# Vercel security overview

Cloud-deployed web applications face constant security threats, with attackers launching millions of malicious attacks weekly. Your application, users, and business require robust security measures to stay protected.

A comprehensive security strategy requires active protection, robust policies, and compliance frameworks:

- [Security governance and policies](/content/docs/security#governance-and-policies/index.html) ensure long-term organizational safety, maintain regulatory adherence, and establish consistent security practices across teams.
- A [Multi-layered protection](/content/docs/security#multi-layered-protection/index.html) system provides active security against immediate threats and attacks.

## [Governance and policies](/content/docs/security#governance-and-policies/index.html)

### [Compliance measures](/content/docs/security#compliance-measures/index.html)

Learn about the [protection and compliance measures](/content/docs/security/compliance/index.html) Vercel takes to ensure the security of your data, including DDoS mitigation, SOC2 Type 2 compliance, Data encryption, and more.

### [Shared responsibility model](/content/docs/security#shared-responsibility-model/index.html)

A [shared responsibility model](/content/docs/security/shared-responsibility/index.html) is a framework designed to split tasks and obligations between two groups in cloud computing. The model divides duties to ensure security, maintenance, and service functionality.

### [Encryption](/content/docs/security#encryption/index.html)

Out of the box, Vercel serves every deployment over an [HTTPS connection](/content/docs/cdn-security/encryption/index.html). Vercel automatically generates SSL certificates for these unique URLs free of charge.

## [Multi-layered protection](/content/docs/security#multi-layered-protection/index.html)

Understand how Vercel protects every incoming request with [multiple layers](/content/docs/vercel-firewall/firewall-concepts#how-vercel-secures-requests/index.html) of firewall and deployment protection. To restrict who can view your preview and production deployments, see the [access control](/content/docs/security/access-control/index.html) options: Password protection and Vercel Authentication.

### [Vercel firewall](/content/docs/security#vercel-firewall/index.html)

The Vercel firewall helps to protect your applications and websites from malicious attacks and unauthorized access through:

- An enterprise-grade platform-wide firewall available for free for all customers with no configuration required that includes automatic [DDoS mitigation](/content/docs/vercel-firewall/ddos-mitigation/index.html) and protection against low quality traffic.
- A [Web Application Firewall (WAF)](/content/docs/vercel-firewall/vercel-waf/index.html) that supports custom rules, managed rulesets, and allows customers to challenge automated traffic. You can customize the WAF at the project level.
- [Observability](/content/docs/vercel-firewall/firewall-observability/index.html) into network traffic and firewall activity, including the access to firewall logs.

Last updated August 11, 2026

---