Menu
Secureframe
Secureframe is a compliance automation platform for SOC 2 and dozens of other commercial and government frameworks. It connects cloud, identity, and development tools to collect evidence, then adds risk, policy, audit, and questionnaire workflows.
Best for: Teams that want expert guidance on named Fundamentals, Complete, or Defense packagesWatch for: SSO and SCIM require quote-based Complete; Fundamentals starts at a published $7,500/year before scope and services Read our Secureframe review →
AI and MCP
MCP server: Official. Access: Read, write and delete. Checked 12 Oct 2026.
How much does Secureframe cost?
Secureframe publishes plan prices on its site. Vendr reports contracts of $7,733 to $32,575 a year. Your price depends on plan scope, headcount, services, and contract term.
Price source: view reported prices · checked 2026-09-30
Reported Secureframe contracts against similar platforms
- Secureframe$7,733–$32,575 · median $20,000
- Hyperproof$22,215–$70,000 · median $41,400
- Drata$9,415–$68,250 · median $25,000
- Vanta$7,500–$57,207 · median $20,000
Published prices (1)
| Listed item | Price | Scope |
|---|---|---|
| Fundamentals | From $7,500 / year | One compliance framework; includes evidence collection, policy management, personnel management, risk management and a trust center. The public starting price does not establish a buyer-specific headcount band or total. · Source |
As of 2026-10-02 Secureframe publishes a $7,500/year Fundamentals starting price; Complete and Defense remain quote-based. SSO and SCIM Connections begin on Complete; Additional Workspaces is an add-on. The Fundamentals floor does not establish a full contract price. Plan source
Ask for the first-year total, renewal cap, implementation charge, required add-ons, and separate audit fee in writing.
What does Secureframe do?
Secureframe was founded in 2020. Secureframe is led by Shrav Mehta. Secureframe is headquartered in San Francisco, California, United States.
What does the Secureframe device agent check?
On macOS, Windows, supported Linux distributions, the documented checks include disk encryption, password policy, device compliance settings. Support varies by operating system.
Device make, model, operating system, serial number, memory, CPU, device name, owner name, and compliance settings. Secureframe says the read-only agent does not access personal files.
Read the vendor's device documentation · checked 2026-09-29
Evidence collection
Available · Automated evidence collection across 300+ native integrations.
Scope and limits
Automated evidence collection across 300+ native integrations. Fundamentals includes one custom automated test; Complete lists unlimited custom automated tests and custom integrations. Package listing is not evidence that a custom source supplies the required field or history.
Auditor workspace
Available · Audits Module supports requests, comments and module-level read access.
Scope and limits
Audits Module supports requests, comments and module-level read access. Evidence visibility in Audit Mode requires its completion date to fall within the selected observation window; live results and window changes can change readiness. The intended CPA must inspect historical samples and exports.
Trust center
Available · Trust Center ships free on the Fundamentals tier; an 'Advanced Trust Center' is bundled into Complete or sold as an add-on.
Security questionnaires
Available · AI-powered ('Trust AI') questionnaire automation; Advanced Questionnaire Automation is gated to the Complete tier.
Enterprise administration
Partial · The current pricing table adds SSO & SCIM Connections on Complete and lists Additional Workspaces as an add-on.
Scope and limits
The current pricing table adds SSO & SCIM Connections on Complete and lists Additional Workspaces as an add-on. Fundamentals does not include SSO/SCIM, and public evidence still does not establish granular RBAC, so the roll-up remains partial.
SCIM provisioning
Available · Secureframe's support documentation includes SCIM provisioning for account lifecycle management, while the current pricing page places SSO & SCIM Connections on Complete rather than Fundamentals.
Continuous control testing
Available · Continuous Control Monitoring is included on both Fundamentals and Complete tiers.
Multi-framework support
Available · Vendor states each framework gets its own control mapping, automated tests, and policy requirements, with a shared common-controls layer to cut duplicate work across frameworks.
Funding history
Secureframe has raised $79M total, anchored by a $56M Series B led by Accomplice (with Kleiner Perkins, Optum Ventures and others) in February 2022; no new round has been publicly reported since.
How does Secureframe compare with Vanta, Drata, Sprinto?
| Attribute | SecureframeThis profile | Comp AI | Iru | Vanta | Drata | Sprinto |
|---|---|---|---|---|---|---|
| Best for | Teams that want expert guidance on named Fundamentals, Complete, or Defense packages | Engineering-led teams that value inspectable code or the option to self-host | Teams seeking SOC 2 automation and device management in one platform | Cloud-native SaaS teams on mainstream stacks that value a broad integration catalog | Growth-stage SaaS teams on mainstream stacks that expect to add frameworks over time | Early- to growth-stage SaaS teams seeking guided first-audit preparation |
| Observed price | $7,733–$32,575 / year | Not published | Up to $15,000 / year for Compliance Automation | $7,500–$57,207 / year | $9,415–$68,250 / year | Not published |
| G2 rating | 4.7/5 (826 reviews) | 4.7/5 (73 reviews) | 4.7/5 (853 reviews) | 4.6/5 (2,728 reviews) | 4.7/5 (1,397 reviews) | 4.7/5 (1,685 reviews) |
| Integrations | 300+ published | 590+ published | Not published | 400+ published | 300+ published | 300+ published |
| Frameworks | 8 listed | 11 listed | 11 listed | 8 listed | 10 listed | 8 listed |
| Onboarding | guided | guided | guided | guided | guided | bundled expert |
| Auditors here | 12 | 4 | Not published | 36 | 45 | 39 |
| Trust center | Listed | Listed | Listed | Listed | Listed | Listed |
Will Secureframe connect to your stack?
Secureframe reports 300+ integrations. Check the exact fields, tests, permissions, and plan coverage for each tool you need.
Check 19 named tools
| Tool | Coverage | Scope |
|---|---|---|
| AWS | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Google Cloud | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Microsoft Azure | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Microsoft Entra ID | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Google Workspace | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Microsoft 365 | Listed integration | Secureframe documents an Office 365 native connection that pulls account data; confirm which tenant, user and security fields are in scope and available on the quoted plan. Source |
| GitLab | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Slack | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Rippling | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Gusto | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| CrowdStrike | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Kandji | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Microsoft Intune | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Datadog | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Snyk | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| Cloudflare | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| HubSpot | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| JumpCloud | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
| ServiceNow | Listed integration | Secureframe documents a direct product connection or evidence sync for this tool; supported fields, tests and plan availability vary. Source |
Which frameworks does Secureframe support?
- SOC 2Secureframe says
- ISO 27001Secureframe says
- HIPAASecureframe says
- PCI DSSSecureframe says
- GDPRSecureframe says
- CMMCSecureframe says
- FedRAMPSecureframe says
- ISO 42001Secureframe says
Who does what in a SOC 2 with Secureframe?
Secureframe
Organizes the listed control, evidence, and audit workflows.
Your team
Owns policies, control decisions, exceptions, and approval of shared evidence.
The CPA firm
Sets audit scope, tests controls independently, and issues the SOC 2 report.
Secureframe is not an auditing firm. It does not issue the SOC 2 report itself; it runs an Audit Partner program that connects customers with independent CPA firms, and gives those auditors an in-platform Audit Module to review mapped evidence and comment directly on tests.
Which auditors work with Secureframe?
12 licensed audit firms in our directory list Secureframe experience. Listing experience is not an endorsement.
| Firm | Licence | Peer review |
|---|---|---|
| A-LIGN | Licensed CPA | Pass |
| Sensiba LLP | Licensed CPA | Pass |
| 360 AdvancedPublished Type 2 fee: $10,000–$80,000 | Licensed CPA | Pass |
Questions to ask in a Secureframe demo
- Which parts of enterprise administration require another tool or service?
- What renewal increase and minimum contract term should we put in writing?
- Is the SOC 2 audit contracted with a separate CPA firm, and what does that firm charge?
Secureframe FAQ
Where is Secureframe based?
Secureframe is headquartered in San Francisco, California, United States.
Who runs Secureframe?
Shrav Mehta is the CEO of Secureframe.
Who founded Secureframe?
Shrav Mehta founded Secureframe in 2020.
Does Secureframe include the SOC 2 audit?
Secureframe is not an auditing firm. It does not issue the SOC 2 report itself; it runs an Audit Partner program that connects customers with independent CPA firms, and gives those auditors an in-platform Audit Module to review mapped evidence and comment directly on tests. A licensed CPA firm issues the SOC 2 report.
Is Secureframe itself SOC 2 compliant?
Supporting a buyer's SOC 2 program does not establish that Secureframe holds a current SOC 2 report. Ask for the vendor's current report during security review.
What does the Secureframe device agent check?
The vendor documents checks for disk encryption, password policy, device compliance settings. Supported checks vary by operating system; read its device documentation before installation.
Secureframe on SOC2Auditors
More guides and comparisons (2)
Sources 42 records · last read 2026-10-05
These links show what we checked and when.
| Establishes | Source | Retrieved |
|---|---|---|
| Company page gives 2020 founding and $79M funding total. | Secureframe Vendor docs | 2026-09-29 |
| Company page lists San Francisco headquarters, private status and employee band. | Secureframe on LinkedIn Marketplace | 2026-09-29 |
| Company founder biography identifies Shrav Mehta as founder and CEO. | Secureframe Press | 2026-09-29 |
| Company announcement confirms $56M Series B led by Accomplice and $79M cumulative funding. | Secureframe Press | 2026-09-29 |
| Fundamentals starts at $7,500/year and includes one custom automated test; Complete and Defense request a quote, and Complete lists unlimited custom automated tests and custom integrations. SSO & SCIM Connections start on Complete, and Additional Workspaces is an add-on. The published floor does not establish a complete buyer-specific contract price. | Secureframe Vendor docs | 2026-09-29 |
| Current quote-only feature table; SSO & SCIM Connections begin on Complete, and Additional Workspaces is an add-on. | Vendor docs Vendor docs | 2026-08-11 |
| Current account-settings documentation indexes SCIM provisioning, IdP login, and role-permission guidance for Secureframe administrators. | Secureframe Vendor docs | 2026-08-11 |
| Secureframe has 300+ native integrations. | Vendor docs Vendor docs | 2026-07-24 |
| Full list of 35 supported frameworks across commercial, federal, privacy, and AI categories, each with its own control mapping. | Vendor docs Vendor docs | 2026-07-24 |
| G2 rating of 4.7 out of 5 stars across 809 reviews. | G2 Review platform | 2026-07-24 |
| Independent wire confirmation of the $56M Series B (Feb 23, 2022), bringing total funding to $79M. | PR Newswire Press | 2026-07-24 |
| Describes the in-platform Audit Module used for auditor/customer collaboration on specific tests. | Vendor docs Vendor docs | 2026-07-24 |
| Observed price bands: roughly $12,000-$20,000/year for a single framework at a small company, $25,000-$35,000/year for a mid-market two-framework deal. | Vendr Third-party estimate | 2026-07-24 |
| Secureframe's advertised 'EU' data center is AWS eu-west-2, located in London, UK, not the EU, which is a real limitation for EU-data-residency buyers. | Orbiq (editorial comparison) Editorial | 2026-07-24 |
| Customer-questionnaire response workflow and usage evidence; product claims are not independent performance tests. | Secureframe Vendor docs | 2026-08-30 |
| Live pricing page names Fundamentals, Complete, and Defense and places SSO & SCIM Connections on Complete, but publishes no dollar amount as of 2026-09-08. | Secureframe Vendor docs | 2026-09-08 |
| Vendor-claimed HIPAA workflow: privacy-officer assignment, training, vendor PHI tracking, BAA sending, and evidence submission to auditors. | Secureframe Vendor docs | 2026-08-31 |
| Customers can select an audit firm, set an observation window, grant module-level read access, and exchange evidence and comments with auditors in Secureframe's Audits Module. This is exact, current CPA handoff/workspace evidence. | Secureframe Vendor docs | 2026-08-31 |
| Live pricing page names Fundamentals, Complete, and Defense and places SSO & SCIM Connections on Complete, but publishes no dollar amount as of 2026-09-08. | Secureframe Vendor docs | 2026-09-08 |
| Not established. Secureframe documents sending BAAs to a buyer's business associates; the reviewed product page does not establish Secureframe's own PHI or customer BAA terms. | SOC2Auditors.org Editorial | 2026-08-31 |
| Current support index names Secureframe integrations by cloud, identity, HR, endpoint, development, and security category. | Secureframe Vendor docs | 2026-09-24 |
| Onboarding documentation identifies GCP, Google Workspace, Rippling, Gusto, CrowdStrike, Kandji and Snyk integrations used for evidence collection. | Secureframe Support Vendor docs | 2026-09-24 |
| AWS connection guide documents Secureframe’s direct connection, resource scanning and automated evidence collection. | Secureframe Support Vendor docs | 2026-09-24 |
| Azure connection guide documents tenant and subscription connections, resource scanning and automated evidence collection. | Secureframe Support Vendor docs | 2026-09-24 |
| Microsoft Entra ID guide documents OAuth and app-registration connection methods, synced fields and automated tests. | Secureframe Support Vendor docs | 2026-09-24 |
| Slack guide documents personnel access sync and task delivery through the Secureframe integration. | Secureframe Support Vendor docs | 2026-09-24 |
| Microsoft Intune guide documents device and app sync plus compliance-test evaluation. | Secureframe Support Vendor docs | 2026-09-24 |
| HubSpot guide documents a direct connection that pulls user and access information for compliance requirements. | Secureframe Support Vendor docs | 2026-09-24 |
| JumpCloud guide documents REST API device sync and automated compliance checks and evidence collection. | Secureframe Support Vendor docs | 2026-09-24 |
| ServiceNow guide documents OAuth setup and automated compliance checks and evidence collection. | Secureframe Support Vendor docs | 2026-09-24 |
| Office 365 integration guide explicitly describes adding a native connection, connecting the tenant and choosing whether guest and unlicensed accounts are included in synced data. | Secureframe Support Vendor docs | 2026-09-25 |
| Integration coverage table documents GitLab data pulled into Secureframe, including MFA information. | Secureframe Support Vendor docs | 2026-09-24 |
| Current integration FAQ documents connected Datadog and Cloudflare data used in monitoring and framework tests. | Secureframe Support Vendor docs | 2026-09-24 |
| G2 seller listing shows 4.7/5 from 826 reviews; snapshot retrieved 2026-09-29. | G2 Review platform | 2026-09-29 |
| Secureframe documents the read-only agent, collected fields, and supported operating systems. | Secureframe Vendor docs | 2026-09-29 |
| Supported operating systems and monitoring setup for the employee device agent. | Secureframe Vendor docs | 2026-09-29 |
| Secureframe's terms place its offices in San Francisco; its about page describes hubs across the United States, Canada, and the United Kingdom. | Secureframe Vendor docs | 2026-09-29 |
| Current annual USD transaction panel: low $7,733, high $32,575, median $20,000. Purchase count was not displayed in the retrieved panel; package scopes vary and these are not quotes. | Vendr Third-party estimate | 2026-09-30 |
| Fundamentals starts at $7,500/year and has one custom automated test. Complete lists unlimited custom automated tests, custom integrations and SSO/SCIM connections; Defense adds SSP, POA&M, SPRS and managed CUI infrastructure. Both higher packages require quotes. | Secureframe Vendor docs | 2026-09-30 |
| Every customer is paired with a Customer Success Manager for platform training and setup guidance, test prioritization, evidence and framework scoping advice, and audit-readiness support. This establishes included guidance, not delegated control implementation or remediation execution. | Secureframe Support Vendor docs | 2026-10-02 |
| Fundamentals starts at $7,500/year with Trust Center; Complete lists SSO & SCIM Connections, Advanced Trust Center and Advanced Questionnaire Automation; Defense lists SPRS Score Tracker, SSP, POA&M, Managed CUI Enclave and Managed Virtual Desktops. Complete and Defense request a quote. Unchanged on re-read 2026-10-05. | Secureframe Vendor docs | 2026-10-02 |
| Evidence counts as in audit only when its completion date falls in the observation window; auditors get module-level read-only access and comments; export includes the evidence package plus test and control mapping CSVs. | Secureframe Vendor docs | 2026-10-05 |
Not yet confirmed
- Customer count · last checked 2026-09-24