Set four v0 controls before anyone puts company data into it: the training default, chat sharing, what the sandbox and its agents can reach, and who can deploy. The v0 service takes prompts, files, screenshots, and environment variables, runs generated code in a sandbox, and can publish it. Each check below names the setting that controls the risk and the plan that offers it.
When you need this
- Product and design staff want v0 for work that touches customer or internal data.
- Your security team asks whether prompts and generated code train models.
- Chats are shared by link and nobody knows who can open them.
- Builders leave v0 on its default Auto permission mode, which lets it run MCP tool calls and unlisted terminal commands without asking.
Checks
Training on your content
Is our content used to train models, and where is that set?
What good looks likeThe v0 FAQ says v0 may use prompts and content to improve its products. It does not train on Enterprise content or on content from customers who opted out in Vercel team settings, and deletion requests go to privacy@vercel.com. The plan comparison lists data opt-out for Business and Enterprise only, and the pricing page says Business opts out of training by default. Since March 31, 2026, Vercel's defaults are opted in on Hobby, opted out on paid Pro teams, and opted out entirely on Enterprise, set under Team Settings, Data Preferences.
Who can open a chat
Can a chat with sensitive context leak through a link?
What good looks likeChat visibility set per chat, from Only people with access to Anyone on the web, and a workspace default set by Owners. Vercel Owners can open every team chat by URL, including private ones, with its full history. Enterprise Owners can turn on Restrict Chat Sharing to remove the link and public options.
What the sandbox and agents can reach
What can v0, and any agent inside its sandbox, run and reach?
What good looks likeEach chat runs in its own Vercel Sandbox VM, separate from production, with a Sandbox Network Policy that defaults to allow-all until a team owner restricts it. One permission mode governs both terminal commands and MCP tool calls, and Auto is the default. In Auto, v0 runs its built-in allow list of read-only commands without asking, decides for itself whether to confirm a command no rule matches, and runs most unmatched MCP calls automatically. New Marketplace integrations default to Ask for Approval, but v0's MCP docs say that label does not override the chat's permission mode. Ask mode confirms every unmatched command and MCP call. Full skips every allow, ask, and deny rule, including the built-in rm -rf deny. Team owners set team-wide rules under Settings, Agent Permissions. Pre-installed agents such as Claude Code can read the project and its environment variables. They are on by default except on Enterprise, where an admin must opt in. A team using v0 for about 200 client apps reported an automatic diagnosis feature editing apps it opened without a prompt.
Who can deploy, and from where
Can a v0 user publish to production on a project they should not touch?
What good looks likev0 roles govern actions in the v0 web app, and Vercel roles govern GitHub and CLI deploys. A v0 Builder can publish every v0-connected project in the team. Vercel Deployment Policies can block v0 as a deployment source for an environment, and GitHub branch protections apply to v0's pull requests.
Identity, audit, and attestations
Does v0 meet the identity and audit requirements we hold other tools to?
What good looks likeSAML SSO, role-based access, and audit logs on Enterprise, with roles provisioned from your identity provider through Directory Sync and Access Groups. Vercel's SOC 2 Type 2 attestation for Security, Confidentiality, and Availability covers v0. Enterprise teams start on v0 models and need an owner to allow custom models from the AI Gateway catalog.
Questions for your security review
- Which plan are builders on today, and does its training default match our data policy?
- Who are the Vercel Owners on the team, given they can open every chat?
- Has a team owner set a Sandbox Network Policy and team deny rules under Agent Permissions?
- Do builders on sensitive projects switch from Auto to Ask mode?
- Should pre-installed agents be enabled for us, given they can read environment variables?
- Is there a written rule on what goes into a prompt?
Red flags
- Customer data in prompts on a plan without training opt-out.
- Full permission mode on projects that hold production credentials.
- Sandbox network left at allow-all on projects connected to internal services.
- v0 Builder granted to everyone while v0 is connected to production projects.
Products in this piece
Sources
- Official documentation
- 13
- Public source
- 1
- v0 docs: FAQs
- v0 docs: Pricing
- v0 pricing
- Vercel changelog: Updates to Terms of Service, March 2026
- v0 docs: Teams
- v0 docs: Enterprise
- v0 docs: Security
- v0 docs: Sandbox
- v0 docs: Terminal commands
- v0 docs: MCP Integrations
- v0 docs: Pre-installed Agents
- v0 docs: Choosing models
- Vercel docs: Deployment policies
- DevGlyphX, Vercel Community: auto-diagnosis editing code without consent (Mar 18, 2026)