Factorial

Connect Factorial to collect hris evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Factorial:

   1. API key: log in to Factorial with an admin account and head to Settings.
   2. Scroll down to the Advanced section and select API Keys.
   3. Click Create new API Key, enter a Name (for example the name of the integration) and choose an expiration period (new keys expire after 24 hours by default; a longer period or a non-expiring key can be chosen).
   4. Click Get my API key, then copy the key immediately and store it securely; it will not be shown again after you close the screen.
   5. Access token (alternative, scoped): in Settings, under Advanced configuration, select OAuth applications and click Create OAuth app.
   6. Enter the application name, one redirect URI per line, and select the required scopes; choose Confidential client with secret, then select Save. Copy the client secret when it is shown (the Client ID is always visible in the OAuth applications list).
   7. Send a company administrator to https://id.factorialhr.com/oauth/authorize?client_id=<CLIENT_ID>&redirect_uri=<URL_ENCODED_REDIRECT_URI>&response_type=code&scope=<URL_ENCODED_SCOPES>&state=<RANDOM_STATE>&resource_owner_type=company; the administrator signs in, reviews the requested scopes and authorizes the application, and the returned code is exchanged for the Company Token as described in Factorial's Company Token guide.

   Factorial shows the secret only once, so copy it before you leave the page.

   Factorial API keys cannot be scoped: they give full access to all company data and require full admin permissions to manage. Read-only access to employees is only possible with an OAuth Company Token restricted to the employees scope (Factorial's scopes have no separate read/write split; scopes also never exceed the authorizing user's own permissions). Factorial's API guide words the API key path as Settings › API Keys › New API Key and says keys do not expire, while the newer help-center article uses Settings › Advanced › API Keys › Create new API Key / Get my API key and says new keys expire after 24 hours by default; the help-center labels are used above. A lost client secret can be replaced with Rotate client secret in OAuth applications. Verification 2026-10-07: the employees scope name comes from Factorial's OAuth scopes page, which was not among the pages re-read, so the steps say 'the required scopes' instead of naming it.

   Source: help.factorialhr.com, apidoc.factorialhr.com, apidoc.factorialhr.com, apidoc.factorialhr.com, checked 2026-10-07.

   The permissions Safeguard needs: employees: read.

2. On Compliance › Connectors, open Factorial, click Connect, choose API token and fill in:

   Field	What to enter
   API key	Optional. Stored encrypted and never shown again.

   Or, instead: Access token (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Factorial and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• HRIS connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks