> ## Documentation Index
> Fetch the complete documentation index at: https://docs.keldyn.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Vercel

> Connect Vercel to Keldyn so deployment, environment-separation, configuration, firewall/TLS, and logging evidence for your hosting stays current automatically.

The Vercel integration connects your Vercel team to Keldyn's continuous-evidence engine. Once connected, Keldyn reads your deployment, environment, configuration, edge-security (firewall/TLS), and logging posture on a schedule and turns it into live evidence for the related controls — so you don't have to re-check and re-attach that evidence by hand.

<Note>
  Integrations and automated evidence are typically managed by workspace admins.
  See [Evidence & audits](/evidence-and-audits) for how automated evidence fits
  alongside manual evidence.
</Note>

## What it's used for

Keldyn uses the data it reads from Vercel to keep the evidence for your hosting and deployment controls current. Each nightly refresh updates the evidence and the freshness status shown on the integration's **Controls covered** table.

The integration contributes evidence to these ISO 27001 controls:

| Control                                                                  | Topic                                   | Coverage |
| ------------------------------------------------------------------------ | --------------------------------------- | -------- |
| **A.8.19** — Installation of software on operational systems             | Production deployment trail             | Full     |
| **A.8.31** — Separation of development, test and production environments | Environment isolation                   | Full     |
| **A.8.9** — Configuration management                                     | Enforced project configuration baseline | Full     |
| **A.8.20** — Networks security                                           | Web Application Firewall (WAF) posture  | Full     |
| **A.8.21** — Security of network services                                | TLS/HTTPS enforcement on served domains | Full     |
| **A.8.15** — Logging                                                     | Log drains exporting runtime logs       | Full     |
| **A.8.32** — Change management                                           | Deployment authorization trail          | Partial  |
| **A.8.16** — Monitoring activities                                       | Log export feeding monitoring           | Partial  |

<Info>
  **Full** coverage means the data is the artifact the control asks for.
  **Partial** coverage means the data usefully contributes but does not, on its
  own, replace everything the control requires (for example, A.8.32 also needs
  change authorization, impact assessment, and rollback records that live in your
  change-management process). Keldyn labels partial coverage in the
  auto-generated evidence so it isn't mistaken for complete coverage.
</Info>

## Before you begin

<Steps>
  <Step title="Install as a Vercel team admin">
    You connect by installing the Keldyn integration on your Vercel team. This
    is a **connect once** flow — after install, Keldyn refreshes evidence on its
    own with no further action from you. Installing requires permission to add
    integrations to the team.
  </Step>

  <Step title="Know which features your plan includes">
    The **Vercel Firewall (WAF)** and **Log Drains** are available on higher
    Vercel plans (Pro/Enterprise). On plans that don't include them, the
    firewall and logging controls show **Access required** instead of failing —
    the rest of the evidence still refreshes normally.
  </Step>

  <Step title="Keldyn only ever reads">
    The integration is granted read access only. Keldyn never deploys, changes
    configuration, or writes to your Vercel team.
  </Step>
</Steps>

## Set up the integration

<Steps>
  <Step title="Open Integrations">
    In the Keldyn web app, go to **Integrations** and select **Vercel**.
  </Step>

  <Step title="Connect">
    Select **Connect**. You're redirected to Vercel to install the Keldyn
    integration on your team. Review the requested read access and approve it;
    Vercel returns you to Keldyn once the install completes.
  </Step>

  <Step title="Run the first sync">
    After connecting, select **Sync now** to pull evidence immediately, or wait
    for the next scheduled refresh. The **Controls covered** and **Evidence
    sources** tables then show what was collected and how fresh it is.
  </Step>
</Steps>

<Tip>
  From an integration's detail page, **Controls covered** shows, per control,
  whether Vercel is actively feeding it and whether the control is satisfied.
  **Evidence sources** shows each data fetch, the controls it covers, and its
  freshness.
</Tip>

## What data Keldyn collects and why

Keldyn requests **read-only** access and never writes to your Vercel team. It collects only the data below, and only to build control evidence.

| Data collected                     | What it contains                                                                                                                            | Why Keldyn collects it                                                                                                      | Refresh |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | ------- |
| **Production deployments**         | Recent production deployments per project: the source commit and branch, who triggered them, the ready/error state, and when they went live | Shows only authorized, tracked releases reach production — the core evidence for software installation and the change trail | Daily   |
| **Environment inventory**          | The environments defined per project — production, preview, development, and any custom environments                                        | Evidences that production is separated from non-production environments                                                     | Daily   |
| **Project configuration**          | Each project's security-relevant settings: deployment protection (password/SSO), trusted IPs, and Git fork protection                       | Evidences the enforced configuration baseline                                                                               | Daily   |
| **Web Application Firewall (WAF)** | WAF enablement, managed rulesets, and custom rules per project                                                                              | Evidences that inbound traffic is filtered — networks security                                                              | Daily   |
| **Domain TLS/HTTPS**               | The served domains per project and whether each enforces HTTPS/TLS                                                                          | Evidences that traffic is served only over encrypted connections — security of network services                             | Daily   |
| **Log drains**                     | The configured log drains, their delivery format, and their sources                                                                         | Evidences that runtime logs are produced and exported/retained off-platform                                                 | Daily   |

### Authentication

Keldyn authenticates as a **Vercel integration installation**. Installing the integration returns a long-lived, team-scoped access token that Keldyn stores encrypted, so there is no password to rotate and no repeated re-authorization. The integration's read scopes are configured on the integration itself in Vercel. Removing the integration in Vercel, or selecting **Disconnect** in Keldyn, immediately severs access.

## Troubleshooting "Access required"

A control shows **Access required** when the connected team can't read the
underlying data — most often because the feature isn't included in your Vercel
plan. For example:

* The **Vercel Firewall (WAF)** is required for the networks-security control.
* **Log Drains** are required for the logging control.

Upgrade the Vercel plan to include the feature, or enable it for the team, then
run **Sync now** again. Controls not affected by the gap keep refreshing
normally.

## Keeping evidence current

Keldyn refreshes Vercel evidence automatically each day. Evidence that hasn't
refreshed within its expected cadence is marked **stale**, and failed pulls are
marked **failed** so you can spot gaps. You can also trigger an immediate refresh
at any time with **Sync now**.

## Next steps

<Card title="Evidence & audits" icon="clipboard-check" href="/evidence-and-audits" arrow={true}>
  Learn how automated integration evidence works alongside manual evidence and
  audits.
</Card>