--- title: Security description: Learn about v0's security practices, threat modeling, and enterprise security features. product: v0 type: reference related: - /docs/enterprise - /docs/account --- # Security v0 is built with security as a fundamental principle, implementing multiple layers of protection to ensure your code and data remain secure throughout the development process. ## General security approach ### Threat model and code validation From a threat model perspective, v0 doesn't take LLM-generated code for granted. We consider all code potentially incorrect or adversarial, implementing robust validation and security measures: * **Code Analysis**: All generated code undergoes security analysis before execution * **Sandboxed Execution**: Code runs in isolated environments to prevent system access * **Input Validation**: Comprehensive validation of all user inputs and generated content * **Adversarial Testing**: Regular security testing against potential attack vectors ### Environment variable security v0 leverages Next.js's strong distinction between server-side and client-side environment variables: * **Server-side tokens**: Environment variables without the `NEXT_PUBLIC_` prefix remain secure on the server * **Client-side tokens**: Only variables prefixed with `NEXT_PUBLIC_` are exposed to the browser * **Automatic Analysis**: v0 analyzes `NEXT_PUBLIC_` usage and warns users about potential security risks * **Smart Refactoring**: The AI can move code to Route Handlers, Server Actions, or other server-side contexts to improve security ### Code execution security When v0 deploys to Vercel, server-side code becomes secure Functions that run in isolated sandboxes: * **Isolated Execution**: Each function runs in its own secure container * **Encrypted Environment**: Environment variables are stored in Vercel's built-in secure vault * **Network Isolation**: Functions have controlled network access * **Resource Limits**: Memory and execution time limits prevent resource exhaustion attacks ## Enterprise security features Enterprise plans include advanced security features designed for organizations with strict compliance and security requirements. ### Data privacy and training * **Opt-out of Data Training**: Enterprise customers can opt out of having their content used for model training * **Data Isolation**: Enterprise data is processed on separate infrastructure * **No Cross-contamination**: Your data never influences models used by other customers ### Access control * **Single Sign-On (SSO)**: SAML-based SSO integration with your existing identity provider * **Role-based Access Control**: Granular permissions for different team members * **Audit Logs**: Comprehensive logging of all user actions for compliance * **Session Management**: Advanced session controls and timeout policies ### Team Security Enterprise teams benefit from enhanced collaboration security: * **Private Workspaces**: Isolated environments for sensitive projects * **Approval Workflows**: Request and manage reviews before deployment * **Version Control**: Track all changes with detailed history * **Secure Sharing**: Control who can access and modify shared projects For more information about team collaboration features, see our [Teams documentation](/docs/teams). ### Compliance and certifications * **SOC 2 Type 2**: v0 is included in Vercel's SOC 2 Type 2 attestation for Security, Confidentiality, and Availability * **GDPR Compliance**: Full compliance with European data protection regulations * **Enterprise Support**: Dedicated support channels for security-related inquiries ## Best practices ### Environment variables * Never expose sensitive tokens with `NEXT_PUBLIC_` prefix * Use Vercel's environment variable management for production deployments * Regularly rotate API keys and secrets * Use different keys for development and production environments ### Team collaboration * Set appropriate access levels for team members * Use private workspaces for sensitive projects * Enable audit logging for compliance requirements * Regularly review team member permissions ## Security reporting If you discover a security vulnerability in v0, please report it to our security team at [security@vercel.com](mailto:security@vercel.com). We take all security reports seriously and will respond promptly. For more information about Vercel's security practices, visit [security.vercel.com](https://security.vercel.com). --- For a semantic overview of all documentation, see [/docs/sitemap.md](/docs/sitemap.md) For an index of all available documentation, see [/docs/llms.txt](/docs/llms.txt) For agent-facing discovery, including API and MCP surfaces, see [/docs/agents.md](/docs/agents.md)