> ## Documentation Index > Fetch the complete documentation index at: https://docs.base44.com/llms.txt > Use this file to discover all available pages before exploring further. # Connecting a security partner with the Compliance API > Let a security partner such as Orca Security scan your Base44 workspace's security posture with the Compliance API. Choose what they see, stop access anytime. The Compliance API lets the security tools your company already uses check your Base44 workspace, the same way they check your other cloud services. Your security partner gets a read-only view of how your workspace is set up, such as your apps, members, SSO and security findings, so your security team sees Base44 alongside everything else. To connect a partner, you create a workspace API key, choose what it can read, and send it to them. > [!WARNING] > > **Before you connect a partner:** > > * You need the [Enterprise plan](https://docs.base44.com/Enterprise/Base44-for-enterprises.md#choosing-business-or-enterprise) to use the Compliance API. It isn't included in the Business plan. > * You need to be a workspace owner or admin to create the API key. *** ## Supported security partners You can connect these security partners today. Each partner's setup guide explains where to enter your Base44 key in their product. | Partner | Type of security | Setup guide | | - | - | - | | Orca Security | Cloud security. Orca is the design partner for the Compliance API. | [Connecting Base44 to Orca](https://docs.orcasecurity.io/docs/connecting-base44) | | Token Security | Identity security | [Connecting Base44 to Token Security](https://docs.token.security/docs/base44) | | Noma Security | AI security | Coming soon | More partners are coming soon: Upwind (security), Pluto (AI workspace security) and Zenity (AI agent security). For the latest list of partners and their setup guides, see the [Compliance API page on base44.com](https://base44.com/compliance-api). *** ## Choosing permissions When you create the key, you choose which kinds of data your partner can read. Choose only what your partner needs. | Permission | What your partner can read | | - | - | | **Read compliance inventory** | Your workspace's security settings, apps, domains, API key details, data structure, backend functions, secret names, integrations and agents. Your partner always needs this one. | | **Read compliance member directory** | Your workspace members, including their email addresses, roles, MFA status and when they were last active. | | **Read compliance security findings** | Security findings from your apps' security scans, including findings from other scanners you've connected, such as Wiz. | > [!NOTE] > > **How the permissions work:** > > * Your partner always sees your whole workspace, even if you limit the key to selected apps, so their report doesn't miss anything. > * If you leave out a permission, your partner's report shows that data as not shared, rather than as empty. *** ## Connecting your partner Create a workspace API key with the compliance permissions, then send it to your partner. **To connect a security partner:** 1. Click your workspace name at the bottom left and click **Settings**. 2. Click **Secrets** in the sidebar. 3. Click **+ Create API Key**. 4. Enter a name that says who the key is for, for example `Orca Security`. 5. Under **Permissions**, open **Workspace** and select **Read compliance inventory**, plus any other compliance permissions you want to share. ![A screenshot of the Create API Key dialog with the 3 compliance permissions outlined](https://mintcdn.com/base44/C9r8Uh2ycZtSXfdp/images/enterprise-secrets-compliance-permissions.png?fit=max\&auto=format\&n=C9r8Uh2ycZtSXfdp\&q=85\&s=7d861b94ed2b5e99ac14008dbac12b40) Choosing compliance permissions for your partner's key 6. Click **Create Key**. 7. Click the copy icon next to your key to copy it. It's only shown once, so copy it before you click **Done**. ![A screenshot of the API Key Created window with the copy button outlined next to the new key](https://mintcdn.com/base44/C9r8Uh2ycZtSXfdp/images/enterprise-secrets-compliance-key-created.png?fit=max\&auto=format\&n=C9r8Uh2ycZtSXfdp\&q=85\&s=37515a7e17de09605b8b0fb35fbd6da9) Copying your new key to send to your partner 8. Send the key to your security partner through a secure channel, and finish the setup in their product using their setup guide. *** ## What stays private Your partner sees how your workspace is set up, never your content or credentials. Whatever permissions you choose, the Compliance API never shares: * The data in your apps, such as records and uploaded files * Your chats with the AI chat and your agents' conversations * Secret values, API keys, tokens and passwords * Your backend function code and your agents' instructions * Your app users' identities * MFA details, such as phone numbers and authenticator codes > [!NOTE] > > Your partner can only read. The Compliance API can't change or delete anything in your workspace. *** ## Seeing your partner's scans Your partner's reads are recorded in your workspace's [audit logs](https://docs.base44.com/developers/references/audit-logs-api/get-started/overview.md) as `workspace.compliance_api.read`. Each record names the API key that was used and the partner that called, so you can see when scans run and investigate if a key is ever misused. To keep your audit logs readable, Base44 records each kind of read once an hour, not every request. You see at most one record an hour for each key, partner, type of data read, and result (succeeded or failed), so the number of records doesn't match the number of requests. *** ## Managing your partner's key You can rename your partner's key, pause their access, or remove it for good from your **Secrets** page. When you disable or delete the key, your partner can't read your workspace from that moment. **To manage your partner's key:** 1. Click your workspace name at the bottom left and click **Settings**. 2. Click **Secrets** in the sidebar. 3. Click the **More actions** icon next to your partner's key. ![A screenshot of a key's More actions menu open on the Secrets page with Edit, Disable key and Delete key](https://mintcdn.com/base44/C9r8Uh2ycZtSXfdp/images/enterprise-secrets-compliance-key-menu.png?fit=max\&auto=format\&n=C9r8Uh2ycZtSXfdp\&q=85\&s=aaca62dd43d165ff9052543403732397) Managing your partner's key from the More actions menu 4. Do one of the following: > [accordion] Edit the key > > Click **Edit** to change the key's name, description or permissions. To change what your partner can see, select or clear the compliance permissions, then save. Your partner keeps using the same key, so you don't need to send them anything. > [accordion] Disable the key > > Click **Disable key** to pause your partner's access without removing the key. Their scans stop straight away. To let them back in, click **Enable key** in the same menu. > [accordion] Delete the key > > Click **Delete key**, then click **Delete Key** to confirm. Your partner's access stops straight away, and you can't undo it. To connect the partner again, create a new key and send it to them. *** ## FAQs Click a question below to learn more about connecting a security partner. > [accordion] Can I connect more than one security partner? > > Yes. Create a separate key for each partner and name it after them. That way you can stop one partner's access without affecting the others, and your audit logs show which partner made each scan. > [accordion] How often does my partner scan my workspace? > > Your partner decides how often to scan, usually once a day. Each scan reads your workspace's current setup, and you can see when scans run in your audit logs. > [accordion] What happens if my workspace leaves the Enterprise plan? > > Your partner can no longer read your workspace, because the Compliance API is only available on the Enterprise plan. Their scans start working again if your workspace returns to the Enterprise plan, as long as the key hasn't been deleted. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.