Share it with us, and upvote other users' ideas.
Got an idea for how to improve Secfix?
Complete
Inventory: Sub-categories for Custom Assets and/or tag sorting
Right now, all Custom Assets appear in the Inventory → Custom Assets in a single flat list. As the number of assets grows, it gets harder to keep an overview and find related items quickly. It would be great, to be able to have one of the following for Custom Assets: Sub-categories: Being able to create our own categories (e.g. AI Assets, Physical documents, Products) and assign each asset to one. Improved Sorting/Filtering: A new field where we are able to tag each asset with a type or category, and the option to sort or filter the list by it. This would make it much easier to: Have a structured overview over assets by type Review and maintain the inventory during audits Make sure they have the right classification and owner
Multi-entity / multi-product Trust Center
As a Trust Center admin for a group with several entities or products, I want to show separate compliance information per entity/product within one Trust Center, so visitors see exactly what applies to the entity they work with, without us maintaining separate workspaces. What would help: - Define entities/products and let visitors switch between them (e.g. dropdown) - Assign documents, certifications, frameworks and sub-processors per entity, or share them across all entities - Grant access per entity (a visitor approved for entity A doesn't automatically see entity B) - Branding/URL per entity (nice to have)
Trust Center visitor activity: see who viewed or downloaded which documents
As a Trust Center admin, I want to see which visitors and companies viewed or downloaded which documents, so we know who is interested in what and can follow up (e.g. sales or account managers). What would help: - Activity log per visitor/company: documents viewed and downloaded, with timestamps - Per-document stats: number of views and downloads - Filter by company or date range - Export (CSV/Excel)
Require visitors to accept an NDA before accessing restricted Trust Center documents
As a Trust Center admin, I want to require visitors to accept or sign an NDA before they can request or open restricted documents, so I don't have to handle NDAs manually by email. What would help: - Upload our own NDA template (or use a standard one) and choose which documents require it - Visitors accept/sign the NDA as part of the access request flow - The signed NDA is stored with the access request so we can show it to auditors - NDA acceptance can be used as a condition for auto-approving access.
Custom categories in Risk Register
The Risk Register is currently a flat list with no way to group entries. Risks under the same asset but with different risk levels are hard to tell apart unless you artificially fragment them into smaller, overly granular risks, and the overview gets lost as the list grows. Suggestion: Consider adding a function that lets users create custom risk categories and assign risks to them. The register could then be grouped (e.g. collapsible sections) and filtered by category.
Risikobewertung einsehbar und bearbeitbar machen
Sobald die Fragen zur Risikobewertung beantwortet und abgesendet werden, können diese Antworten nicht mehr eingesehen und bearbeitet werden. Die (noch) nicht implementierten Bewertungen wandern dann zwar ins Risikoregister, aber alle mit “Ja“ beantworteten Fragen verschwinden samt Erklärung im Nirwana. Wir würden uns wünschen, dass die Antworten nicht nur 14 Tage im Cache gespeichert werden, sondern dauerhaft. Auch wenn sie angeschlossen und abgesendet wurden. Man könnte ja für alle, die das nicht wünschen, einen Reset-Button einbauen, der alle Antworten löscht.
"Trusted by" section with customer logos in the Trust Center
As a Trust Center admin, I want to show logos of customers who have reviewed and trust us, so prospects get social proof at a glance. What would help: - Add, edit, reorder and delete companies (logo, name, optional website link) - Customizable section title (e.g. " is reviewed and trusted by") - Nice to have: fetch logos automatically from the company domain instead of uploading them Context: a customer raised this while comparing Trust Center platforms. A spec for this already exists internally (Trust Center shapes, "Trusted by – companies logos section", Aug 2024).
Domain-based access rules for Trust Center requests (auto-approve / auto-decline)
As a Trust Center admin, I want to define rules based on the requester's email domain, so that requests are approved or declined automatically and I only review the ones that need a decision. What would help: - Blocklist: automatically decline requests from specific domains (e.g. competitors) and from free email providers (gmail.com, outlook.com, etc.), optionally without notifying the requester - Allowlist: automatically approve requests from specific domains (e.g. existing customers), with a default access level and expiration - Optional: block further requests from a requester whose earlier request was declined - All automatic decisions appear in the request history, marked as "auto-approved" / "auto-declined"
Sub-processor change notifications and subscriptions in the Trust Center
As a Trust Center admin, I want visitors and customers to subscribe to our sub-processor list and be notified automatically when it changes, so we can meet our GDPR Art. 28 notification obligations without emailing customers manually. What would help: - "Subscribe to sub-processor updates" on the Trust Center's Subprocessors section - When we add, remove or replace a sub-processor, subscribers get an email with what changed (name, purpose, location, effective date) - Optional advance notice period (e.g. 30 days before the change takes effect) - Change history / previous versions of the list - Log of who was notified and when, as evidence for audits Context: a customer raised this while comparing Trust Center platforms (alongside sending an updated sub-processor list to customers when changes are made).
Complete
Allow custom classifications on the Inventory
We’d like to be able to adjust the data classification options available on inventory assets. Our classification scheme has four levels, including a Restricted category for our most sensitive assets, but the platform only offers a fixed set of classifications, and Restricted isn’t one of them. What we’d like: Either: Add Restricted as a standard classification option, or Let workspace admins edit or add classification levels to match their own information classification policy.
Upload Custom Profile Pictures for Users
User avatars can currently only come from the connected identity provider, which makes it hard to tell users and task owners apart in overviews. Requested Functionality Allow profile pictures to be uploaded directly in Secfix, by the users themselves or by workspace admins. Example: Manual evidence task list → each owner is recognizable by their picture at a glance.
GitLab integration: sync members of all projects/repositories within the selected group
Secfix syncs members of the group selected in the integration settings. Members who were added directly to individual projects, but not to the group itself, aren’t included in the sync. It would be great if Secfix checked all members of all repositories in the group, since there are more members accessing the repositories.
In Progress
Vendor List: Flag for Stored Assessment Docs (+Expiration Date)
For convenience it would be a very nice feature to have a column in the Vendor Overview List, which contains a flag showing, if a certificate and/or a questionnaire was provided. This avoids clicking through all the vendor records. A+ it would be to see also the expiration date (could be a manually added value).
Customizable time/closing thresholds for Jira automated checks
Problem: Currently, the time thresholds for Jira automated checks are fixed and cannot be customized to match users’ internal policies and workflows. This leads to checks failing even when the underlying processes are being followed correctly. Requested Improvement: Allow users to customize SLA/Closing thresholds for Jira automated checks based on their internal policies. Ideally, users should also be able to configure which date triggers the SLA calculation (e.g., ticket creation date vs. employee departure/due date).
Linux Agent: Detect Snap and AppImage apps in Installed apps
The Linux Agent currently lists only applications installed as Debian (.deb) packages under “Installed apps.” Applications installed via Snap or run as AppImages are not detected, so the app inventory for Linux devices is incomplete. Installed apps should also include Snap packages and AppImage applications, so the device inventory reflects everything installed on the machine.
In Progress
Make Treatment Task input fields expandable text areas
It would be nice if the input fields of the Treatment Tasks were text areas instead of single-line inputs. Then you can also read the entire task while editing.
Sync AWS IAM Identity Center users through the AWS integration
We manage all our AWS users in AWS IAM Identity Center. They're created there directly, not synced from an external identity provider like Google Workspace, Entra ID, etc. Since the Secfix AWS integration only reads IAM users, none of these users show up in Secfix, and connecting an identity provider doesn't help because the users don't exist there. We'd like to see our Identity Center users in Secfix so we can review AWS access in one place. Specifically, we'd like to see: A list of all Identity Center users, with name, email and status Whether each user is actively using their account, for example their last sign-in Whether each user has MFA enabled, so we can quickly spot users with MFA disabled This would let us run user access and MFA reviews for AWS directly in Secfix, instead of checking Identity Center manually.
Secfix Agent: report the inactivity timeout for screen lock, not only the grace period
The "Configured Screen Lock" value in the Secfix Agent shows the grace period: the time after the screen turns off before a password is required. On my macOS, this shows as 0.0833 min on the Computers page. Problem: The grace period doesn't show how long a device can stay idle before it locks. A Mac with the display set to never turn off would still report 5 seconds. Requested improvements Show the inactivity timeout, meaning how long a device can sit idle before the screen turns off or locks. Flag it against a configurable threshold (e.g. ≤ 5 min) so admins can see compliance at a glance. Check battery and plugged-in settings separately. macOS and Windows allow different timers for each, so a device can be compliant on battery but not when plugged in. Reporting the less strict of the two would be a reasonable default.
Add the ability to rename policy names
We’d like to be able to rename the policies in the Policies page. During certification and surveillance audits, the auditor traces each control from the Statement of Applicability, risk treatment plan and prior audit reports to the governing document by its title, and then verifies identification, version control and approval under ISO/IEC 27001 clause 7.5. The renaming of our policies and management system in Secfix means the titles in our controlled documentation no longer match what the auditor sees in the platform. This forces us to demonstrate, during the audit, that the renamed document is the same approved artefact, that its approval and version history remain valid, and that staff acknowledgements against the original title still hold. That is an avoidable audit finding risk on document control, and it also breaks the evidence trail for our concurrent SOC 2 observation period. We need the platform to display our approved document titles, or at minimum a customer-defined display name alongside your framework mapping, so that what the auditor sees in Secfix is consistent with our documented information.
Add pacman/Arch Linux package detection support for Linux antivirus check
The Linux antivirus check currently relies on package-inventory tables (deb_packages, rpm_packages, etc. via osquery), which have no equivalent for pacman-based distributions (Arch Linux, Manjaro, EndeavourOS, Omarchy, and others). As a result, any antivirus solution installed via pacman — including ClamAV, which is on your supported list — can never be detected, regardless of whether it's correctly installed and running. We verified this on an Omarchy (Arch-based) device: ClamAV was installed, running, and actively detecting malware (confirmed via EICAR test), and the underlying osquery processes table showed clamd/freshclam running correctly — but no pacman_packages table exists for the compliance check to query against, so the device was flagged as having no antivirus.