Connect SigNoz

Safeguard reads your SigNoz with a service account key, GET calls only: alert rules and the notification channels they reach, log retention, and the users and roles in your workspace. It works with SigNoz Cloud and with a self-hosted SigNoz.

Which role to give the key

The account checks list users and roles, which only SigNoz-Admin can do: custom roles cannot grant user management. SigNoz-Admin also grants write access, so either give it as an elevated grant (Safeguard only reads with it), or keep the key as Viewer and attest the account checks instead.

1. Create a service account key in SigNoz

1. In SigNoz, open Settings › Service Accounts and create a service account, for example "Safeguard compliance".
2. Give it the SigNoz-Viewer role, or SigNoz-Admin for the account checks.
3. Create a key for it and copy it.

2. Connect it in Safeguard

1. Open Compliance › Connectors, search for SigNoz and click Connect.
2. Choose API token:

3. Click Connect with token.

A self-hosted SigNoz must be reachable at a public https:// address. Safeguard refuses private, loopback and cloud-metadata addresses before it sends anything.

What Safeguard checks

• Alert rules reach a notification channel. A rule routed only by a routing policy is reported as unknown, because Safeguard does not evaluate routing expressions.
• Log retention meets your minimum
• With SigNoz-Admin: SigNoz accounts belong to people in your personnel register, people who left no longer have access, and how many admins there are

Troubleshooting

• The account checks show an error naming SigNoz-Admin: expected with a Viewer key. Give the key SigNoz-Admin, or attest those checks.
• Not working with a self-hosted SigNoz: make sure the Base URL is a public https:// address.