Vercel BYOC on AWS Is Now Generally Available: Functions Run in Your Own Cloud Account

Vercel has announced the general availability of Bring Your Own Cloud (BYOC) on AWS. The core change in this offering is straightforward: enterprise teams can run Vercel Functions inside their own AWS accounts, while Vercel continues to handle deployment, environment management, routing, and static asset delivery.

What Exactly Does BYOC Change

Traditionally, using Vercel means function code executes in a Vercel-hosted runtime. For most teams, that's convenient enough. But for highly regulated industries like finance, healthcare, and government, code execution must stay within their own security and compliance boundaries—a requirement that often becomes a hard blocker for cloud adoption.

BYOC redraws those boundaries: function code and execution environments land in the customer's own AWS account, while Vercel takes over the deployment pipeline, environment configuration, request routing, and static assets. In other words, the "control plane" remains managed by Vercel, while function execution in the "data plane" returns to the enterprise's own infrastructure.

According to Vercel's official documentation, functions are provisioned within your AWS account at deploy time, and everything else continues to be delivered by Vercel.

Control plane and data plane are the key abstractions for understanding BYOC. The control plane handles orchestration, configuration, scheduling, and state management—it determines "what the system should do." The data plane carries actual business traffic and computation—it determines "how the system actually does it." In the serverless context, the data plane typically refers to function instance creation, execution, scaling, and the actual forwarding of requests. Traditional SaaS platforms put both in their own infrastructure, so customer code, traffic, and logs all cross the vendor's boundary. BYOC is essentially a "division of responsibilities": pushing the data plane down into the customer's account so sensitive data and execution environments stay within the customer's compliance boundary, while preserving the vendor's operational efficiency on the control plane. This model has been widely adopted in databases, message queues, Kubernetes management planes, and other areas. Vercel is now extending it to the serverless function layer.

Four Capabilities Enterprises Care About Most

Vercel explicitly lists four categories of value that BYOC delivers, covering the most common blockers in enterprise procurement decisions:

• Run Node.js and Python functions: Mainstream Vercel Functions runtimes work the same way in BYOC mode—no need to rewrite your tech stack for compliance.
• Meet strict compliance, security, and isolation requirements: Function code and execution never leave the enterprise's own security boundary, making audits easier.
• Private connectivity to VPC backends: Functions can directly access databases and internal services within a VPC without exposing public endpoints.
• Reuse existing AWS commitments: Existing AWS usage commitments can continue to be consumed, avoiding cloud spend being fragmented across multiple vendors.

The last point is especially friendly to finance teams. Many enterprises already have long-term usage agreements with AWS. If function execution can count toward those commitments, there won't be a duplicate procurement problem where "platform fees go to Vercel while compute fees sit outside AWS."

AWS usage commitments refer to long-term consumption agreements that enterprise customers sign with AWS, typically over a 1-to-3-year period, committing to a minimum spend in exchange for discounts or credits. These agreements are especially important for large enterprises, since cloud spend often accounts for a significant portion of IT budgets. Whether new workloads can count toward existing commitments directly affects the "marginal cost" on the books. If a platform puts function execution outside AWS, the enterprise is effectively opening a new spending line outside its commitment, which in the short term could trigger penalties or waste already-purchased credits. BYOC places function execution within the customer's own AWS account, so that compute consumption naturally counts toward existing commitments—a tangible cost optimization signal for procurement and finance teams.

What Control Actually Means

Vercel emphasizes that under BYOC, enterprises retain multiple layers of control over function execution:

IAM permissions are configured by the enterprise itself, meaning which AWS resources functions can access and what roles they can assume are entirely determined by internal security policies.

Network access is likewise autonomous. Combined with VPC private connectivity, traffic between functions and internal backends doesn't need to traverse the public internet.

Resource lifecycle policies also remain in the enterprise's hands. When instances are reclaimed, how they're billed, and how long they're retained can all follow existing operational standards.

This division is essentially finding a balance point between "managed convenience" and "infrastructure sovereignty." Vercel hasn't handed over the entire runtime—it has only pushed the function execution layer down into the customer's account, while the remaining operational burden stays with the platform.

VPC (Virtual Private Cloud) is a logically isolated network environment provided by AWS. Enterprises can define subnets, route tables, security groups, and network ACLs within it, placing databases, caches, internal APIs, and other resources in private subnets that aren't exposed to the public internet. VPC private connectivity typically refers to using VPC Endpoints (interface or gateway endpoints) or PrivateLink so that traffic stays within the AWS backbone network rather than passing through an Internet Gateway or NAT. For industries like finance and healthcare, the value here is twofold: first, it reduces the attack surface since internal services no longer need open inbound rules; second, it meets compliance requirements that data must not leave the enterprise network. Under BYOC, functions run inside the customer's VPC, so they can directly access RDS, ElastiCache, internal microservices, and other resources in the same VPC without detouring through the public internet or building an additional proxy layer.

Who Can Use It and How to Get Started

BYOC is currently available only to Enterprise plans. Vercel recommends that interested teams contact sales or their account team, or consult the official documentation and the complete BYOC guide for onboarding details.

For enterprises already using Vercel but blocked by compliance, this path offers an option that doesn't require migrating frameworks. For enterprises evaluating edge function platforms, BYOC also removes "where code executes" from the evaluation checklist, shifting focus to developer experience and operational costs.

It's worth noting that BYOC doesn't equal full self-hosting. Vercel still controls deployment, routing, and static assets. Teams choosing it are effectively accepting a hybrid responsibility model: core execution stays in their hands, while platform-level convenience is enjoyed as before.

One-line Summary

Vercel launches BYOC on AWS, letting enterprise functions run in their own accounts while Vercel still manages deployment and routing.

Paragraph Summary

Vercel has announced the general availability of Bring Your Own Cloud (BYOC) on AWS, allowing enterprises to deploy and execute Vercel Functions within their own AWS accounts while Vercel continues to handle the deployment pipeline, environment management, request routing, and static asset delivery. The offering primarily targets highly regulated industries like finance, healthcare, and government, addressing the hard requirement that code execution must remain within their own security boundaries. It supports Node.js and Python runtimes, enables private VPC connectivity to internal backends, and lets compute consumption count toward existing AWS usage commitments. Enterprises retain control over IAM permissions, network access, and resource lifecycle policies, creating a hybrid responsibility model where "the control plane belongs to Vercel, the data plane belongs to the enterprise." BYOC is currently available only to Enterprise plans.