Client onboarding checklist¶
Welcome to BCP Portal. This is your first-day walkthrough — what to connect, what already works out of the box, and where to look for each thing. Give yourself 20-30 minutes.
1. Get in¶
You should have received an invite from the ByteCode team. Sign in at bcp.bytecode.team with Google or Microsoft (your corporate account — personal Gmail/Outlook is blocked). Details: Access and Login.
Whoever creates the organization first becomes Admin automatically. Others can be added later.
2. What's already done for you¶
You don't need to configure any of the below — the ByteCode team sets them up before onboarding.
- Policies — a full library of company security policies (ISO 27001 / SOC 2 / GDPR flavored to your org) sits ready in the Policies tab. Your admins publish new versions when we tell you a draft is ready; everyone reads them on the portal.
- Monitoring reports — monthly SOC write-ups + a task board syncing our progress on your engagement. Each month has its own page: tasks + reports + full-year Gantt chart.
- Detection services — HIBP breach lookups on your domain, Pastebin monitoring, social-media impersonation checks. Running quietly in the background.
3. What you connect on your side¶
These are optional — but each one meaningfully expands what the portal can protect for you.
GitHub / GitLab code scanning¶
Scans your repositories for exposed secrets (tokens, API keys, credentials, private keys). One click via OAuth, no personal access tokens.
Tip
If your source lives across multiple orgs / groups (staging, prod, contractor sandbox) — connect them all. The scanner picks up any repo you have read access to.
Slack notifications¶
Wire the portal to your Slack so new critical findings arrive as messages instead of dashboards you have to check. Configure which channels, which severities, which sources. Details: Slack Integration.
Personal accounts¶
Every employee should have HIBP running on their work email (checked at login). Optional but recommended: connect personal GitHub via the same OAuth flow if they push code with a personal identity.
4. Invite your team¶
Company profile → Add Team Member. Enter their email and pick a role from the dropdown:
| Role | Give it to… |
|---|---|
| Admin | Security lead, IT lead (1-3 people) |
| Analyst | SOC team, incident responders — investigate and resolve alerts |
| Viewer | Auditors, contractors — read-only observers |
| Employee | Everyone else — sees only their own findings + Policies |
Full matrix in Roles and Permissions. Rule of thumb: default to Employee, elevate on request.
New users sign in with their own Google/Microsoft account — no password rollout on your side.
5. Where to look for what¶
| I want to… | Go to… |
|---|---|
| See the overall security posture | Dashboard |
| Read / accept a company policy | Policies |
| Check the SOC's monthly work | Monitoring |
| Investigate a specific alert | Dashboard → Alerts or Detection Services |
| Get a report for the board | Reports → New Custom Report |
| Set up recurring reports to Slack | Reports → Scheduled Reports |
| Take security training | Your Studies (edu portal) |
| Add / remove team members | Company profile |
| Change my role or profile | Settings → Profile |
6. First-week homework¶
- Publish v1 of the initial policies your ByteCode contact has drafted (Admin only).
- Ask everyone to log in once and accept the policies.
- Connect GitHub/GitLab (Admin).
- Configure Slack for at least critical alerts (Admin).
- Kick your team to Your Studies — assign the first training module.
Getting help¶
- Docs: you're on it — docs.bytecode.team.
- Slack: ping your dedicated ByteCode channel (created during onboarding).
- Email:
partnership@bytecode.teamfor anything that doesn't fit Slack. - Live sync: you have monthly SOC syncs with your ByteCode contact — that's the place to raise anything strategic.
Welcome aboard 🚀