> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/getting-started/getting-started.md).

# Onboarding

After your Nullify tenant is provisioned, complete the onboarding flow to connect your codebases, connectors, cloud accounts, and configure how Nullify understands your business context.

## Onboarding Flow

The onboarding wizard guides you through a sequence of configuration steps. Each section teaches Nullify about your environment so it can triage findings, validate exploitability, and route work to the right teams.

### 1. Welcome

![Welcome Screen](/files/rNUZ3NMzUcLD2GyIEbab)

Start the onboarding process. Onboarding takes less than an hour for most organizations.

### 2. Connect Codebases

![Connect Codebases](/files/9d5EIyam5GCMCFCrfGGV)

Connect Nullify to your source control:

* **GitHub** - Install the Nullify GitHub App
* **Bitbucket** - Install the Nullify Bitbucket App
* **GitLab** - Connect via OAuth ([GitLab install guide](/enterprise-tier/gitlab-install.md))

Nullify needs repository access to review code, open pull requests, and map ownership from CODEOWNERS files.

### 3. Connect Workflow Tools

![Connect Workflow Tools](/files/lk2jYH5gYd1sSKHY49V5)

Connect collaboration and assignment tools:

* **Jira** - Auto-assign tickets, track remediation, create issues
* **Compass** - Map services to teams for improved ownership
* **Slack** - Send notifications, escalate findings, collaborate on triage
* **Microsoft Teams** - Alternative to Slack for notifications

These connectors let Nullify work in the tools your team already uses, so much of the day-to-day review and remediation happens where you already are. The Nullify dashboard remains available for configuration, reporting, and deeper investigation.

### 4. Integrate Cloud (AWS Setup)

![Cloud Integration - Setup](/files/rsmRXx02z3Vjk18IeDz4)

Configure cloud access for continuous audits. Nullify provides CloudFormation templates with least-privilege IAM roles.

Copy the External ID, Nullify Role ARN, S3 Bucket name, and KMS Key ARN to use in your AWS account.

### 4b. Integrate Cloud (GCP Setup)

For Google Cloud Platform, Nullify uses OIDC + Workload Identity Federation — no service account keys, no long-lived secrets, revoke any time with `terraform destroy`. The trust is pinned per-tenant so even a compromised Nullify signing key cannot cross tenants.

Copy your **Nullify Tenant ID** from the trust setup tab. The **OIDC Issuer URL** is a fixed Nullify constant — `https://gcp.nullify.ai` — and is the same for every tenant, so there is no per-tenant value to copy. Pass the tenant ID and issuer URL to the [Nullify Cloud Connector Terraform module](https://github.com/Nullify-Platform/nullify-cloud-connector/tree/main/gcp-integration-setup/terraform). Paste the module's `service_account_email` and `workload_identity_provider` outputs back into the console, then click Save.

See the [GCP Connector Setup Guide](/connectors/gcp/configuration.md) for prerequisites, scope choices (org / folder / projects), and troubleshooting.

### 5. Integrate Cloud (Add Accounts)

![Cloud Integration - Add Accounts](/files/EknbbufFarXEXDx9q4vo)

Add AWS account IDs (12 digits or comma-separated list) — or GCP project IDs in the GCP tab — to enable cloud audits across your infrastructure.

Nullify continuously monitors deployed resources for misconfigurations and maps findings back to repositories.

### 6. Bug Bounty Program

![Bug Bounty Configuration](/files/nvQVKc96XqDi6BgMu4ll)

Configure bug bounty program integration:

* **HackerOne** - Import vulnerability disclosures
* **BugCrowd** - Sync external findings
* **Website URL** - Link to your bounty program
* **Document Based** - Upload scope documents
* **No Program** - Skip if not applicable

Nullify correlates external bug bounty findings with internal code reviews and pentests.

### 7. Configure Asset Scope

![Asset Scope Configuration](/files/2rCazIKOwbg9p4jcIS9u)

Define attack surface monitoring scope:

* **In-Scope Assets** - Domains, IPs, and CIDR ranges Nullify should monitor
* **Excluded Assets** - Assets to ignore (third-party services, partner networks)

Nullify uses this for attack surface discovery, continuous monitoring, and vulnerability assessment prioritization.

### 8. Configure Credentials

![Credentials Configuration](/files/xRrsSgnPTgypjo5TktBC)

Add authentication credentials for deeper pentesting:

* Test credentials for comprehensive authenticated testing
* Service account credentials for API testing
* Admin/user credentials for authorization testing

Nullify validates credentials are not leaked and uses them for authenticated vulnerability validation.

### 9. Configure Applications

![Applications Configuration](/files/XFL9hHRJ2SefKeRaGvES)

Set up applications for continuous pentesting:

* Add application names and URLs
* Associate user credentials for authenticated testing
* Define which apps receive continuous penetration testing

Nullify pentests these applications continuously, replaying authenticated flows and chaining exploits.

### 10. Set SLAs

![SLA Configuration](/files/9AjNCnbiKuHpuA3nf5pe)

Define remediation timelines by priority:

* **Urgent** - Immediate attention (e.g., 7 days)
* **Important** - High-priority issues (e.g., 21 days)
* **Medium** - Standard remediation timelines (e.g., 60 days)

Nullify uses these SLAs to prioritize work and escalate overdue findings.

### 11. Memory Vault

![Memory Vault](/files/bzQwO8do8pbrVsFr7rWB)

Upload organizational context documents:

* Architecture diagrams
* Incident reports
* Penetration test reports
* Vulnerability management documentation

Nullify learns from these documents to better understand your risk profile and prioritize findings.

### 12-17. Onboarding Questionnaire

Nullify asks about your organization to understand business context:

**General Information** ([Screenshot](https://github.com/Nullify-Platform/nullify/tree/main/public-docs/.gitbook/assets/onboarding/12-questionnaire-general-company-info.png))

* Company name
* Core products and services

**Sensitive Data Types** ([Screenshot](https://github.com/Nullify-Platform/nullify/tree/main/public-docs/.gitbook/assets/onboarding/13-questionnaire-sensitive-data-types.png))

* PII, PHI, Payment Information, Financial Information, Trade Secrets, Government Data
* Custom data classifications

**Compliance Requirements** ([Screenshot](https://github.com/Nullify-Platform/nullify/tree/main/public-docs/.gitbook/assets/onboarding/14-questionnaire-compliance-requirements.png))

* PCI DSS, HIPAA, SOC1, GDPR, CCPA, DORA, FISMA
* Custom compliance frameworks

**Impact Scenarios** ([Screenshot](https://github.com/Nullify-Platform/nullify/tree/main/public-docs/.gitbook/assets/onboarding/15-questionnaire-impact-scenarios.png))

* Sensitive Data Leaked, Data Loss/Deletion, Tampered Data, System Interruption
* Compromised User Accounts, Unintended User Behavior

**Threat Actors** ([Screenshot](https://github.com/Nullify-Platform/nullify/tree/main/public-docs/.gitbook/assets/onboarding/16-questionnaire-threat-actors.png))

* State Actors, Hacktivists, Insider Threats
* Custom threat profiles

**Additional Context** ([Screenshot](https://github.com/Nullify-Platform/nullify/tree/main/public-docs/.gitbook/assets/onboarding/17-additional-information-optional.png))

* Any other information Nullify should know about your application security posture

### 18. Review and Submit

![Ready to Finish](/files/CDJDAdxxDxmu9auV8F8Q)

Review all configuration before submitting. Once submitted, Nullify's AI agent begins processing your environment.

### 19. Onboarding Complete

![Onboarding Complete](/files/1wXlPYAjVGGPcfzTDbnN)

Nullify is now learning your environment. The platform will:

* Index repositories and build context
* Map team ownership from CODEOWNERS and service metadata
* Begin continuous code reviews on new commits
* Start cloud audits of deployed resources
* Initialize threat intelligence monitoring

You can edit the onboarding questionnaire anytime to refine Nullify's understanding.

## What Happens Next

After onboarding, Nullify operates autonomously:

1. **Context Collection** - Nullify builds a knowledge graph of your services, dependencies, infrastructure, and teams
2. **Continuous Assessment** - Code reviews run on every commit, cloud audits monitor infrastructure changes, pentests validate findings
3. **Triage & Validation** - Findings are ranked by exploitability with evidence, not just theoretical risk
4. **Remediation** - Nullify drafts fixes, opens PRs, keeps them green through CI and review feedback, and assigns the right reviewer to merge
5. **Learning** - Every interaction refines Nullify's understanding of your risk tolerance and business priorities

Much of the work surfaces directly in the tools your team already uses — your source control (GitHub, GitLab, Bitbucket, and Azure DevOps), Jira, Slack, Microsoft Teams, and your cloud accounts (AWS and GCP) — while the Nullify dashboard remains available for configuration, reporting, and deeper investigation.

## Need Help?

* Reach out to your Nullify customer success manager
* Email <support@nullify.ai>
* See [Install](/getting-started/install.md) for tenant provisioning details