Ramp
Connect Ramp to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Ramp to collect vendor procurement evidence with automated compliance tests, switched on per workspace.
| Category | Vendor Procurement |
| Connect with | API token, MCP server |
| What a connection produces | Automated compliance tests |
| Ramp's guide | docs.ramp.com |
Connect with an API token
-
In Ramp:
- In Ramp, register a developer app in the Ramp Developer Console (the docs name the console but the public pages fetched do not give its menu path or button labels).
- Give the app the Client Credentials grant (the docs describe it as best for server-to-server integrations with no user interaction).
- Grant the app the users:read scope (Ramp scopes follow the resource:permission pattern).
- Copy the app's client_id and client_secret and paste them into Safeguard, or exchange them yourself at /developer/v1/token for an access token and paste that into Access token.
Where to find the other values:
- Client ID (optional): Shown for the app in the Ramp Developer Console (exact screen not documented publicly).
Ramp's public documentation does not cover every step.
Ramp's public authorization guide covers OAuth 2.0, the client credentials flow, scopes (e.g. users:read) and the /developer/v1/token endpoint, but not the dashboard click path for creating the app. Menu path, button labels and secret display behaviour are unverified.
Source: docs.ramp.com, docs.ramp.com, checked 2026-10-07.
The permissions Safeguard needs:
users:read. -
On Compliance › Connectors, open Ramp, click Connect, choose API token and fill in:
Field What to enter Access token Optional. Stored encrypted and never shown again. Or, instead: Client ID (optional), Client secret (optional).
-
Click Connect with token.
Connect with the MCP server
Choose MCP server: the address https://ramp-mcp-remote.ramp.com/mcp is filled in. Sign in to Ramp when asked. It lets Griffin AI search Ramp; the compliance evidence comes from the API token connection.
Frameworks
Safeguard's automated tests read Ramp and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 3 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 3 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5 | 3 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vendor Procurement connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks