The iPad works well for the review side of security and compliance work. Install the Safeguard app from the App Store, sign in, and ask Griffin about your findings. Open the web interface in Safari for evidence, tests and approvals. Then hand the code changes to the Mac, where the Safeguard CLI writes and fixes code with your approval.
You do not give up the assistants you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and ask about your security data from the chat your team already uses.
This guide is for security leads, compliance owners and engineering managers who spend part of the week away from a desk. It covers setup, what to ask Griffin, how to work through evidence and tests on a tablet, and how the iPad hands off to the Mac and the CLI. Device facts come from the Safeguard download page, checked on 21 October 2026.
What the iPad is for, and what to leave for the Mac
Safeguard's web app docs are direct about this. The interface is responsive for tablets and phones, and mobile use focuses on review and alerts, such as reviewing and approving Griffin proposed remediations and acknowledging alerts. Heavier work, such as editing policies or deep SBOM inspection, is best done on a desktop.
That split matches how most security teams already work. Decisions, triage and sign off happen in meetings, on the move and between other jobs. Code changes and long documents happen at a desk. So treat the iPad as the review and decision surface, and the Mac as the place where the work gets done.
| Job | iPad app | Web interface in Safari on iPad | Mac desktop app | Safeguard CLI on the Mac |
|---|---|---|---|---|
| Ask a question in plain English | Yes, the same answers as on other devices | Yes, through Search | Yes | Yes, in the interactive terminal |
| Check the readiness score and controls | Use the web interface | Yes, the full platform | Yes | Not covered in the CLI docs |
| Run tests or collect evidence now | Use the web interface | Yes, from Compliance, Tests and Connectors | Yes | Not the CLI's job |
| Approve a policy, evidence or risk acceptance | Use the web interface | Yes, a person decides in the app | Yes | No; approvals are made in the app |
| Edit policies, inspect SBOMs in depth | Possible, not ideal | Possible, not ideal | Best fit | SBOM validation with safeguard validate |
| Write and fix code | No | No | Run the CLI from the panel's Terminal tab | Yes, with your approval |
The table is built from the docs. Where a cell says "use the web interface", that is because the full platform is in the browser and the download page describes the app only as giving the same answers on a phone.
Set up the iPad step by step
This takes about as long as installing any other work app. Do it once and the iPad is ready for review sessions.
1. Install the right app
Open safeguard.sh/download in Safari on the iPad and follow the App Store link. The iOS app is one app for iPhone and iPad. Using the link from the download page matters, because several unrelated apps on the App Store have Safeguard in their name.
2. Sign in to your workspace
Sign in with the same account your team uses on desktops. The web app docs list email plus passkey as the default sign in, TOTP or WebAuthn hardware keys for high assurance, and SSO through SAML, OIDC or OAuth for enterprise tenants. Sessions expire after 8 hours idle or 24 hours absolute by default, and enterprise tenants can tighten those limits. If the iPad asks you to sign in again after a long day, that is the session limit working as designed.
3. Turn on the Safari extension
The Safari extension for iPhone and iPad is included in the app, but it starts switched off. Open the Settings app, tap Apps, then Safari, then Extensions, and turn on Safeguard.sh. On iOS and iPadOS versions before 18, the download page gives the older path: Settings, then Safari, then Extensions.
4. Add the web interface for the full platform
Open app.safeguard.sh in Safari. The web app docs list Safari 17.4 or later as supported. This is where you will reach Compliance, Tests and Connectors from the iPad.
5. Put the two side by side
Apple's iPadOS 26 guide explains the steps. Turn on Windowed Apps under Settings, Multitasking and Gestures. Open one app full screen, then drag a second app from the Dock, App Library or Spotlight to the left or right edge. Drag the bar in the middle to resize. In iPadOS 26.2 or later you can also keep one window floating with Slide Over.
A layout that works well: the Safeguard app on one side for questions, Safari with the web interface on the other for evidence and approvals. Ask a question on the left, act on the answer on the right.
Ask Griffin from the iPad
Griffin is Safeguard's own large language model, built for software supply chain security. Safeguard's AI models page describes it as the flagship reasoning model, used for remediation, vulnerability explanation and natural language questions. The Griffin docs state that your code is never stored or used for training.
You can choose the model for each conversation. This walkthrough shows how: Zero z20 answers with no language model at all (it turns the question into a platform query); Griffin, Eagle and Lion are Safeguard's models; a tenant admin chooses which model families people may use; and you can bring your own model on your own provider account and route jobs such as chat or summaries to it.
Click through it at your own pace, or open it full screen.
Prompts that work well on a tablet
The Griffin docs give example prompts, and they are a good fit for a review session because the answers are short enough to read on a tablet:
What's our biggest risk?
Show me all critical vulnerabilities in production services
Compare last two scans
Generate executive summary
"What's our biggest risk?" is a sensible way to open a weekly review. "Compare last two scans" answers the question every manager asks after a release: did this make things better or worse? "Generate executive summary" gives you something to paste into a status update.
The Griffin docs also describe prioritisation that weighs reachability, exploitability, production versus development context and business impact. That is the right lens for a tablet session, because you are deciding what goes to the top of someone's list, not reading every finding.
When to use Zero instead
If the question is a count or a list, such as how many critical findings a product has, the pick-your-model demo shows Zero z20 answering with no language model by turning the question into a platform query. That is useful when you want the number straight from your data.
Follow up, then hand off
A good session ends with a decision and an owner. Ask Griffin which findings matter most, check them in the web interface, and then make sure the code change lands on someone's Mac. The last section of this guide covers that hand off.
Evidence, tests and approvals on the iPad
Compliance work suits a tablet better than people expect. Most of it is checking status, chasing gaps and making decisions. Here is how each part works, taken from Safeguard's compliance docs, and what you can do from Safari on the iPad.
Read the readiness score correctly
Safeguard's frameworks docs define a framework's readiness score as the share of its in-scope requirements that pass. Requirements waiting for evidence count as not yet passing. Requirements a person scopes out with a written justification leave the score. The score reads 100 only when every in-scope requirement passes. The docs are explicit that a readiness score is not an audit opinion or a certification, so say that when you share the number with leadership.
Know where evidence comes from
Controls are evidenced with automated tests, uploaded evidence, policies and attestations. Automated tests from connected systems map to SOC 2, ISO/IEC 27001, the HIPAA Security Rule, PCI DSS, NIST CSF 2.0 and CIS benchmarks. Requirements a scan cannot see, such as policies or access reviews, pass when a person attests them with evidence.
Compliance connectors read from your systems with read-only access and turn that data into evidence. Evidence collection and automated tests need the OAuth or API token connection method. The MCP server method serves Search only and cannot feed compliance tests, which is worth knowing if someone asks why a connection shows up in Search but not in your controls.
Run tests and collect evidence on demand
Tests run on a schedule, about every six hours, and each test runs when it is due, daily by default. You do not have to wait. From the web interface on the iPad:
- Open Compliance, then Tests, and tap Run now on one test or Run all tests.
- Open Connectors and use Collect evidence now to start a collection immediately.
- Check each connection's card. Not working means the credential needs fixing. Unverified means the last check got no answer, so recheck it.
This is the practical value of the iPad in an audit week. Someone fixes a setting, you run the test from wherever you are, and you see the result without walking back to a desk.
Understand preview tests and tasks
New tests start in a preview period, typically 14 days. During preview, results appear on the Tests page but do not change any control's status or your readiness score, and they open no tasks. Once a test is out of preview, its results count. So if a new test shows a failure and no task appeared, check whether it is still in preview before you chase anyone.
When a connection is disconnected, its tests stop, but its earlier results stay as history. That matters for auditors: removing a connector does not erase what it already proved.
Make the decisions only a person can make
Safeguard's requests and approvals docs list the changes that need a person's sign off: policies, evidence, access reviews, test exclusions, risk acceptances and crosswalk mappings. An approval only counts once a person decides it. Safeguard's AI assistant and MCP clients can prepare that work, but they never approve, accept or sign off; those decisions are made by a person in the app.
That is a good fit for the iPad. Griffin or a connected Claude or ChatGPT can draft the material. You read it on the iPad, and you decide.
A weekly review routine
Here is one way to run it:
- In the app, ask "What's our biggest risk?" and "Compare last two scans".
- In Safari, open each framework you care about and note the readiness score and the requirements waiting for evidence.
- Run all tests to make sure the numbers are current.
- Work through pending approvals: evidence, test exclusions, risk acceptances.
- Review any Griffin proposed remediations and approve the ones that are ready.
- For anything that needs a code change, write down the repository and the finding, and hand it to the engineer who owns it.
Do the work properly with the Safeguard CLI
The iPad decides. The Mac does the work. The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It writes code, not only scans it.
Install on the Mac
One line in Terminal on macOS or Linux:
curl -fsSL https://cli.safeguard.sh/install | bash
On Windows, in PowerShell:
irm https://cli.safeguard.sh/install.ps1 | iex
It is a single static binary, with no Node, Python or JVM needed. The download page lists CLI 1.4.0 with binaries for macOS Apple Silicon and Intel, Linux x86_64 and arm64, and Windows x86_64.
First session
In the repository from your iPad notes:
cd ~/code/payments-api
safeguard
Type /login to sign in through the browser, then /scan . to scan the folder. When the local runner runs platform scan jobs, your source code stays on the machine; only SBOMs and findings are uploaded.
Writing and fixing code
Ask in plain language, for example "fix the lodash CVE in this repo" or "how many critical vulns do we have". The assistant has tools for local files and for your Safeguard data and picks whichever the question needs. It can write files, edit code and run commands, and those actions ask before they act. Type @ to attach a file from the folder you started in, and /resume picks up the last session in that folder.
This walkthrough shows the hand off in one flow: attach a computer running the Safeguard CLI and a folder, ask for a fix, review the diff and approve the command before it runs. The demo itself notes that computer work from Search is available and expanding.
Click through it at your own pace, or open it full screen.
Use your Claude, ChatGPT or Codex plan
Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. /model shows or switches the model; for connecting a model, see the CLI docs. Teams that already standardised on one of those plans do not have to change it to switch to Safeguard.
Approvals
/permissions sets the mode. Ask prompts before every action. Auto approves known actions and asks about anything new, and it is the default. Yolo approves everything. For a fix that came out of a compliance review, Ask or Auto is the right choice, because the change will be read again by an auditor.
CI with safeguard exec
safeguard exec "summarise the critical findings in this repository"
safeguard exec runs one non-interactive assistant turn, which is how you put the assistant in CI. safeguard scan --dir . builds an SBOM and writes results such as vuln.json and license.json under ./output, and safeguard validate checks CycloneDX, SPDX and VEX documents before you share them with a customer. Policies and gates are evaluated in the platform, not by the CLI, so the gate result is something you can check from the iPad afterwards.
For more on the assistant, see the security aware coding assistant post. If engineers already use another coding agent, checking coding agent changes with the Safeguard CLI shows how to scan what it changed before merge.
Common mistakes
Treating the readiness score as an audit result. The docs say it is not an audit opinion or a certification. Present it as progress.
Chasing a failure from a preview test. Preview tests change no control status and open no tasks. Check the preview period first.
Expecting an MCP connection to feed controls. The MCP server method serves Search only. Use OAuth or an API token for evidence collection and tests.
Expecting the assistant to sign off. Approvals count only once a person decides them in the app. Griffin and connected assistants prepare; people approve.
Editing long policies on the iPad. The web app docs point heavy work, such as policy editing and deep SBOM inspection, to the desktop.
Leaving the Safari extension off. It ships inside the app but stays off until you turn it on in Settings.
Installing a look alike app. Follow the App Store link from safeguard.sh/download.
Handing off without a repository and finding. "Fix the payments issue" leaves the engineer guessing. Name the repository and the finding so they can start the CLI in the right folder and ask directly.
FAQ
Is the Safeguard iPad app the same as the iPhone app?
Yes. The download page lists one iOS app on the App Store for iPhone and iPad.
Can I do compliance work entirely from the iPad?
You can review status, run tests, collect evidence on demand and make approvals in the web interface in Safari, which carries the full platform. The web app docs recommend a desktop for heavy work such as editing policies and deep SBOM inspection.
What is Griffin?
Safeguard's own large language model for software supply chain security. It answers plain language questions, explains vulnerabilities and helps with remediation. The docs state your code is never stored or used for training.
Can Griffin approve evidence or accept a risk for me?
No. Safeguard's AI assistant and MCP clients can prepare work, but they never approve, accept or sign off. A person makes those decisions in the app.
How often does evidence refresh?
Tests run on a schedule, about every six hours, and each test runs daily by default. Use Run now or Run all tests on Compliance, Tests, or Collect evidence now on the Connectors page, to refresh sooner.
Can my team keep their Claude, ChatGPT or Codex plan?
Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use. See the CLI docs or /model for connecting a model.
Does source code end up on the iPad?
The iPad shows platform data. On the Mac, when the local runner runs platform scan jobs, source code stays on the machine and only SBOMs and findings are uploaded.
Is there a Safari extension for the Mac?
The download page lists Safari on Mac as in Apple review. On iPhone and iPad the extension is included in the app.
Try it yourself
The hand off ends on a Mac running the CLI. This walkthrough shows how to set up the runner on your own machine, pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.
Click through it at your own pace, or open it full screen.
Get the iPad app and the Mac downloads from safeguard.sh/download, and keep the CLI docs open for the engineer who picks up the fix.
Quick check
Do preview tests change your readiness score?
No. During the preview period, typically 14 days, results show on the Tests page but change no control's status or readiness score and open no tasks.
Who approves evidence, test exclusions and risk acceptances?
A person, in the app. Safeguard's AI assistant and MCP clients can prepare the work but never approve, accept or sign off.
Where do you turn on the Safari extension on iPad?
In the Settings app, under Apps, then Safari, then Extensions. Before version 18, the path is Settings, then Safari, then Extensions.
Sources
- Safeguard downloads
- Safeguard CLI overview
- Safeguard CLI interactive terminal
- Safeguard local runner
- Safeguard web application
- Safeguard desktop application
- Griffin AI
- Safeguard AI models
- Safeguard compliance frameworks
- Safeguard compliance connectors
- Safeguard requests and approvals
- Safeguard MCP integrations
- Apple: multitask on iPad with iPadOS 26
Last reviewed: 21 October 2026.
