Cloud deployment
What the Cloud tab's deployment cards do today, which credentials they ask for, and how to deploy Safeguard into your own cloud.
What it does
The Cloud tab of Integrations lists the clouds and platforms you can run Safeguard in: the cloud marketplaces (AWS, Azure, Google Cloud, Oracle Cloud), the direct cloud cards (AWS, Google Cloud, Azure, IBM Cloud, Oracle Cloud) and, marked Coming soon, other clouds and Kubernetes platforms.
- Marketplaces: choose a region and deploy. Safeguard records the deployment request and opens the marketplace listing in a new tab, where you finish the launch in your own cloud account.
- Direct cloud cards: these dialogs do not start a deployment yet. They show example commands for your own cloud CLI, and the keys you type into them stay in your browser: they are not sent to or stored by Safeguard.
To run Safeguard in your own cloud account, contact Safeguard (hi@safeguard.sh); the deployment is set up with you.
Public vs private
This does not apply: a deployment always runs in your own cloud account.
Supported auth methods
| Card | What the dialog asks for | Sent to Safeguard? |
|---|---|---|
| Marketplaces (AWS, Azure, Google Cloud, Oracle Cloud) | A region | Only the provider and region |
| AWS | Access key ID and secret access key | No |
| Google Cloud | A service account JSON key (optional) | No |
| Azure | Subscription ID, tenant ID, client ID and client secret | No |
| IBM Cloud | An IBM Cloud API key and resource group | No |
| Oracle Cloud | Tenancy OCID, user OCID and API key fingerprint | No |
Permissions required
Marketplace deployment
| Permission | Required? | Why |
|---|---|---|
| Permission in your cloud account to subscribe to a marketplace listing and launch its image | Required | You finish the launch in the marketplace, in your own account |
Safeguard receives no cloud credential for a marketplace deployment.
Direct cloud cards
| Permission | Required? | Why |
|---|---|---|
| None for Safeguard | Required: nothing | The dialogs do not send any key to Safeguard; do not paste long-lived production keys into them |
Token types
| Credential | Works? | Notes |
|---|---|---|
Your own cloud CLI login (for example aws configure, gcloud auth login, az login) | Yes, on your machine | Use it to run any deployment commands yourself |
| Long-lived access keys pasted into a direct cloud dialog | Not needed | They are not used by Safeguard |
Expiry: not applicable; Safeguard stores no cloud credential for deployments.
What we never need: root or owner credentials, or any cloud key sent to Safeguard for a deployment.
Step-by-step setup
In your cloud
- Decide the account, subscription or project and the region Safeguard should run in.
- Make sure your user can subscribe to marketplace listings there (for a marketplace deployment).
Or with the cloud CLI
Run deployment commands only with your own CLI login, on your own machine. The Safeguard team gives you the exact steps for your environment.
In Safeguard
- Open Integrations and choose the Cloud tab.
- In the Marketplaces row, choose AWS, Azure or GCP, pick a region and deploy.
- Finish the launch in the marketplace tab that opens.
Webhooks and triggers
This integration has no webhooks.
What we read and store
- Read: nothing from your cloud account.
- Stored: for a marketplace deployment, the provider, the region and the deployment record. Keys typed into the direct cloud dialogs are not stored.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Deployment recorded ... launch details coming from the <marketplace>. | The marketplace returned no launch link | Open the marketplace listing yourself, or contact Safeguard |
| Nothing deploys after a direct cloud card says the deployment started | The direct cloud dialogs do not start a deployment yet | Use a marketplace, or contact Safeguard |
Rotation and disconnect
- Rotate: nothing to rotate; Safeguard stores no cloud credential for deployments.
- Disconnect: remove the deployment from your cloud account with your cloud's own console or CLI, and cancel the marketplace subscription if you no longer need it.
Vendor references
- AWS Marketplace: subscribing to products, checked 2026-10-16.
- Azure Marketplace overview, checked 2026-10-16.
- Google Cloud Marketplace documentation, checked 2026-10-16.
Microsoft Project (Planner)
Create Microsoft Planner tasks from Safeguard. The Microsoft Entra app and Graph permissions Safeguard needs, and step-by-step setup.
Cloud provider catalog
How the Cloud tab's provider catalog works: which clouds have their own connector, which connect through a generic connector, and how to ask for the rest.