Skip to main content
BAA Directory

Is Vercel HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on Enterprise and Pro. Vercel signs BAAs with customers, and Pro customers get one through the HIPAA add-on in their dashboard billing settings.

Site builders. Checked on the vendor's own pages on .

Using Vercel on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Vercel says

“We sign Business Associate Agreements (BAAs) with customers.”

Source: Vercel Knowledge Base, How to build and maintain HIPAA-compliant applications on Vercel, checked .

“The HIPAA BAA is available to Enterprise and Pro customers who are covered entities or business associates under HIPAA.”

Source: Vercel Knowledge Base, How can my organization sign a BAA with Vercel?, checked .

What the BAA covers and excludes

Covers, in Vercel's words:

  • Vercel lists its core platform services as “fully covered under the BAA”: the CDN, Vercel Functions, Global Config, the build and deploy pipeline, environment variable management and Static IPs.

Excludes or limits, in Vercel's words:

  • "Each provider that stores or processes PHI is a business associate in its own right, so the BAA chain has to extend all the way down your stack."

What this means for ad tracking

A web host's BAA covers the servers, functions and data it runs for you. Vercel says its HIPAA BAA “covers our entire global infrastructure,” and that “Each provider that stores or processes PHI is a business associate in its own right” (Vercel).

The ad pixels on your pages are a different matter. A Meta or Google tag runs in the visitor's browser and sends data to that company, which is not a party to your BAA with Vercel, and this directory lists Meta and Google Ads as not signing one. Our guides to HIPAA compliant website hosting and removing the Meta Pixel from a healthcare website cover the rest.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Vercel for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Vercel HIPAA compliant?

Yes, on Enterprise and Pro. Vercel signs BAAs with customers, and Pro customers get one through the HIPAA add-on in their dashboard billing settings. With a signed BAA, Vercel can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Vercel sign a BAA?

Yes. In Vercel's words: “We sign Business Associate Agreements (BAAs) with customers” (Vercel). We checked Vercel's own page on October 26, 2026.

Which Vercel plans include a BAA?

Vercel says “The HIPAA BAA is available to Enterprise and Pro customers who are covered entities or business associates under HIPAA.” Pro customers add HIPAA from the billing settings in the dashboard, and Enterprise customers contact their Customer Success Manager or Account Executive (Vercel).

Does Vercel's BAA cover my database?

Vercel tells you to check. It says “Most PHI ends up in a database or storage layer, and much of that sits outside Vercel,” and to “Execute BAAs with those providers” (Vercel). Supabase is one database with its own entry in this directory.

Does a BAA with Vercel cover my ad pixels?

No. A BAA covers the data Vercel handles for you. A pixel sends data from the visitor's browser to Meta, Google or TikTok, and none of them is a party to your BAA with Vercel.

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Vercel before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call