Shuffle
Connect Shuffle to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Shuffle to collect security automation evidence with automated compliance tests, switched on per workspace.
| Category | Security Automation |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Shuffle's guide | shuffler.io |
Connect with an API token
-
In Shuffle:
- Log in to Shuffle.
- Open https://shuffler.io/settings (or /settings on your own instance) and copy your API key, a 36-character value.
Where to find the other values:
- Base URL (optional): Cloud: https://shuffler.io. Self-hosted: the address of your own Shuffle instance (https://<endpoint>:<port>).
Shuffle's public documentation does not cover every step.
Source is Shuffle's official docs repository (rendered at shuffler.io/docs/API, which did not load for fetching). The docs give the settings URL but no button labels; the key carries the user's own rights, so the user must be an org admin. Shuffle documents no read-only key. In multi-tenant setups the tenant is chosen with the Org-Id header. Verification: the docs say admin rights are needed to regenerate a key via POST, not to list users, so the admin claim was removed from the steps; the docs do not say whether the key can be viewed again.
Source: raw.githubusercontent.com, checked 2026-10-07.
The permissions Safeguard needs:
organization admin. Shuffle shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. -
On Compliance › Connectors, open Shuffle, click Connect, choose API token and fill in:
Field What to enter API key Required. Stored encrypted and never shown again. Base URL (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Shuffle and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.18 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 2 |
| PCI DSS | Automated tests | 7.2.1, 8.2.5 | 2 |
| NIST CSF 2.0 | Automated tests | PR.AA-01 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Security Automation connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks