ClickHouse
Connect ClickHouse to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect ClickHouse to collect data export evidence with automated compliance tests, switched on per workspace.
| Category | Data Export |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| ClickHouse's guide | clickhouse.com |
Connect with an API token
-
In ClickHouse:
- In the ClickHouse Cloud console, open the API Keys tab on the left menu.
- Click New API Key (on first use, the create button shown on the empty page).
- Enter a key name, choose the permissions (the guide says the developer role has "read-only permissions for assigned services" and the admin role has "full read and write permissions"; pick the least-privileged one Safeguard needs), and set an expiration time.
- Optionally restrict use to Specific locations (CIDR ranges).
- Click Generate API Key and copy the Key ID and Key secret before leaving the screen.
Where to find the other values:
- Key ID: Shown with the Key secret on the screen after the key is created.
ClickHouse shows the secret only once, so copy it before you leave the page.
ClickHouse's public documentation does not cover every step.
"The values won't be displayed after you leave this screen." The API uses HTTP Basic auth with Key ID and Key secret against https://api.clickhouse.cloud/v1. Not verified: which role grants control-plane:organization:view; the fetched pages do not mention that permission (the access-management page fetched is an index only). Confirm in the role picker that the chosen role includes it.
Source: clickhouse.com, clickhouse.com, checked 2026-10-07.
The permissions Safeguard needs:
control-plane:organization:view. -
On Compliance › Connectors, open ClickHouse, click Connect, choose API token and fill in:
Field What to enter Key ID Required. Key secret Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read ClickHouse and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.2, CC6.2, CC6.3, CC6.6 | 5 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2, A.8.13, A.8.20 | 5 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(a)(1) | 5 |
| PCI DSS | Automated tests | 1.3.1, 7.2.2, 7.2.4, 8.2.5 | 4 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05, PR.DS-11, PR.IR-01 | 5 |
These tests are switched on per workspace by the Safeguard team.
Related
- Data Export connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks