Gusto

Connect Gusto to collect hris evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Gusto:

   1. Gusto issues company-level access tokens (with refresh tokens) only through its OAuth2 process for an application registered in the Gusto Developer Portal; organization-level API tokens are also provided through the Developer Portal.
   2. Register an application in the Gusto Developer Portal and have the company authorize it through the OAuth2 process to obtain the company's access token.

   Where to find the other values:

   • Environment (optional): Demo applications call api.gusto-demo.com; production calls api.gusto.com after Gusto grants production credentials and QA approval.

   Gusto issues this credential through its API or its support team, not through its admin screens.

   There is no in-product screen where a Gusto customer creates a read-only token. The fetched page does not detail the OAuth2 scopes or where the company UUID is shown; the scope names come from the connector's grant list. Company access tokens expire and must be refreshed. Verification: the scope names (employees:read, contractors:read, company_admin:read) were removed from the steps because the fetched page does not list them. Access tokens expire in 7200 seconds (2 hours).

   Source: docs.gusto.com, checked 2026-10-07.

   The permissions Safeguard needs: employees:read, contractors:read, company_admin:read. Safeguard's compliance tests for Gusto need the credential on the API token tab: an OAuth connection cannot read everything they check.

2. On Compliance › Connectors, open Gusto, click Connect, choose API token and fill in:

   Field	What to enter
   Access token	Required. Stored encrypted and never shown again.
   Company ID	Required.
   Environment (optional)	—

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Gusto and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• HRIS connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks