Klaviyo shipped 356 internal apps in two weeks on a Vercel-based platform

What happened

According to a case study published on the Vercel blog, Klaviyo opened internal app development to its entire workforce through a citizen developer program, and in the first two weeks 512 of its more than 2,000 employees deployed 356 apps. Of those, 196 were full-stack applications with their own databases. The builders included not just engineers but staff in legal, marketing and HR.

Klaviyo sells a B2C CRM used by more than 200,000 brands. The program runs on K:Forge, an in-house pipeline built on the Vercel SDK, and Klaviyo was among the first customers of Vercel for Enterprise Apps and Agents.

Guardrails rather than restrictions

Opening deployment to a couple of thousand new builders made security the first design question. Klaviyo's Senior Lead AI Architect, Mohamed Ali, describes the approach as engineering "guardrails instead of walls" — keeping every app safe by default rather than broadly limiting what builders can do.

The defaults, per Vercel's account: every app is private and gated behind single sign-on through Okta; sensitive environment variables are set at the team level, out of individual builders' hands; every project inherits Klaviyo's hardened GitHub security configuration; Wiz scans each project and feeds findings into Klaviyo's SIEM; and public deployment is granted case by case, so sales can share external microsites while internal tools stay private. Builders themselves are managed through Klaviyo's identity provider using Vercel's Enterprise Managed Users.

The feature that made internal databases viable, Ali says, was Vercel's Secure Compute, which gives deployments a private network path into Klaviyo's own infrastructure. Apps in the program read from and write to company databases without traffic crossing the public internet — the factor Ali says set Vercel apart when the team evaluated alternatives such as Lovable and Netlify.

K:Forge, from idea to deployed app

K:Forge is designed so any employee can describe an idea in plain language — from Slack, Claude or Cursor — and get back a working app. The pipeline creates a GitHub repository, deploys the app on Vercel, connects data through Secure Compute and applies every security default automatically; the builder never touches infrastructure. Jordan Trundy, Klaviyo's Director of AI and App Engineering, says the path from idea to a live, deployed app takes under three minutes. Changes follow the same route: someone can request an edit mid-thread in Slack, and K:Forge applies it and redeploys.

Klaviyo deliberately built only the pipeline layer, not what sits underneath it. CDN behavior, preview environments, analytics and global scaling are left to Vercel — work Ali argues would otherwise have required hiring a whole department to solve problems already solved elsewhere.

An 80/20 split with the platform team

For larger builds, citizen developers take an app roughly 80 percent of the way, and Klaviyo's platform team handles the remaining 20 percent for fine-tuning and safety review. Ali frames the shift as the platform team going from being the bottleneck to being the finishing touch, and says the company does not worry about sudden scale because the underlying platform absorbs it.

What people build varies widely: microsites that reshape sales processes, full-stack apps for problems too niche for any vendor tool, and custom registration tooling for Klaviyo's flagship K:BOS event, which Vercel says engineering barely touched.

Why it matters

The figures come from a vendor-published case study, so they should be read as promotional rather than independently verified. Even so, the architecture is the interesting part: a paved road where identity, network isolation, secrets management and vulnerability scanning are applied by the platform rather than negotiated project by project. That is what makes it plausible for non-engineers to ship full-stack software against production company data at this volume — and it is a pattern other organisations building internal app platforms can copy regardless of whose infrastructure they run on.

Vercel says one in five Klaviyo employees has now shipped an app, and the team plans to expand the program further while going deeper on Vercel's MCP support and AI Gateway. Ali's own framing is that no playbook for citizen developer programs exists yet, which is why the mechanics described here, more than the headline number, are worth studying.