Vercel and PostHog are winning among YC's Newest Founders

Insurgents are winning nearly every layer of the S26 stack. Almost none of them are agentic.

We’re at an interesting time in tech. Almost every software solution has agentic competitors looking to disrupt it. We were curious how much this is impacting the tech stack the newest companies are selecting. To understand, we took a look at the 234 companies in Y Combinator’s Summer 2026 batch.

The short answer: the batch is buying insurgents aggressively. Vercel over AWS. Resend over SendGrid. PostHog over Google Analytics. Supabase over a managed Postgres. The incumbent loses almost every layer.

They’re just not buying agentic insurgents. Of every layer we could measure, exactly one has an AI-native product winning share, and it isn’t one you’d guess.

The main driver of buying decisions is implementation speed and completeness of solution.

Where this data comes from

Riveter collected all 234 companies in the batch, then probed each company on September 9, 2026. The Riveter tech stack probes and enrichments found privacy policies, subprocessor pages, and subdomains for each company.

We found 831 live hostnames and pulled from four sources: DNS records and HTTP response headers, scripts and network requests on live pages, privacy policies and terms of service, and trust pages with their subprocessor lists. Riveter ran the collection. It took 19 minutes.

We also split every detection by which hostname it was found on. A company’s marketing site and its product surface are different things, and they often run on different infrastructure.

Two limits worth knowing. Cloudflare sits in front of other providers, so some share of what reads as Cloudflare is really AWS or Vercel behind a proxy. And some layers are only visible when a company chooses to disclose them, so those figures are the share of companies where we could establish an answer, not the share of the batch. We say so and give the denominator where it applies.

The biggest insurgent win in the batch is not an AI company

Vercel owns the marketing site landscape outright. 118 companies serve their marketing site from it. 28 serve it from AWS, Google Cloud or Azure.

The product surface is a different picture. Of the 99 companies running something behind a login, Vercel hosts 38. The big three clouds host 38. A tie.

Looking only at the 96 companies where we can see both surfaces, Vercel goes from 59% of marketing sites to 40% of product surfaces. The big three go from 16% to 36%. Twelve companies run Vercel for marketing and a real cloud for the product, Rex and Manifold among them.

Google Cloud is the sharpest case. It appears on 3 marketing sites and 13 product surfaces. Nearly invisible at the front door, and a real choice in the back.

This isn’t founders not knowing the alternative. 37 companies in the batch have a founder who worked at Google, Amazon, AWS or Microsoft. 54% of them ship on Vercel. Not one of the 11 companies with an ex-Google founder runs on Google Cloud.

The reason is time. Standing up a proper cloud environment is days of work that produces nothing a customer can see. At three months old with two people, that time doesn’t exist. Vercel gets the product in front of users faster, and at this stage that beats every other consideration, including cost.

What you’re watching is a maturity curve compressed into a single batch. The marketing site goes up on Vercel in an afternoon. By the time there’s a real product behind a login, a third of those companies have moved it somewhere else.

Next.js follows the same logic at 146 companies, 62% of the batch.

The pattern repeats, and it has nothing to do with AI

Databases. Among the 44 companies where we could establish one, Supabase has 26. Neon has 4, PlanetScale has 2.

Supabase isn’t winning as only a database. 9 of those 26 companies use it for auth as well. It’s winning as a bundle, which is the whole point. One thing to set up, two problems solved, and a founder gets back to building.

Transactional email. Resend has 30 of the 66 we could identify. Amazon SES has 13. SendGrid, Postmark and Mailgun have 2 each.

Analytics. PostHog appears at 75 of the 118 companies where analytics was visible. Google Analytics has 17, Amplitude 4, Mixpanel 2. Sentry handles error monitoring at 43. Datadog is at 11.

Payments. Stripe, 59 of 67.

Every one of those is a younger company beating an older one. None of them is agentic. Resend beat SendGrid by being better at sending email, not by replacing it with an agent. Supabase won on setup time and scope. PostHog won on a free tier and a product developers like.

The batch is not conservative. It is extremely willing to drop an incumbent. It just isn’t picking anything exclusively for being AI-native.

The exception is compliance

95 companies, 41% of the batch, already publish a trust page. Nine claim a completed SOC 2 Type II. Several of those have two people. Graphify Labs has one.

Vanta leads the vendors with 12. Comp AI has 7, Oneleet has 7, Sprinto has 3.

That’s the only layer we measured where the newer entrants together outnumber the leader. It’s worth noting Vanta is itself a recent insurgent that took this category from audit consultancies, so this is one generation of challenger meeting the next.

Two things are driving the early adoption. SOC 2 gates enterprise deals, and it gates them harder the more sensitive the data. And it’s much easier to pass early. Fewer systems, fewer employees, fewer policies to write and enforce. At three months old it’s the cheapest it will ever be.

Why that layer and not the others

Compliance work is evidence collection, policy review and control monitoring. It’s document-shaped drudgery, which is what agents are actually good at. A CDN is not that. Neither is a Postgres instance.

Which points at the more useful conclusion. Founders aren’t shopping for AI. They’re shopping for a complete product that does the job fast and without fuss.

Comp AI isn’t winning because it’s AI-native. It’s winning because being AI-native makes it a better compliance product specifically. Where being agentic makes the product better, founders buy it. Where it doesn’t, they buy whatever is better. Not every solution needs to be an AI solution, and it may just have AI elements rather than being built around them.

If any group were going to buy AI for its own sake, it would be this one. They don’t.

Where the agentic tools actually are

34 companies use any AI-native infrastructure tool. Four use three or more. The top five account for 37% of all adoptions, and one company, LATO, accounts for ten of them on a team of two.

That’s not an emerging pattern. It’s a handful of enthusiasts. LATO runs Daytona, E2B, Exa, Firecrawl, Clay and Pydantic Logfire, and it still sits on Vercel, Supabase, WorkOS, Railway and Google Workspace underneath. Even the most agentic company in the batch has a conventional foundation.

One category is genuinely forming. Voice has ElevenLabs at 3 companies, Deepgram at 2 and LiveKit at 1. Small numbers, but it’s the only AI-native category besides the model providers with more than one serious player in it.

There’s no reason to choose one model provider

Of the 44 companies where a model provider was identifiable, 22 name both OpenAI and Anthropic. Among companies publishing a formal subprocessor list, half name both, and of those naming one, Anthropic leads 7 to 3. Treat it as a disclosure sample, not market share.

The split is the point. There’s no reason to commit to a single provider. Different models are good at different things, and once that’s working you optimize for cost and speed per task. Cheap fast model for classification, stronger model for the reasoning step.

What we’re looking at next

Is Vercel’s early dominance a fact about S26, or a fact about building software in 2026? Does a stack calcify around whatever got picked in month three, or do founders keep migrating as the product matures?

We already see the first step of that migration inside this batch. The front door stays on Vercel while the product surface drifts toward the big clouds. If that’s a maturity curve rather than a generational preference, older batches should show it further along.

We’ll be running the same probe against them to find out.

---

Data collected September 9, 2026 across all 234 Y Combinator Summer 2026 companies using Riveter.