Segment
Connect Segment to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Segment to collect data export evidence with automated compliance tests, switched on per workspace.
| Category | Data Export |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Segment's guide | docs.segmentapis.com |
Connect with an API token
-
In Segment:
- Log in to the Segment App and choose the Workspace you want to connect (each Workspace needs its own token).
- Click Settings in the left menu to open Workspace Settings, go to the Access Management tab and click Tokens.
- Click +Create Token and follow the prompts. Select a Public API token (not a Config API token).
- Copy the token and store it in a secrets manager.
Where to find the other values:
- Region (optional): Use your Workspace's data residency region:
api.segmentapis.comfor US-based Workspaces,eu1.api.segmentapis.comfor EU-based Workspaces.
Segment's public documentation does not cover every step.
Segment shows the full user list only to Workspace Owners, so the token needs that role. The role picker's exact label in the token prompts was not shown on the fetched page (Workspace Owner is the role name from the connector requirements). The getting-started page does not state whether the token is shown only once. Verification: neither fetched page names the role to give the token, so the Workspace Owner role instruction was removed.
Source: docs.segmentapis.com, docs.segmentapis.com, checked 2026-10-07.
The permissions Safeguard needs:
Workspace Owner. Segment shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. -
On Compliance › Connectors, open Segment, click Connect, choose API token and fill in:
Field What to enter Access token Required. Stored encrypted and never shown again. Region (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Segment and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 3 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 3 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5 | 3 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Data Export connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks