# Vercel onboarding document

- Source: https://support.icompaas.com/support/solutions/articles/a_1791547982665355-vercel-onboarding-document
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Onboarding Process](https://support.icompaas.com/support/solutions/folders/f_179154743186642)
- Last updated: 2026-10-13
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Vercel Integration with iCompaas

1\. What are we integrating, and what's our goal?

-   Suppose the customer hosts their applications on Vercel.
-   iCompaas connects to their Vercel Team with read-only access. It discovers the team, projects, domains and deployments, and evaluates the security and compliance controls.
-   Vercel connects through OAuth. The customer doesn't create API keys or paste tokens. They sign in to Vercel and approve access.

2\. Prerequisites

-   A Vercel Team. Personal accounts can't be connected.
-   A Vercel user who is allowed to install integrations on that Team.
-   At least one project in the Team.  
    
-   Integration was installed with "All projects" selected, not "Specific projects"
-   Signed in to iCompaas in the same browser, with pop-ups allowed.

3\. The Complete Onboarding Flow

-   Let's say the customer is Zato, and Zato runs its applications on a Vercel Team.
-   In iCompaas, the customer goes to Onboarding → Application onboarding, selects Vercel and clicks "Connect".
-   In the dialog, they can enter a connection name, such as "Vercel production". Then they click "Continue".
-   A Vercel pop-up opens. The customer signs in to Vercel and selects the Team to connect.
-   Under project access, they choose "All Projects". Access to only some projects isn't supported.
-   They review the read-only permissions and confirm the installation.
-   Vercel sends the browser back to iCompaas. iCompaas exchanges the authorization code for an access token and securely saves the connection with the Vercel Team ID and Configuration ID.
-   The pop-up closes, and iCompaas shows "Vercel connected."
-   iCompaas then validates the connection. It checks that the Team can be reached, the installation is complete, all projects are included, and the Team has at least one project.
-   Once validation passes, the connection is marked valid and the first scan starts automatically.

4\. What iCompaas Checks

-   Team: SAML SSO enabled and enforced, directory sync, least-privilege member roles, no stale invitations.
-   Projects: deployment protection (including production), password protection, Git fork protection, skew protection, directory listing disabled, system environment variables not exposed automatically.
-   Deployments: production deployments use a stable target.
-   Domains: verified, valid SSL certificate, correct DNS configuration.

5\. Troubleshooting

-   "Your browser blocked the connect popup": allow pop-ups for iCompaas and click Connect again.
-   "This Vercel account is not part of a Team": install again and select a Vercel Team.
-   "Please sign in to iCompaas first": sign in to iCompaas in the same browser, then reconnect.
-   Connection shows as invalid: in Vercel, set the integration's project access to All Projects, or add a project to the Team. Then reconnect.
-   Same Team connected again: iCompaas refreshes that Team's existing connection and doesn't create a duplicate.

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.