Cloudflare
Connect Cloudflare to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Cloudflare to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.
Step-by-step guide: Connect Cloudflare.
| Category | Cloud Infrastructure |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Cloudflare's guide | developers.cloudflare.com |
Connect with an API token
-
In Cloudflare:
- In the Cloudflare dashboard, go to Manage Account › API Tokens (account token) or My Profile › API Tokens (user token).
- Select Create Token and create a custom token.
- Add these permissions with Read access: Account Settings Read (Account), and Zone Read, Zone Settings Read, DNS Read and Zone WAF Read (Zone).
- Under resources, include your account and all zones (or the zones Safeguard should read).
- Select Continue to summary, review, and select Create Token.
- Copy the token secret; it is only shown once.
Where to find the other values:
- Account ID (optional): On any domain's Overview page, the API section at the bottom shows the Account ID; you can also use the dashboard search (CMD/CTRL + K) › Copy account ID, or Workers & Pages › Account Details.
Cloudflare shows the secret only once, so copy it before you leave the page.
Cloudflare's public documentation does not cover every step.
Source: developers.cloudflare.com, developers.cloudflare.com, developers.cloudflare.com, checked 2026-10-07.
The permissions Safeguard needs:
Account Settings Read,Zone Read,Zone Settings Read,DNS Read,Zone WAF Read,Account API Tokens Read. Optional, read-only: Bot Management Read. The connection does not ask for it by default; without it, the checks that need it show an error naming it. -
On Compliance › Connectors, open Cloudflare, click Connect, choose API token and fill in:
Field What to enter API token Required. Stored encrypted and never shown again. Account ID (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Cloudflare and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3, CC6.6, CC6.7, CC7.1, CC7.2 | 18 |
| ISO/IEC 27001 | Automated tests | A.5.14, A.5.16, A.5.17, A.5.18, A.6.5, A.8.2, A.8.5, A.8.9, A.8.15, A.8.20, A.8.24 | 18 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(b), 164.312(d), 164.312(e)(1) | 12 |
| PCI DSS | Automated tests | 4.2.1, 5.4.1, 6.4.2, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.3, 10.2.1 | 13 |
| NIST CSF 2.0 | Automated tests | DE.CM-01, DE.CM-09, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-02, PR.IR-01 | 16 |
These tests are switched on per workspace by the Safeguard team.
Related
- Cloud Infrastructure connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks