Klaviyo Ships 356 Internal Apps in Two Weeks Using Vercel Platform

Klaviyo launched a citizen developer program on Vercel that enabled 512 employees to deploy 356 internal apps within the first two weeks. Of these, 196 were full-stack applications with their own databases, built by teams across legal, marketing, and HR. The initiative allows employees to go from idea to live app in 3 minutes using a custom in-house pipeline called K:Forge.

Security and Architecture

To support this scale, Klaviyo implemented strict security guardrails rather than broad restrictions. Every app is SSO-gated through Okta and private by default, with no traffic crossing the public internet. Key security measures include:

• Secure Compute: Provides a private network path for apps to read and write to Klaviyo's databases.
• Enterprise Managed Users: Manages builder identities through Klaviyo’s identity provider.
• Automated Scanning: Wiz scans every project, feeding findings into Klaviyo's SIEM.
• Inherited Security: Projects inherit Klaviyo’s hardened GitHub security settings.

The K:Forge Pipeline

K:Forge is an internal tool built on the Vercel SDK that automates the entire deployment lifecycle. Users can describe an app in plain language via Slack, Claude, or Cursor, and K:Forge handles the rest:

• Creates a GitHub repository.
• Deploys the app on Vercel.
• Connects data via Secure Compute.
• Applies all security defaults automatically.

For complex builds, citizen developers complete about 80% of the work, while the platform team handles the final 20% for fine-tuning and safety reviews. This shift removed the engineering team as a bottleneck, allowing them to focus on high-value tasks rather than infrastructure management.