How Klaviyo shipped 356 internal apps in two weeks on Vercel
Source
Susan Aziz
Author
Susan Aziz
Date
Key takeaways · AI-distilled
In this Vercel customer story, 512 of Klaviyo's 2,000+ employees deployed 356 apps in the first two weeks of a citizen-developer program, 196 of them full-stack apps with their own databases, built by teams including legal, marketing, and HR.
Klaviyo chose guardrailsThe checks around a model that block bad inputs and outputs — filters, validators, and permission rules the model itself can't override.Full definition → over restrictions: every app is private and SSO-gated through Okta, sensitive env vars are set at the team level, GitHub security settings are inherited, and Wiz scans every project into its SIEM. Public deployment is granted case by case.
Vercel Secure Compute gives deployments a private network path into Klaviyo's own infrastructure, so apps read and write company databases without traffic crossing the public internet. Klaviyo says this is what made bring-your-own-database workable.
Klaviyo's in-house K:Forge pipeline, built on the Vercel SDK, turns a plain-language request from Slack, Claude, or Cursor into a GitHub repo and a deployed, SSO-gated app in under three minutes. For bigger builds, the platform team finishes the last 20% and reviews safety.
Terms in this piece · Glossary
guardrails — The checks around a model that block bad inputs and outputs — filters, validators, and permission rules the model itself can't override.
Why it matters
Klaviyo's guardrails-over-walls approach, SSO by default, private DB connections, shared security tooling, is a concrete blueprint for letting non-engineers ship real full-stack apps safely at scale.
