Looker
Connect Looker to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Looker to collect data export evidence with automated compliance tests, switched on per workspace.
| Category | Data Export |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Looker's guide | cloud.google.com |
Connect with an API token
-
In Looker:
- As a Looker admin, first create a role whose permission set contains only see_users (see permission_steps).
- In the Admin panel open the Users page and click Add › Service Account.
- Enter a service account name, leave Create default set of API credentials enabled, assign the role from step 1, and click Save.
- On the service account's Edit User page, in the API Keys section, click Manage, then click Create New API Key.
- Copy the Client ID and Client Secret right away.
- Create a custom permission set containing only see_users, attach it to a new role, and assign only that role to the service account. (The exact Admin › Roles screen labels were not captured from the fetched page.)
Where to find the other values:
- Instance URL: The address of your Looker instance as it appears in your browser when signed in (for example
https://yourcompany.cloud.looker.com). - Client ID: Shown on the service account's API Keys page (admins can view client IDs, not secrets, later).
Looker's public documentation does not cover every step.
Source: docs.cloud.google.com, cloud.google.com, checked 2026-10-07.
The permissions Safeguard needs:
see_users. Safeguard's compliance tests for Looker need the credential on the API token tab: an OAuth connection cannot read everything they check. -
On Compliance › Connectors, open Looker, click Connect, choose API token and fill in:
Field What to enter Instance URL Required. An address under looker.com. Client ID Required. Client secret Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Looker and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3 | 4 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2, A.8.5 | 4 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 8.4.2 | 4 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-03, PR.AA-05 | 4 |
These tests are switched on per workspace by the Safeguard team.
Related
- Data Export connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks