Zitadel
Connect Zitadel to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Zitadel to collect identity & sso evidence with automated compliance tests, switched on per workspace.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Zitadel's guide | zitadel.com |
Connect with an API token
-
In Zitadel:
- In the ZITADEL Console, navigate to Service Accounts and click New.
- Enter a username and display name and create the service account.
- In the service account's detail view, click the Personal Access Token menu point, then click New.
- Set an optional expiration date (or leave it blank for no expiration) and copy the token from the dialog; you will not see it again.
- Go to your organization's detail page, click the + button in the top right corner, search for the service account, and assign it a manager role (ZITADEL's guide uses Org Owner as the example; see ZITADEL Permissions for the other roles).
Where to find the other values:
- Instance URL: The https address of your ZITADEL instance, the same host as the Console.
Zitadel shows the secret only once, so copy it before you leave the page.
Zitadel's public documentation does not cover every step.
ZITADEL's guide only shows Org Owner, which is a full admin role; the read-only viewer roles (ORG_OWNER_VIEWER, IAM_OWNER_VIEWER) named in the earlier draft were not on the fetched page. Where the Organization ID is shown was not on the fetched page.
Source: zitadel.com, checked 2026-10-07.
The permissions Safeguard needs:
ORG_OWNER_VIEWER,IAM_OWNER_VIEWER. -
On Compliance › Connectors, open Zitadel, click Connect, choose API token and fill in:
Field What to enter Instance URL Required. Your own server: an https address reachable from the internet. Personal access token Required. Stored encrypted and never shown again. Organization ID (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Zitadel and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3 | 4 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.17, A.5.18, A.6.5, A.8.2, A.8.5 | 4 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 8.4.2 | 4 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-03, PR.AA-05 | 4 |
These tests are switched on per workspace by the Safeguard team.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks