Why we host business websites on Vercel and Cloudflare, and when we do not

Our default hosting is a static build on Vercel behind Cloudflare. Why those two, what it costs you nothing to leave, and the cases where we choose differently.

3 minread 680words last updated

Our position, stated plainly

What each one does

JobHandled byWhy it matters to you
Building the site from the repository on every changeVercelPublishing is automatic and reproducible; nobody uploads files by hand
Preview deployment for every changeVercelYou see and approve changes on a real link before they go live
Serving the site worldwideBothFast pages for visitors wherever they are
CertificatesBoth, automaticallyNo expiry surprises, no “Not secure” warnings
DNSCloudflareOne place for all records, with an API we can automate and audit
Caching, attack filtering, bot rulesCloudflareJunk traffic never reaches the site; spikes are absorbed
Security headers and redirectsConfigured in the project, enforced at the edgeVersioned with the code, checked on every deploy

Why these two

  • Previews. Every change gets its own link before it goes live. Clients approve on a real page instead of a screenshot, and mistakes are caught before anyone sees them.
  • No servers to maintain. The output is files on a network. Nothing to patch, nothing to overload, nothing to log into at 2 a.m.
  • Global by default. Visitors in Asia and Europe both get the site from nearby. That is a requirement for us, not a nice-to-have.
  • Documented and boring. Both platforms are widely used, well documented, and familiar to any competent developer. Taking over a site hosted this way is not a research project.
  • Control at the edge. Headers, redirects, bot rules and caching are configuration in the project, not tickets to a hosting provider.

When we choose differently

  • Applications with servers and databases. A client portal or a custom system needs a database, background jobs and often a specific region. We pick the platform and region per project, and we can keep data processing in the EU where that is required.
  • Strict data residency. When a client’s compliance rules say data must not leave a specific jurisdiction, we design the hosting around that rule first and the convenience second.
  • Very large media libraries. Thousands of large images or video files are cheaper and better served from dedicated storage with the CDN in front.
  • An existing platform that works. If a client runs a well-maintained setup elsewhere and it performs, we do not move it for the sake of our default.

What this means for you

The names matter less than the properties: automatic builds and previews, no servers to maintain, a global network, certificates that renew themselves, a written answer to who holds which account, and an exit that takes an afternoon. Our default delivers all of them today. If yours does not, the platform is worth a conversation before the next redesign.

Written by the CivSec S.M.A.R.T team

We build and run websites, software and AI systems for businesses. We write about what we see in that work, in plain language, and we update articles when things change.

Last checked . Spotted something outdated? Tell us.

Frequently asked questions

Why not just one provider?

They do different jobs well. Vercel builds and deploys the site from the repository with previews for every change. Cloudflare handles DNS, sits in front for caching and attack filtering, and gives us fine control over headers and routing. Using one for everything is possible; we prefer the stronger tool for each job.

Is this a lock-in?

No, and we check that on purpose. The site is a standard static build in a repository you own. Moving it to another platform is a matter of connecting the repository and changing DNS. We have done it in both directions.

What about hosting in the EU only?

Both providers operate globally, which is what makes sites fast worldwide. For a marketing website that holds no personal data this is rarely an issue. For applications that store customer data we choose where the database and functions run, and we can keep those in the EU. Ask us about your specific case rather than assuming either way.

Do you resell hosting?

No. We take no margin on hosting, which is why we can recommend whatever fits best. The hosting project and the DNS zone are managed in our accounts because that is faster to operate; you can have either in your own name on request, and you can take them back at any time. Your domain stays registered in your company's name throughout.

Sources

  1. Vercel documentation (accessed 2026-09-11)
  2. Cloudflare developer documentation (accessed 2026-09-11)