Portfolio Monitoring

Portfolio Monitoring

Portfolio Monitoring is the recurring program for companies you enroll under a legal organization: a Quarterly Light Audit, a monthly pulse after an assessment exists, and one included Full Audit per company per contract year.

It is distinct from a one-off diligence audit you start from Create New Audit. Monitoring clones through a connected Git account so the program does not wait on someone running the CLI.

Availability: an active Portfolio Monitoring plan (standalone or included with Enterprise). A 3-month pilot runs Light Audits and pulses only — it does not include the complimentary Full Audit.

What runs, and in what order

Program	What it does	Opens a report?
Quarterly Light Audit	A 100-file quality sample in each approved repository	Yes — a group audit
Monthly pulse	Refreshes CVEs, DORA, activity, innovation vs maintenance, and AI-authored share against the latest Light or Full	No — overlay only
Included Full Audit	One complete audit per enrolled company per year, included up to 2.5 million lines	Yes — a group audit

You choose when the included Full Audit runs:

• Start with a Full Audit — the first assessment is the included Full. Quarterly Light Audits continue after it completes.
• At the end of this plan year — Light Audits run first. The Full Audit runs at year end.

Above 2.5 million lines, CodeDD still clones automatically and asks you to confirm the extra lines from the annual allowance before analysis starts. Extra Full Audits you start from the dashboard do not use this included grant.

Pulses start only after a completed Light or Full exists for that company. Pulse is not a new audit and does not open a navigable report.

Enroll a company

Enrollment is explicit: a company is on the program only after you save a monitoring schedule for it.

1. Open Account → the legal organization's Portfolio Monitoring list, or open the company dashboard and Next Audit.
2. Pick the company if it is not enrolled yet.
3. Choose Full Audit placement (if your contract includes it) and the first Light Audit date.
4. Name whose Git connection CodeDD should clone with — you, or a member of that company.
5. Save the schedule. Use Start the first Light Audit now (or Start the included Full Audit now) to run the first occurrence today.

Only portfolio initiators and enterprise administrators can enroll companies. The plan's PortCo seat allowance caps how many companies can be enrolled at once.

Git connections belong to a person, not a company

OAuth and personal access tokens live on a CodeDD user account, one connection per Git host (GitHub, GitLab, Bitbucket, Azure DevOps). They are not stored separately for each portfolio company.

What that means in practice:

• Connecting GitHub, GitLab, or Azure once on Account → Profile → Git provider connections (or during import) is enough for that person to use the same connection on every company they enroll — as long as the same Git user can see that company's repositories.
• A PE or firm CTO who monitors ten companies can hold GitHub and GitLab and Azure on the same CodeDD login. Each host is a separate connection.
• CodeDD does not keep two GitHub logins, or two GitLab.com tokens, or two different self-managed GitLab instances, on one user. Connecting again for the same host replaces the previous token.
• You can point each company's schedule at a different person (a member of that company) so Company A's clone uses their GitLab and Company B uses someone else's GitHub.

GitHub (cloud) uses the CodeDD GitHub App. Access is the repositories selected on each App installation, intersected with what that GitHub user can already see. Installing the App on another GitHub organization adds access; it does not create a second CodeDD GitHub login.

GitLab, Bitbucket, and Azure DevOps grant whatever that connected user can read on that host. There is no separate CodeDD "organization grant" per portfolio company.

Each company has its own repository list

The Git token is shared. The list of repositories CodeDD clones for monitoring is not.

When you enroll a company you approve the repositories for that company only. Later Light Audits, pulses, and the included Full Audit reuse that list. New repositories CodeDD finds on later checks start selected; uncheck any that should not be cloned. Unchecked repositories stay out of the next scan.

That is how one person with access to many GitHub organizations or GitLab groups monitors ten companies without mixing their code: pick Company A's repos on Company A's schedule, Company B's on Company B's.

The first-time import dialog asks you to pick a Git host, then an organization / group / workspace, then repositories. Use that when companies live on different hosts, or when you need to add a GitHub organization that does not yet have the CodeDD App.

The schedule's repository checkboxes list what the named Git connection can currently see on the host already linked to that schedule. After the first successful listing, the schedule stays on that host so a GitHub connection cannot silently start cloning an unrelated GitLab estate.

First setup when Git is already connected

An existing Git connection does not enroll a new company by itself.

Step	If Git is already connected	If it is not
Authorize CodeDD (OAuth popup)	Skipped for that host	Required
Install the GitHub App on a new GitHub organization	Required for that organization ("add another organization")	Same
Select organization / group and repositories	Required for this company	Required
Import / start the first Light or Full	Required once	Required once

Typical path when you click Start … now on a brand-new schedule:

1. CodeDD opens Audit Invitation for the first occurrence (nothing has been approved to clone yet).
2. Import repositories. If that host is already connected, you skip the authorize popup and go to organization / group, then repository selection.
3. Mark the audit ready and start it. Those imported repositories become the approved list for every later unattended run.

You can instead save the schedule, tick repositories on the monitoring form, then let the first run clone automatically — still a per-company selection, not a second OAuth grant.

Reconnect access on the schedule card is only when the weekly health check finds the named connection missing or failing. It is not required every time you add a company.

After the first run

Quarterly Light Audits, monthly pulses, and the included Full Audit clone the approved repositories with the named person's connection. You are not asked to authorize Git or accept repositories again unless:

• the connection breaks (token expired, App uninstalled, person left) — reconnect or pick someone else;
• CodeDD finds new repositories — they start selected; uncheck to keep them out;
• the next run's repository list drifted and you are asked to confirm the scope the day before.

Funds with many portfolio companies

A typical private-equity CTO with ten companies:

• Connects GitHub, GitLab, and Azure DevOps once on their CodeDD account.
• Installs the CodeDD GitHub App on each GitHub organization that needs monitoring, selecting the repositories GitHub should expose to CodeDD.
• Enrolls each company and selects that company's repositories (invitation import or schedule checkboxes).
• Leaves later Lights, pulses, and the yearly Full on autopilot for each schedule.

They do not get a separate OAuth grant stored per company. Isolation is the per-company repository list, plus GitHub App installations on the GitHub side. If two companies must never share a Git identity, assign different CodeDD users as each schedule's Git connection, or use a dedicated Git service account per company.

Troubleshooting

Issue	What to try
Schedule shows no repositories	Save the schedule first, then confirm the named person has a working Git connection for that host
GitHub connected but a company's org is missing	Install the CodeDD GitHub App on that GitHub organization, then pick it in import
Import lists the wrong host's repositories	Use Audit Invitation import and choose the host explicitly; a schedule locks to the first host that listed successfully
"Git access needs reconnecting"	Use Reconnect access on the schedule, or Account → Profile → Git provider connections
Pulse date says "After the first Light or Full Audit"	Complete a Light or Full for that company; pulses do not run before an assessment exists
Cannot enroll another company	The plan's PortCo allowance is full — remove a company or raise the allowance

Next steps

• Setting Up a Portfolio Organization
• Repository Connection & Security
• Team Members & Access Roles
• Enterprise Data API