HashiCorp Vault

Connect HashiCorp Vault to collect infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In HashiCorp Vault:

   1. Write a policy file (for example safeguard-read.hcl) that grants only what Safeguard reads: path "sys/audit" { capabilities = ["read", "sudo"] } path "sys/auth" { capabilities = ["read"] } path "identity/mfa/login-enforcement" { capabilities = ["read", "list"] } path "identity/mfa/login-enforcement/*" { capabilities = ["read", "list"] }
   2. Load it with the Vault CLI: vault policy write safeguard-read safeguard-read.hcl
   3. Create a token bound to that policy: vault token create -policy=safeguard-read
   4. Copy the token value from the command output and paste it into Safeguard.

   Where to find the other values:

   • Server URL: Your Vault server's https address.
   • Namespace (optional): Vault Enterprise or HCP Vault only: the namespace path the policy and token were created in.

   HashiCorp Vault issues this credential through its API or its support team, not through its admin screens.

   Source: developer.hashicorp.com, checked 2026-10-07.

   The permissions Safeguard needs: read + sudo: sys/audit, read: sys/auth, read + list: identity/mfa/login-enforcement. HashiCorp Vault has no narrower grant for these reads. Safeguard only reads with it.

2. On Compliance › Connectors, open HashiCorp Vault, click Connect, choose API token and fill in:

   Field	What to enter
   Server URL	Required. Your own server: an https address reachable from the internet.
   API token	Required. Stored encrypted and never shown again.
   Namespace (optional)	—

3. Click Connect with token.

Frameworks

Safeguard's automated tests read HashiCorp Vault and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks