BoldSign
Connect BoldSign to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect BoldSign to collect digital signature evidence with automated compliance tests, switched on per workspace.
| Category | Digital Signature |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| BoldSign's guide | developers.boldsign.com |
Connect with an API token
-
In BoldSign:
- Sign in to BoldSign.
- In the app's left navigation pane, go to the API menu item and select API Key.
- Click Generate API Key; in the Generate API Key dialog, click Generate Token (create it in the Live environment, not Sandbox).
- Copy the API key.
Where to find the other values:
- Region (optional): Leave blank for the default API host
https://api.boldsign.com; BoldSign's regional hosts were not documented on the fetched pages.
API access must be part of your BoldSign plan. All scopes are included when you generate an API key and this is not customizable, so there is no read-only key. Up to 4 keys, at most 2 per environment (Live or Sandbox). Not sourced: whether the full user list needs an admin account, whether the key is shown only once, and EU/CA regional API hosts. The optional access token field would come from BoldSign's OAuth 2.0 flow, not documented here.
Source: developers.boldsign.com, developers.boldsign.com, checked 2026-10-07.
The permissions Safeguard needs. BoldSign shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. BoldSign issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time.
-
On Compliance › Connectors, open BoldSign, click Connect, choose API token and fill in:
Field What to enter API key Optional. Stored encrypted and never shown again. Region (optional) — Or, instead: Access token (optional).
-
Click Connect with token.
Frameworks
Safeguard's automated tests read BoldSign and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 3 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 3 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5 | 3 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Digital Signature connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks