It would be nice to be able to add (supporting) evidence (e.g. linking a policy, ME or AC) to a control. E.g. “We’d like to map POL-04 as evidence under 12.1.1 PCI DSS control, to have the Acceptable Use section also visible for the PCI DSS audit. That's what our auditor knows from the past and was asking for. Sure, having the POL-02 linked to it is the generic approach and totally correct. The POL-04 would simply make it more concrete.”

Frank Tiex 21 days ago

💡

Feature Request

We would like to connect an AI assistant to the platform and programmatically pull compliance data. Problem / use case: The customer is preparing for ISO certification. They want to pull platform data — policies, controls, and related artifacts — into their AI workflow, then auto-generate a detailed requirements-and-preparation plan for the cert. They also want to push the output into Jira (e.g., create a ticket documenting the requirements and prep plan). Today this is manual. Proposed capability: An MCP server that exposes Secfix data (policies, controls, frameworks, evidence) as queryable resources/tools for MCP-compatible AI clients. Read access at minimum; optionally write/action support for downstream integrations (e.g., creating Jira tickets from generated plans).

Srinivas Sambari 20 days ago

1

💡

Feature Request

Proposed Solution Add download capabilities directly on the Policies page. Problem We often need to download and share our current policy documents for internal reviews, audits, compliance activities, or document archiving. While policy templates can be downloaded from the Policies page, there is currently no straightforward way to download the actual policy versions maintained by us. We must navigate through multiple screens and use a workaround to access and download min 20 documents. Additionally, downloaded files may lose their original naming structure, creating extra manual work after download.

Oliver Broszat 1 day ago

💡

Feature Request

Proposed Solution Add vendor address information (or at minimum vendor location/country) to the Vendor Export. Problem We frequently use the Vendor Export as part of security questionnaires, customer onboarding processes, and audit preparations. While the current export provides a list of vendors, it does not include vendor address/location information. Many customer due diligence and security review questionnaires require not only the vendor name but also information about where the vendor is located. As a result, we currently have to manually open each vendor record and copy the address information into the exported vendor list.

Oliver Broszat 1 day ago

💡

Feature Request

Currently, a reminder can be sent to a single employee or to all of them having open tasks. When selecting the checkbox of an employee line, the bulk reminder feature disappears. It would be helpful, if a reminder could be sent dedicatedly to selected employees. In addition, it would be a great feature, if there was also an option to use an own, custom text to the reminder. It is in most cases helpful to give some more context to the adressees.

Frank Tiex 1 day ago

Employees

💡

Feature Request

Der Secfix Agent prüft die PC’s. Devolutions Workspace wurde umbenannt in Devolutions Password Manager. Diesen bitte zusätzlich aufnehmen

Thomas Wischermann 5 days ago

💡

Feature Request

Employees might not know that the company has started using the Secfix platform and hence might qualify the bulk reminder as a phishing email. It would be helpful if an automated “intro-email” was sent out to all employees, upon connection of the idP, introducing Secfix and letting the employees know that they’ll have to complete a certain number of tasks in the coming days.

aj 6 days ago

💡

Feature Request

Just came up recently, where we needed to do a test scenario for three months with a vendor. Would be beneficial if the review date could be adjusted to that timeline, so we could have checked the vendor again / archived them after the test was completed.

Niclas Nibbe 6 days ago

Vendor management

+1

💡

Feature Request

When you download a file, for example, at Evidence, the filename is apparently generated from a UUID, even though the original filename is actually stored in the system (and also displayed). This makes it very cumbersome to assign the downloaded file.

Philipp Lehmayr 7 days ago

💡

Feature Request

I like the way evidences are shown and handled now. There’s just one detail, I might have missed so far. It would be very helpful to have a dedicated tab for a single evidence to see, to which Framework controls it is linked. Coming from the Framework, you can drill down to the evidences, but in practice I feel, the other way around would be even more helpful. It’s a kind of cross-reference, should not be too difficult to implement.

Frank Tiex 14 days ago

Manual evidence

💡

Feature Request

We use Wiz as our cloud security platform and would like to see a native integration with Secfix. Wiz already contains relevant cloud security posture, monitoring, and control evidence, so being able to sync this information automatically into Secfix would reduce manual evidence collection and make audit preparation more efficient. This would also help us demonstrate our cloud security controls more clearly during ISO 27001 audits. We’ve also noticed that similar compliance automation platforms already support Wiz integrations, so having this available in Secfix would provide significant additional value for teams using modern cloud security tooling.

Matt Sleeman about 2 months ago

Connections

💡

Feature Request

I need to export all SOC 2 evidence files as a ZIP package. I want to download all the evidence to my folder and not go over it 1 by 1. I am the auditor and want to save it in my DB.

meni.b about 1 month ago

💡

Feature Request

Title: Vendor Discovery Page – Surfacing New/Unreviewed Vendors More Clearly Description: The current "Discover Vendors" tab shows all vendors in a single list, including those already ignored. With 144 vendors in total—over 130 of which have been ignored—it's difficult to tell at a glance whether any new vendors require review. Proposed Solution: The optimal improvement would be to split the tab into two separate views: A "Discovered Vendors" tab (or equivalent) showing only unreviewed/un-ignored vendors A separate "Ignored Vendors" tab for vendors already dismissed This would allow users to immediately see how many vendors need attention without scrolling through a long mixed list. Alternative / Minimum Viable Improvement: If a full tab split isn't feasible, sorting the list by status (new vs. ignored) would also help—but only if a visible "New" badge or count indicator is shown in the header, so users are alerted without having to open the tab at all. User Impact: This change would make the Vendor page significantly more actionable for users managing large vendor lists, reducing the effort required to stay on top of new additions.

Melita Mujičić about 1 month ago

1

💡

Feature Request

Currently, I need to reach out to support to manually add an employee to Secfix. I should be able to do it myself as the Admin.

tracy.olnhausen 2 months ago

💡

Feature Request

I use the SECFIX platform in German. Unfortunately, the search function only works with English terms. If you’re using the platform in German, you should also be able to search for German terms. For example, the search in the Manual Records. When I search for “Rechtsregister,” nothing comes up. I have to search for “Legal,” and then “Rechtsregister” appears. It’s kind of illogical. This behavior is the same for all search fields and should be corrected.

Domenico Genco about 1 month ago

1

Manual evidence

+4

💡

Feature Request

Add team password manager to the list of supported password managers

Sarah Dema about 1 month ago

💡

Feature Request

SentinelOne XDR should be recognized as an AV protection solution on Windows, MacOS and Linux in the “Antivirus installed” compliance check. The Sentinel Agent is listed in the Intune software inventory, so easy to detect.

Frank Tiex about 1 month ago

2

Inventory

+2

💡

Feature Request

For the audit purpose (SOC 2 Type II), it would be great to be able to show the policy acceptance timestamps per policy per employee. This was requested by the auditors

Rich Bard about 1 month ago

💡

Feature Request

Under policies —> Profile picture of the approver should be put as well (like we do with the owner) so as to see whether the owner and approver is a different person or not (for quick check with customer)

François Gales about 1 month ago

💡

Feature Request