{
  "slug": "secureframe",
  "category": "compliance-automation",
  "name": "Secureframe",
  "description": "Hosted compliance automation platform that integrates with cloud, identity and HR systems to monitor controls and collect evidence for SOC 2, ISO 27001, FedRAMP, CMMC, HIPAA and other frameworks, with AI tools for questionnaires and risk management.",
  "website": "https://secureframe.com",
  "license": null,
  "platforms": [
    "web"
  ],
  "jurisdiction": {
    "code": "US",
    "name": "United States",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "provider"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "F",
  "score": 28,
  "coverage": 100,
  "summary": "Secureframe scores 28 out of 100 (grade F) on the compliance automation criteria. It meets 1 of 8 criteria: TLS configuration. It partly meets no ads or data sales, independent audit and security headers. It does not meet open source, no trackers or telemetry, transparency report and tells users about requests. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.",
  "url": "https://privacyratings.com/compliance-automation/secureframe/",
  "markdown": "https://privacyratings.com/compliance-automation/secureframe/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://secureframe.com/privacy",
      "note": "The privacy policy names Google Analytics and describes cross-site tracking for advertising, and the website loads PostHog and HubSpot."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://secureframe.com/privacy",
      "note": "Paid service with no ads, and it says it does not sell data for money, but website activity is used for personalized advertising of its own services on other sites."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://trust.secureframe.com/",
      "note": "The trust center lists SOC 2 Type 2, ISO 27001, FedRAMP 20x and CMMC Level 2 assessments, but the full reports are only available on request."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "no",
      "evidence": "https://secureframe.com/privacy",
      "note": "No transparency report or government request policy is published. The privacy policy only says data may be disclosed in response to lawful requests by public authorities."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published policy on notifying users about data requests."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=app.secureframe.com&hideResults=on",
      "note": "Grade A+"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "partial",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=app.secureframe.com",
      "note": "Grade B (70/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    }
  },
  "tests": {
    "ssllabs": "A+",
    "observatory": "B",
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [
      {
        "name": "Google Analytics",
        "host": "www.google-analytics.com",
        "effect": "no"
      },
      {
        "name": "Google DoubleClick",
        "host": "stats.g.doubleclick.net",
        "effect": "no"
      },
      {
        "name": "HubSpot",
        "host": "js.hs-scripts.com",
        "effect": "no"
      }
    ],
    "tested_at": "2026-10-01T07:07:14.863Z"
  },
  "last_modified": "2026-10-01T07:44:20Z"
}