Ironclad
Connect Ironclad to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Ironclad to collect digital signature evidence with automated compliance tests, switched on per workspace.
| Category | Digital Signature |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Ironclad's guide | developer.ironcladapp.com |
Connect with an API token
-
In Ironclad:
- In Ironclad, click your user profile dropdown at the top right-hand corner and select Company Settings.
- Select the API tab on the left sidebar (visible only if the API add-on is enabled for your instance).
- Click Create new app, enter a name, and click Create app.
- Copy the client ID and secret; you will not be able to access the secret again.
- After closing the modal, set Grant Types to client credentials and, under Requested Resource Scopes, select only scim.users.readUsers; click Save Changes.
- Request a token:
POST https://ironcladapp.com/oauth/tokenwithgrant_type=client_credentials,scope=scim.users.readUsers,client_idandclient_secret; paste the returned access token into Safeguard.
Where to find the other values:
- Environment (optional): Use the Ironclad environment you sign in to:
ironcladapp.com(most customers),eu1.ironcladapp.com(EU), ordemo.ironcladapp.com(demo). Client apps only work in the environment where they were created.
Ironclad shows the secret only once, so copy it before you leave the page.
Source: developer.ironcladapp.com, developer.ironcladapp.com, developer.ironcladapp.com, checked 2026-10-07.
The permissions Safeguard needs:
scim.users.readUsers. -
On Compliance › Connectors, open Ironclad, click Connect, choose API token and fill in:
Field What to enter Access token Required. Stored encrypted and never shown again. Environment (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Ironclad and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 2 |
| PCI DSS | Automated tests | 7.2.4, 8.2.5 | 2 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Digital Signature connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks