Google BigQuery

Connect Google BigQuery to collect data export evidence automatically.

Connect with OAuth

Before you start, an administrator of Google BigQuery must allow third-party apps:

• If your Google Workspace restricts third-party apps, a Workspace admin opens the Admin console › Security › Access and data control › API controls › Manage App Access.
• Click Configure new app, search for the Safeguard app by name or OAuth client ID, and select it.
• Choose Trusted, Limited, or Specific Google data (the narrowest that allows the BigQuery read-only scope), then click Continue and Finish.
• Check API controls › Settings: if it is set to Don't allow users to access any third-party apps, the app must be configured as above before users can approve it.

1. On Compliance › Connectors, open Google BigQuery, click Connect and choose OAuth.
2. Sign in to Google BigQuery and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for https://www.googleapis.com/auth/bigquery.readonly.
3. You return to Safeguard, and the card shows Verified once the first check succeeds.

Connect with an API token

1. In Google BigQuery:

   1. Preferred: connect with OAuth from Safeguard's form (scope https://www.googleapis.com/auth/bigquery.readonly) instead of pasting a credential.
   2. To use a service account instead: in the Google Cloud console open the Service accounts page, select your project and click the email address of the service account to use.
   3. Click the Keys tab, click Add key › Create new key, select JSON, and click Create. The key file downloads once.
   4. Grant the service account the BigQuery Data Viewer role (roles/bigquery.dataViewer) on the datasets or tables Safeguard should read, and no broader role.

   Where to find the other values:

   • Account / Org / Workspace (optional): The Google Cloud project ID you select on the Service accounts page.

   Google BigQuery shows the secret only once, so copy it before you leave the page.

   Google BigQuery's public documentation does not cover every step.

   Source: docs.cloud.google.com, knowledge.workspace.google.com, docs.cloud.google.com, checked 2026-10-07.

2. On Compliance › Connectors, open Google BigQuery, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Google BigQuery yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Data Export connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks