Connect Google Cloud Profiler.
Connect profiles from one Google Cloud project. Perfloop uses a dedicated service account to read profiles and stores the ones it uses for performance work.
Updated 18 September 2026.
Access you need
A project IAM administrator runs the commands from Setup to create a dedicated service account for your Perfloop account and Google Cloud project. Its custom role contains only cloudprofiler.profiles.list. It grants no access to other Google resource types, such as buckets, databases, secrets, or VMs.
- cloudprofiler.profiles.listLists Cloud Profiler profiles for the selected project. No write permission.
- Workload Identity impersonationPerfloop uses Workload Identity to act as the dedicated reader with short-lived credentials. You do not need to upload a service-account key or authorize your personal Google account.
Perfloop uses the credential to read profiles. Models and execution sandboxes do not receive it.
Setup
1 · select the project
In Perfloop Setup, choose Google Cloud Profiler and enter the project that holds your profiles.
2 · install the dedicated reader
Run the Cloud Shell commands from Setup in your selected project. They create the service account, assign its read permission, and allow Perfloop to use it through Workload Identity.
Check the project, service account, and permissions in the generated commands before you run them.
3 · validate the read
Return to Setup and validate the connection. Perfloop uses the service account to request the project's profiles. It saves the connection after this check passes.
Data Perfloop reads
Google returns profiles for the whole project. Perfloop then selects the workload, profile type, and time window needed for the query. To restrict which profiles Perfloop can receive from Google, use a separate project. A workload or time filter in Perfloop does not reduce the service account's project access.
Perfloop stores selected profiles in pprof format. Its models can use profile tools to read stack samples, function and file names, build IDs, and labels. Review these fields before connecting a project if they contain sensitive names or identifiers.
Change or remove access
To change the project or service account, run a new install from Setup and validate it. The existing connection stays active until the new one passes validation. To stop reads, remove the Workload Identity binding or the service account's custom role in Google Cloud. This does not delete profiles already stored in Perfloop.
Provider documentation
Security questions: security@perfloop.ai