OneTrust Vendorpedia
Connect OneTrust Vendorpedia to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect OneTrust Vendorpedia to collect vendor procurement evidence with automated compliance tests, switched on per workspace.
| Category | Vendor Procurement |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| OneTrust Vendorpedia's guide | developer.onetrust.com |
Connect with an API token
-
In OneTrust Vendorpedia:
- In OneTrust, go to Global Settings › Access Management › Client Credentials.
- On the Client Credentials tab, create a new client credential and select the SCIM scope (OneTrust offers no read-only variant; Safeguard only reads with it).
- Copy the client ID and client secret into Client ID (optional) and Client secret (optional).
- Alternatively, request a token from https://{hostname}/api/access/v1/oauth/token with grant_type client_credentials and paste it into Access token.
Where to find the other values:
- Host: The OneTrust environment URL where your account is hosted, the address you sign in to: for example app.onetrust.com, app-eu.onetrust.com, app-uk.onetrust.com, app-de.onetrust.com, app-ca.onetrust.com, app-au.onetrust.com, app-apac.onetrust.com, app-jp.onetrust.com or app-in.onetrust.com, or yourcompany.my.onetrust.com for a dedicated instance.
OneTrust Vendorpedia's public documentation does not cover every step.
Source: developer.onetrust.com, developer.onetrust.com, developer.onetrust.com, checked 2026-10-07.
The permissions Safeguard needs:
SCIM. A SCIM token can also create and change users, and OneTrust Vendorpedia has no read-only one. Safeguard only reads with it. -
On Compliance › Connectors, open OneTrust Vendorpedia, click Connect, choose API token and fill in:
Field What to enter Host Required. For example: app.onetrust.com Access token Optional. Stored encrypted and never shown again. Or, instead: Client ID (optional), Client secret (optional).
-
Click Connect with token.
Frameworks
Safeguard's automated tests read OneTrust Vendorpedia and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 2 |
| PCI DSS | Automated tests | 7.2.4, 8.2.5 | 2 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vendor Procurement connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks