​
Overview

LowerPlane connects to Vercel using a REST API access token with read-only access. Once connected, LowerPlane syncs your Vercel team members so they appear in Access Reviews — helping you verify that only current employees have access, that admins (Owners) are appropriate, and that offboarded employees have been removed. It also reads each project’s security posture — custom-domain SSL, environment-variable encryption, and deployment protection — so those checks run automatically too.

​
What LowerPlane Collects

DataWhat LowerPlane Collects
Team membersName, email, and role of each member of your team(s); Owners are flagged as admins
Access statusWhether each member maps to a current employee (for offboarding)
Project security posturePer project: custom-domain SSL status, whether any Production env var is plaintext, and whether deployment protection is enabled
LowerPlane reads member names/roles and project configuration metadata only — custom-domain names and their verification status, environment-variable types (never their values), and the project’s deployment-protection settings. It never reads your source code, deployment content, or secret values.

​
Prerequisites

You need to be a team Owner or Admin to create an access token.

​
Step 1: Create an Access Token

  1. In Vercel, open Settings → Tokens (Account Settings)
  2. Click Create Token
  3. Enter a name, for example:
lowerplane-access-review
  1. Under Scope, select the team you want reviewed (or Full Account)
  2. Choose an expiration (or “No Expiration”)
  3. Click Create
  4. Copy the token now — it is shown only once

​
Step 2 (optional): Find your Team ID

You can leave the Team ID blank — LowerPlane auto-detects every team your token can access. If you want to scope to one team, find its ID under Settings → General (or the URL), e.g. team_….

​
Step 3: Connect in LowerPlane

  1. Go to Integrations in LowerPlane
  2. Find Vercel and click Connect
  3. Paste the Access Token (and optionally the Team ID)
  4. Click Connect
LowerPlane validates the token and starts the first sync automatically.

​
Automated Checks

When Vercel is connected, LowerPlane automatically runs: Access review
  • Includes Vercel members in user access reviews for SOC 2 (CC6.1/CC6.2) and ISO 27001 (A.5.16/A.5.18)
  • Flags Vercel accounts belonging to offboarded employees so access can be revoked
  • Confirms every account is traceable to a named individual, with Owner accounts flagged as admins
Project security (per project)
  • SSL on custom domains — every custom domain is verified (Vercel then serves it over HTTPS)
  • Environment variables encrypted — no Production variable is stored as plaintext (secrets use the Sensitive type)
  • Deployment protection enabled — deployments are restricted via Vercel Authentication, Password Protection, or Trusted IPs

​
FAQ

Which members are collected? Every member of the team(s) your token can access. A member who belongs to several teams appears once, keeping their highest role. Does LowerPlane read my projects or deployments? It reads project configuration metadata only — custom-domain names and their verification status, environment-variable types (never their values), and deployment-protection settings. It never reads your source code, deployment output, or secret values. Is MFA checked? No. Vercel’s members API does not expose per-user MFA status, so LowerPlane cannot verify it for Vercel.