Auditors ask for proof that a control worked, not a promise that it did. Safeguard's approach is to read the proof from the systems that already hold it, such as your identity provider, cloud account, code host and ticket tracker, and keep it attached to the control it supports.
Connect a system
Open Compliance, then Connectors. Search for the system, filter by category, by Automated evidence or Connection record only, or by Connected or Not connected, and click Connect on a card. There are up to three connection methods, depending on the connector:
| Method | How it works |
|---|---|
| OAuth | You approve read access on the vendor's own consent screen. No secret to copy |
| API token | You paste a token and any account details. The form lists the read-only grant to create |
| MCP server | You connect the vendor's MCP server by URL. This is what Search uses, and it cannot feed compliance tests |
Safeguard reads with read-only access. Credentials are encrypted at rest and never shown again. A self-hosted server must be reachable at a public https address, and Safeguard refuses private, loopback and cloud metadata addresses. Admins decide which connectors members can use.
What a connection produces
Not all connectors are equal, and the connector catalog says so. Each one is labelled with what it produces: automated compliance tests, automated evidence collection, people sync, attested evidence, search only, or a connection record. A connection record stores the connection as evidence for its category, and automated collection is not available for those providers yet. Check the label before you promise an auditor anything.
After connecting, the card shows Verified, Not working or Unverified. You can Test connection, Reconnect, Re-authorize, Rename, Disconnect or Remove. Disconnecting stops the tests and keeps earlier results as history.
Automated tests
Most connectors feed automated compliance tests. Each test checks a setting in the connected system against a control and records the evidence. Tests for a provider are switched on per workspace by the Safeguard team, so a new connection may show Verified before its tests run.
The docs say a newly added test starts in a preview period, typically 14 days, during which results show on the Tests page but do not change any control status or readiness score and open no tasks. Tests run on a schedule, about every six hours, and each runs as often as it is due, daily by default. Use Run now or Run all tests on Compliance, Tests to go sooner, or Collect evidence now on the Connectors page.
Automated tests map to SOC2, ISO/IEC 27001, the HIPAA Security Rule, PCI DSS, NIST CSF 2.0 and the CIS benchmarks. Through the crosswalk, evidence also reaches equivalent controls of related frameworks. For other frameworks you can link tests to controls yourself.
What still needs a person
A scan decides a requirement when it can see what the requirement asks for. Some requirements need evidence a scan cannot see, such as a policy, an HR record or an access review. Those pass when a person attests them with named evidence, and they count as not yet passing until then.
How to read the score
A readiness score is the share of in-scope requirements that pass. A requirement a person scopes out, with written justification, leaves the score. The docs state plainly that the score is Safeguard's assessment of what it can see and is not an audit opinion or a certification.
Publishing results
The Trust Center can show framework status and published controls read live from your continuous monitoring, so a failing control shows as failing without you republishing. Publishing is always an explicit action.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does a Connection record connector collect evidence automatically?
No. It stores the connection as evidence for its category. Automated collection is not available for those providers yet.
Is a readiness score an audit opinion?
No. It is Safeguard's assessment of what it can see.
