GovernAtlasSubmit your product ↗
Discover platforms/Secureframe

GOVERNATLAS / PRODUCT DOSSIER

Secureframe

Secureframe describes automated evidence collection, continuous monitoring and risk management.

Explore the product ↗Add to comparison ↗

01 / CONTEXT & SCOPE

Understand the proposition.
Define the boundary.

The decision to make

Secureframe describes automated evidence collection, continuous monitoring and risk management.

What this record does not establish

Published assertions describe their source’s stated scope. They do not establish independently tested performance, certification or suitability for your organization.

3 current sources · 7 published assertions
Source coverage is a research boundary, not a quality score.

03 / DOCUMENTED EVIDENCE

Read the claim. Inspect the basis.

Each statement retains its classification and preserved source. A vendor assertion is not an independent test result.

01
vendor asserted

Secureframe's framework-offering documentation lists EU AI Act within its supported framework catalogue. It describes subscription changes through an account or customer-success manager. Catalogue availability is a vendor-described workflow offering, not an audit, certification or legal determination for a customer.

Source, dates & preserved provenanceSecureframe — Supported framework catalogue ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: fece5f12f7282103019c01e21d3e4fd88873087b9761a8854dc9aa5366a337ea

The hash identifies the preserved capture. The live source may have changed.

02
vendor asserted

Secureframe's framework-offering documentation lists GDPR within its supported framework catalogue. It describes subscription changes through an account or customer-success manager. Catalogue availability is a vendor-described workflow offering, not an audit, certification or legal determination for a customer.

Source, dates & preserved provenanceSecureframe — Supported framework catalogue ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: fece5f12f7282103019c01e21d3e4fd88873087b9761a8854dc9aa5366a337ea

The hash identifies the preserved capture. The live source may have changed.

03
vendor asserted

Secureframe's framework-offering documentation lists ISO 27001 within its supported framework catalogue. It describes subscription changes through an account or customer-success manager. Catalogue availability is a vendor-described workflow offering, not an audit, certification or legal determination for a customer.

Source, dates & preserved provenanceSecureframe — Supported framework catalogue ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: fece5f12f7282103019c01e21d3e4fd88873087b9761a8854dc9aa5366a337ea

The hash identifies the preserved capture. The live source may have changed.

04
vendor asserted

Secureframe's framework-offering documentation lists SOC 2 within its supported framework catalogue. It describes subscription changes through an account or customer-success manager. Catalogue availability is a vendor-described workflow offering, not an audit, certification or legal determination for a customer.

Source, dates & preserved provenanceSecureframe — Supported framework catalogue ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: fece5f12f7282103019c01e21d3e4fd88873087b9761a8854dc9aa5366a337ea

The hash identifies the preserved capture. The live source may have changed.

05
vendor asserted

Secureframe's trust center lists a requestable ISO 27001:2022 certificate. Its public listing does not establish the certificate number, issuer, expiry, covered legal entities or ISMS scope; GovernAtlas has not inspected the certificate.

Source, dates & preserved provenanceSecureframe — Trust center: report and certificate availability ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: b192ebf246843eb5faeeda5e530b3b2ea3ce1b1377b4f7af28d5ac1f91a2919a

The hash identifies the preserved capture. The live source may have changed.

06
vendor asserted

Secureframe's trust center lists a requestable SOC 2 Type 2 report for August 1, 2025 through July 31, 2026. GovernAtlas preserved the public listing, not the restricted report; the opinion, exceptions, covered system and subsequent changes have not been independently reviewed.

Source, dates & preserved provenanceSecureframe — Trust center: report and certificate availability ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: b192ebf246843eb5faeeda5e530b3b2ea3ce1b1377b4f7af28d5ac1f91a2919a

The hash identifies the preserved capture. The live source may have changed.

07
vendor asserted

Secureframe describes automated evidence collection, continuous monitoring and risk management. Scope: vendor documentation only; edition and availability boundaries require confirmation.

Source, dates & preserved provenanceSecureframe — official product or documentation page ↗

Authority: vendor owned
Observed 2026-10-15 · Reviewed 2026-10-15 · current until 2026-11-14

Artifact SHA-256: c52ee744edda149960b3eb4c202c60c58f6a5129da95eef6abcef55c9f348f33

The hash identifies the preserved capture. The live source may have changed.

Source register

Secureframe — Supported framework catalogue ↗vendor owned · captured 2026-11-02
Brand asset provenance

Organization identity asset from its official website; inclusion does not imply endorsement.

Official website ↗ · Original asset ↗

04 / BEFORE YOU COMMIT

Better questions.
A clearer decision.

Resolve these with the provider and your own evaluation team.

01

Which checks are automated and how are manual evidence exceptions assigned and reviewed?

02

What deployment, data retention and access-control evidence applies to the intended use?

03

Which underlying assurance documents are available for inspection?

Regulatory applicability requires a separate, current determination. Inclusion is not certification.

COMPLIANCE / CLAIMS, SCOPE & GAPS

Start with the requirement.
Inspect the support.

Prepare your vendor review ↗

These labels describe this dossier’s current evidence coverage. A published mention may be a framework mapping, a qualified assertion or a limitation; it is not a compliance finding.

GDPR

Published mention available

EU personal data protection

Customer compliance workflow support

Confirm the purchased module, current control mapping, evidence requirements and independent reviewer responsibilities.

Read the source-attributed statement

Secureframe's framework-offering documentation lists GDPR within its supported framework catalogue. It describes subscription changes through an account or customer-success manager. Catalogue availability is a vendor-described workflow offering, not an audit, certification or legal determination for a customer.

vendor asserted

Secureframe — Supported framework catalogue ↗

Explore GDPR evidence ↗

SOC 2

Published mention available

Assurance report · not a law

Vendor-reported assurance

Request the report and any bridge letter; reconcile its end date with material changes and customer controls.

Customer compliance workflow support

Confirm the purchased module, current control mapping, evidence requirements and independent reviewer responsibilities.

Read the source-attributed statement

Secureframe's framework-offering documentation lists SOC 2 within its supported framework catalogue. It describes subscription changes through an account or customer-success manager. Catalogue availability is a vendor-described workflow offering, not an audit, certification or legal determination for a customer.

vendor asserted

Secureframe — Supported framework catalogue ↗
Read the source-attributed statement

Secureframe's trust center lists a requestable SOC 2 Type 2 report for August 1, 2025 through July 31, 2026. GovernAtlas preserved the public listing, not the restricted report; the opinion, exceptions, covered system and subsequent changes have not been independently reviewed.

vendor asserted

Secureframe — Trust center: report and certificate availability ↗

Explore SOC 2 evidence ↗

ISO 27001

Published mention available

Information security management standard

Vendor-reported assurance

Request the certificate, current validity, issuer and scope statement; check whether the purchased service and locations fall inside it.

Customer compliance workflow support

Confirm the purchased module, current control mapping, evidence requirements and independent reviewer responsibilities.

Read the source-attributed statement

Secureframe's framework-offering documentation lists ISO 27001 within its supported framework catalogue. It describes subscription changes through an account or customer-success manager. Catalogue availability is a vendor-described workflow offering, not an audit, certification or legal determination for a customer.

vendor asserted

Secureframe — Supported framework catalogue ↗
Read the source-attributed statement

Secureframe's trust center lists a requestable ISO 27001:2022 certificate. Its public listing does not establish the certificate number, issuer, expiry, covered legal entities or ISMS scope; GovernAtlas has not inspected the certificate.

vendor asserted

Secureframe — Trust center: report and certificate availability ↗

Explore ISO 27001 evidence ↗

EU AI Act

Published mention available

EU artificial intelligence regulation

Customer compliance workflow support

Confirm the purchased module, current control mapping, evidence requirements and independent reviewer responsibilities.

Read the source-attributed statement

Secureframe's framework-offering documentation lists EU AI Act within its supported framework catalogue. It describes subscription changes through an account or customer-success manager. Catalogue availability is a vendor-described workflow offering, not an audit, certification or legal determination for a customer.

vendor asserted

Secureframe — Supported framework catalogue ↗

Explore EU AI Act evidence ↗

For HIPAA-regulated use, request service-specific BAA eligibility, processing scope and responsibility details. Missing evidence here does not establish noncompliance. Payment cannot alter these evidence labels.

KEEP THE RECORD USEFUL

A dossier should stand up to scrutiny.

Have a source that changes this picture? Submit it for editorial review.

Raise an evidence issue ↗