dbt Cloud
Connect dbt Cloud to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect dbt Cloud to collect data export evidence with automated compliance tests, switched on per workspace.
| Category | Data Export |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| dbt Cloud's guide | docs.getdbt.com |
Connect with an API token
-
In dbt Cloud:
- In dbt, click your account name in the left side menu and select Account settings.
- In the left sidebar, click Service Tokens.
- Click + Create service token, enter a name, and add the permission set Account Viewer (Enterprise plans; on Team plans pick Read-only).
- Save the token, and copy it right away.
Where to find the other values:
- Account ID: Account settings displays the account ID; it is also the number in the URL
https://YOUR_ACCESS_URL/settings/accounts/ACCOUNT_ID/. - API URL (optional): Account settings shows your Access URL (for example
cloud.getdbt.com,abc123.us1.dbt.com, oryour-company.getdbt.comfor single tenant).
dbt Cloud shows the secret only once, so copy it before you leave the page.
"Once the token is generated, you won't be able to view this token again." Account Viewer is listed only for Enterprise plans; Team plans list Account Admin, Billing Admin, Job Admin, Metadata Only, Member, Read-only and Semantic Layer Only. Whether Read-only can list account users on Team plans was not verified.
Source: docs.getdbt.com, docs.getdbt.com, docs.getdbt.com, checked 2026-10-07.
The permissions Safeguard needs:
Account Viewer. -
On Compliance › Connectors, open dbt Cloud, click Connect, choose API token and fill in:
Field What to enter Account ID Required. Service token Required. Stored encrypted and never shown again. API URL (optional) For example: https://cloud.getdbt.com -
Click Connect with token.
Frameworks
Safeguard's automated tests read dbt Cloud and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 2 |
| PCI DSS | Automated tests | 7.2.4, 8.2.5 | 2 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Data Export connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks