vercel-data-handling

# Vercel Data Handling ## Overview Handle sensitive data correctly on Vercel: PII redaction in logs, GDPR-compliant data processing in serverless functions, secure cookie management, and data residency configuration. Covers both what Vercel stores and what your application should protect. ## Prerequisites - Understanding of GDPR/CCPA requirements - Vercel Pro or Enterprise (for data residency options) - Logging infrastructure with PII awareness ## Instructions ### Step 1: Understand What Vercel Stores | Data Type | Where | Retention | Control | |-----------|-------|-----------|---------| | Runtime logs | Vercel servers | 1hr (free), 30d (Plus) | Log drains | | Build logs | Vercel servers | 30 days | Automatic | | Analytics data | Vercel | Aggregated, no PII | Disable in dashboard | | Deployment source | Vercel | Until deleted | Manual deletion | | Environment variables | Vercel (encrypted) | Until deleted | Scoped access | ### Step 2: PII Redaction in Logs ```typescript // lib/redact.ts — redact PII before logging const PII_PATTERNS: [RegExp, string][] = [ [/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, '[EMAIL]'], [/\b\d{3}[-.]?\d{3}[-.]?\d{4}\b/g, '[PHONE]'], [/\b\d{3}-\d{2}-\d{4}\b/g, '[SSN]'], [/\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g, '[CARD]'], [/\b(?:Bearer|token|key|secret|password)\s*[:=]\s*\S+/gi, '[CREDENTIAL]'], ]; export function redact(text: string): string { let result = text; for (const [pattern, replacement] of PII_PATTERNS) ...