Proxmox
Connect Proxmox to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Proxmox to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.
| Category | Cloud Infrastructure |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Proxmox's guide | pve.proxmox.com |
Connect with an API token
-
In Proxmox:
- In the Proxmox VE web interface, go to Datacenter › Permissions › API Tokens and add a token for the user (or run
pveum user token add username@realm tokenid). - Keep privilege separation on (the default), so the token only gets the permissions you grant it explicitly.
- Copy the token value when it is shown: it is displayed only once and cannot be retrieved later.
- Grant the token read-only access on the whole tree:
pveum acl modify / -token 'username@realm!tokenid' -role PVEAuditor(the token's effective permissions are the intersection of the user's and the token's).
Where to find the other values:
- Token ID: The full token ID in the form USER@REALM!TOKENID, as listed under Datacenter › Permissions › API Tokens.
- Token secret: The UUID value shown once when the token is created.
- Base URL: The https address of your Proxmox VE web interface.
Proxmox shows the secret only once, so copy it before you leave the page.
The ACL step is given as the documented pveum command; the docs page checked did not spell out the equivalent GUI dialog. Because the user must also hold PVEAuditor (or broader) on / for the intersection to allow reads, make sure the token's user has at least that role.
Source: pve.proxmox.com, checked 2026-10-07.
The permissions Safeguard needs:
PVEAuditor on /. - In the Proxmox VE web interface, go to Datacenter › Permissions › API Tokens and add a token for the user (or run
-
On Compliance › Connectors, open Proxmox, click Connect, choose API token and fill in:
Field What to enter Base URL Required. Your own server: an https address reachable from the internet. Token ID Required. For example: safeguard@pve!readonly Token secret Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Proxmox and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.2, CC6.1, CC6.3 | 3 |
| ISO/IEC 27001 | Automated tests | A.8.2, A.8.5, A.8.13 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(4), 164.308(a)(7), 164.312(d) | 3 |
| PCI DSS | Automated tests | 7.2.2, 8.4.2, 12.10.1 | 3 |
| NIST CSF 2.0 | Automated tests | PR.AA-03, PR.AA-05, PR.DS-11 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Cloud Infrastructure connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks