vercel-data-handling

name	vercel-data-handling
description	Implement data handling, PII protection, and GDPR/CCPA compliance for Vercel deployments. Use when handling sensitive data in serverless functions, implementing data redaction, or ensuring privacy compliance on Vercel. Trigger with phrases like "vercel data", "vercel PII", "vercel GDPR", "vercel data retention", "vercel privacy", "vercel compliance".
allowed-tools	Read, Write, Edit
version	1.18.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","vercel","compliance","privacy","security"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Vercel Data Handling

Overview

Handle sensitive data correctly on Vercel: PII redaction in logs, GDPR-compliant data processing in serverless functions, secure cookie management, and data residency configuration. Covers both what Vercel stores and what your application should protect.

Prerequisites

• Understanding of GDPR/CCPA requirements
• Vercel Pro or Enterprise (for data residency options)
• Logging infrastructure with PII awareness

Instructions

Step 1: Understand What Vercel Stores

Data Type	Where	Retention	Control
Runtime logs	Vercel servers	1hr (free), 30d (Plus)	Log drains
Build logs	Vercel servers	30 days	Automatic
Analytics data	Vercel	Aggregated, no PII	Disable in dashboard
Deployment source	Vercel	Until deleted	Manual deletion
Environment variables	Vercel (encrypted)	Until deleted	Scoped access

Step 2: PII Redaction in Logs

// lib/redact.ts — redact PII before logging
const PII_PATTERNS: [RegExp, string][] = [
  [/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, '[EMAIL]'],
  [/\b\d{3}[-.]?\d{3}[-.]?\d{4}\b/g, '[PHONE]'],
  [/\b\d{3}-\d{2}-\d{4}\b/g, '[SSN]'],
  [/\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g, '[CARD]'],
  [/\b(?:Bearer|token|key|secret|password)\s*[:=]\s*\S+/gi, '[CREDENTIAL]'],
];

export function redact(text: string):  {
   result = text;
   ( [pattern, replacement]  ) {
    result = result.(pattern, replacement);
  }
   result;
}


 { redact }  ;

   () {
   body =  request.();
  .(, (.(body)));
  
}