02
Three build options, graded on security
Same framework and same CMS in all three. What changes is the security envelope around them and what it costs. Security rows first, because that is the deciding axis.
| Capability | 1 · Standard | 2 · Hardened (recommended) | 3 · Compliance-grade |
|---|---|---|---|
Nonce CSP, no unsafe-inline |
YesComes from the build step, not the plan tier. | YesIdentical. This is not something you can pay more for. | YesIdentical. |
| Full header set + SRI | YesIn vercel.json and middleware, version controlled. |
YesSame, plus header regression tests in CI. | YesSame. |
| WAF | Vercel WAF onlyIncluded on Pro: 40 custom rules, 100 IP blocks, bot management, DDoS. No OWASP managed ruleset. | Vercel + Cloudflare ProAdds the OWASP core managed ruleset and rate limiting for $240/yr — the ruleset Vercel itself gates behind Enterprise. | Cloudflare BusinessAdds PCI DSS 4.0 compliance posture and a 100% uptime SLA. $2,400/yr. |
| Certificate control | Platform-managedAutomatic, valid, renewed — but the CA is not your choice. | Advanced Certificate ManagerChoose the CA and validity period. $120/yr. Answers a reviewer who asks who controls the certificate. | Custom uploadBring your own certificate. Requires Cloudflare Enterprise. |
| Origin lock — edge cannot be bypassed | PartialVercel deployment protection covers preview URLs. | YesCloudflare authenticated origin pull, so only the edge can reach the origin. A WAF that cannot be routed around. | YesPlus Trusted IPs on the Vercel side. |
| Gated staging | SSO protectionOn by default for previews; team accounts only. | SSO + Cloudflare AccessZero Trust free tier covers 50 users at $0 — client reviewers get gated access without Vercel seats. | SSO + SAMLDirectory-synced via SCIM. |
| Signed BAA | NoSOC 2 and HIPAA attestation reports available; no BAA on self-serve tiers. | NoSame. Adequate if the site handles no PHI — which sdata.us does not. | YesThe only reason to choose this tier. Requires Vercel Enterprise. |
| Audit trail on content changes | 90 daysActivity feed and draft history on Sanity Growth. | 90 daysSame. Git history covers every code and header change permanently. | Full audit trailHistory API and 365-day retention on Sanity Enterprise. |
| Uptime SLA | None contractualBest-effort on self-serve tiers. | Cloudflare edge SLANo Vercel SLA. Acceptable for a marketing site; state it explicitly to the reviewer. | 99.99%Vercel Enterprise plus Cloudflare Business. |
| Annual software cost | $2,052Fully self-serve, cancellable monthly. | $2,172$120/yr more than Standard. The cheapest meaningful security upgrade on this page. | Quote-basedCloudflare Business alone is $2,400/yr; both Enterprise tiers are sales-led. |
| Time to procure | Same dayCredit card. | Same dayCredit card. | WeeksTwo sales cycles and a legal review. |
Why Hardened, and not Standard
The gap between them is $120 a year and it buys the three controls a security reviewer actually asks about: the OWASP managed ruleset, certificate authority control, and an origin that cannot be bypassed. Standard is defensible; Hardened is the one that survives a questionnaire without a follow-up call.
Compliance-grade is not a better version of Hardened — it is the same build wrapped in contracts. Choose it only if the answer to the BAA question on the Open questions page is yes.