Infisical

Connect Infisical to collect infrastructure evidence with automated compliance tests, switched on per workspace.

Step-by-step guide: Connect Infisical.

Connect with an API token

1. In Infisical:

   1. In your Infisical organization, go to Access Control › Machine Identities and select Create.
   2. Enter a Name (for example Safeguard) and choose an organization Role, then create the identity. It is configured with Universal Auth by default.
   3. On the identity's page, open the Authentication section, select Add Client Secret, optionally enter a Description, TTL (0 means it never expires) and Max Number of Uses, and create it.
   4. Copy the client secret right away, and copy the identity's Client ID.
   5. The machine identity assumes an organization-level role; roles are configured in Access Control › Roles.

   Where to find the other values:

   • Client ID: The machine identity's Universal Auth settings show the Client ID (non-sensitive).
   • Instance URL (optional): Leave blank for https://app.infisical.com; use https://eu.infisical.com for the EU cloud.

   Infisical's public documentation does not cover every step.

   Audit logs need Infisical's Pro plan. The custom-role editor labels, where the Organization ID is shown, and whether the client secret is shown only once were not on the fetched page. Verification: the read-only custom role (Members, Identities, Audit Logs read) and the project Secret Rotation read role were not on the fetched page and were removed.

   Source: infisical.com, checked 2026-10-07.

   The permissions Safeguard needs: Machine identity (Universal Auth), Organization: Member read, Organization: Identity read, Organization: Audit Logs read, Project: Secret Rotation read (no secret access). Needs Infisical's Pro (audit logs) plan.

2. On Compliance › Connectors, open Infisical, click Connect, choose API token and fill in:

   Field	What to enter
   Client ID	Required.
   Client secret	Required. Stored encrypted and never shown again.
   Organization ID	Required.
   Instance URL (optional)	Leave blank to use https://app.infisical.com (EU: https://eu.infisical.com; or your own server).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Infisical and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks