Vultr

Connect Vultr to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Vultr:

   1. Log in to the Vultr Console (https://console.vultr.com) as the root account or a user with Manage Users permission.
   2. Click the organization name in the top navigation bar, click Manage Organization, then Users, and select the user Safeguard will act as (ideally a dedicated user).
   3. Under API Access, click Create API Key. Optionally enter a Key Name, and set Should the API key expire? with an Expiration Date.
   4. Click Generate API Key, then Copy to Clipboard. The key is only displayed once.
   5. Confirm I have successfully copied the key and click Finalize Key Generation.
   6. Click the organization name, click Manage Organization and open the Permission Policies tab. Click + to add a policy.
   7. Enter a Name, then for the Instance and firewall service categories set Allow only on the read actions. Click Add Permission Policy.
   8. Open the policy, click + in the Attached Entities section, select the user, and click Attach Entities.
   9. Optional: also allow the user-management read action if you want the checks that need manage_users to run.

   Vultr shows the secret only once, so copy it before you leave the page.

   Vultr's policy guide shows Allow/Deny per service category and per action, but does not list the individual read action names (they are in Vultr's IAM Policy Actions Reference, not read here). Vultr's docs give API-access enablement for a user only through the API and CLI, not the Console.

   Source: docs.vultr.com, docs.vultr.com, docs.vultr.com, checked 2026-10-07.

   The permissions Safeguard needs: instance and firewall read ACLs. Optional, broader than read-only: manage_users. Without it, the checks that need it show an error naming it. Safeguard only reads with it.

2. On Compliance › Connectors, open Vultr, click Connect, choose API token and fill in:

   Field	What to enter
   API key	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Vultr and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Cloud Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks