases, none with Vercel Inc. in the case caption; in the docket text returned, Vercel appears as the recipient of a subpoena or search warrant or as an entry on creditor lists in other parties' matters. RECAP does not cover every federal docket, so this is not proof that no case exists. No consumer class action against Vercel and no court filing about the April 2026 security incident was identified in these checks. The one matter involving Vercel as a party that was found is the sealed District of Nebraska warrant-compliance proceeding described under government actions and in the court case entry below. Vercel's Terms of Service contain an arbitration clause and class action waiver (section 22), which affects whether customer claims proceed in court.

Is Vercel Legitimate?

Vercel Inc. is recorded in SEC EDGAR as a Delaware corporation (CIK 0001893137) with a San Francisco business address, and its Terms of Service, Privacy Notice and Support Terms (all updated in 2026) name Vercel Inc. as the provider of vercel.com. The site is the home of the open-source Next.js framework, and Vercel announced a $300M Series F in September 2025. Documented items that customers may weigh: Vercel's own bulletin on an April 2026 security incident involving environment variables; a June 2026 Justice Department stipulated dismissal in which Vercel agreed that its legal-process tools had been inadequate for one search warrant; a BBB profile showing an F rating with 6 complaints in the last 3 years as displayed on 2026-10-03 (BBB lists as reasons that six complaints were unanswered and that six were filed); and a Trustpilot score of 1.7 from 123 reviews on the same date, with Trustpilot noting the company has not invited customers recently. Also documented: the Justice Department stipulation's statement that Vercel "has now complied with the Warrant", the Justice Department's statement that Vercel "is not and never was a target of the underlying criminal investigation", Vercel's published spend-limit, support and refund terms (quoted above), a public bug bounty, and published patch guidance and Next.js releases for the vulnerabilities listed. USAComplaints gives no rating; this page records what the sources show. To avoid look-alikes, check that you are signed in at vercel.com and remember that any site ending in vercel.app is deployed by a Vercel user.

Court & Public Records

Frequently Asked Questions