We would like to connect an AI assistant to the platform and programmatically pull compliance data. Problem / use case: The customer is preparing for ISO certification. They want to pull platform data — policies, controls, and related artifacts — into their AI workflow, then auto-generate a detailed requirements-and-preparation plan for the cert. They also want to push the output into Jira (e.g., create a ticket documenting the requirements and prep plan). Today this is manual. Proposed capability: An MCP server that exposes Secfix data (policies, controls, frameworks, evidence) as queryable resources/tools for MCP-compatible AI clients. Read access at minimum; optionally write/action support for downstream integrations (e.g., creating Jira tickets from generated plans).

Srinivas Sambari about 1 month ago

1

💡

Feature Request

Regarding the bigger vendors (Google, AWS, Microsoft, Jira, etc.), automate the Security documents (ISO certificates, DPAs, etc.). Looking for those manually and choosing the right one can be a pain.

aj 7 days ago

💡

Feature Request

Currently, when you mark all evidence/automated tasks as deactivated for a control, it shows the control’s progress 100% even though there are no tasks attached to that specific control. We would like to have the ability to deactivate a control from the framework page when it’s not applicable to us. This way, the auditor does not get confused by looking at the progress percentage, thinking that the check is applicable, and that we have completed all necessary checks.

Hannah-Marie Kleindopff 10 days ago

💡

Feature Request

macOS comes by default with an own password safe named “Passwords” or in German “Passwörter”. That’s why we do not preinstall an additional password safe before laptop provisioning. It would be nice, if the Apple password safe was also detected by Secfix. It can be found in the Intune list.

Frank Tiex about 9 hours ago

Automated tasks

+1

💡

Feature Request

We do have several non-consulting groups (marketing and finance, as well as people & development) that would require the same policies. Hence, it would be great to assign the policies to a parent group of these groups.

Michael Wachter 3 days ago

💡

Feature Request

The Secfix Agent should be compatible with Linux NixOS. It currently only works for Linux Debian

max 4 days ago

💡

Feature Request

Beschreibung: Aktuell können private Smartphones (Android und iPhone) nur über BYOD für die Arbeit genutzt werden, was eine manuelle Registrierung und Genehmigung sowie manuelle Prüfungen erfordert (PIN/Sperrbildschirm, automatische Sperrung innerhalb von 15 Minuten, lokale Speicherverschlüsselung). Es wäre deutlich einfacher, wenn Android-Telefone wie Computer (Windows/Linux/macOS) in Secfix registriert und verwaltet werden könnten, sodass die Compliance automatisch geprüft werden kann, anstatt auf BYOD-Prüfungen zu vertrauen.

Kilian Maier 7 days ago

💡

Feature Request

It would be nice to be able to add (supporting) evidence (e.g. linking a policy, ME or AC) to a control. E.g. “We’d like to map POL-04 as evidence under 12.1.1 PCI DSS control, to have the Acceptable Use section also visible for the PCI DSS audit. That's what our auditor knows from the past and was asking for. Sure, having the POL-02 linked to it is the generic approach and totally correct. The POL-04 would simply make it more concrete.”

Frank Tiex about 1 month ago

💡

Feature Request

Currently, the import feature creates new risks in the risk register. We’d like the option to be able to update the existing risks using this feature. When we put in the exact risk IDs that we already have on the Risk Register, it should update the existing risk entries.

katharina.hansen 18 days ago

💡

Feature Request

Proposed Solution Add download capabilities directly on the Policies page. Problem We often need to download and share our current policy documents for internal reviews, audits, compliance activities, or document archiving. While policy templates can be downloaded from the Policies page, there is currently no straightforward way to download the actual policy versions maintained by us. We must navigate through multiple screens and use a workaround to access and download min 20 documents. Additionally, downloaded files may lose their original naming structure, creating extra manual work after download.

Oliver Broszat 21 days ago

💡

Feature Request

Proposed Solution Add vendor address information (or at minimum vendor location/country) to the Vendor Export. Problem We frequently use the Vendor Export as part of security questionnaires, customer onboarding processes, and audit preparations. While the current export provides a list of vendors, it does not include vendor address/location information. Many customer due diligence and security review questionnaires require not only the vendor name but also information about where the vendor is located. As a result, we currently have to manually open each vendor record and copy the address information into the exported vendor list.

Oliver Broszat 21 days ago

💡

Feature Request

Currently, a reminder can be sent to a single employee or to all of them having open tasks. When selecting the checkbox of an employee line, the bulk reminder feature disappears. It would be helpful, if a reminder could be sent dedicatedly to selected employees. In addition, it would be a great feature, if there was also an option to use an own, custom text to the reminder. It is in most cases helpful to give some more context to the adressees.

Frank Tiex 22 days ago

Employees

💡

Feature Request

Der Secfix Agent prüft die PC’s. Devolutions Workspace wurde umbenannt in Devolutions Password Manager. Diesen bitte zusätzlich aufnehmen

Thomas Wischermann 26 days ago

💡

Feature Request

Employees might not know that the company has started using the Secfix platform and hence might qualify the bulk reminder as a phishing email. It would be helpful if an automated “intro-email” was sent out to all employees, upon connection of the idP, introducing Secfix and letting the employees know that they’ll have to complete a certain number of tasks in the coming days.

aj 26 days ago

💡

Feature Request

Just came up recently, where we needed to do a test scenario for three months with a vendor. Would be beneficial if the review date could be adjusted to that timeline, so we could have checked the vendor again / archived them after the test was completed.

Niclas Nibbe 27 days ago

Vendor management

+1

💡

Feature Request

When you download a file, for example, at Evidence, the filename is apparently generated from a UUID, even though the original filename is actually stored in the system (and also displayed). This makes it very cumbersome to assign the downloaded file.

Philipp Lehmayr 27 days ago

💡

Feature Request

I like the way evidences are shown and handled now. There’s just one detail, I might have missed so far. It would be very helpful to have a dedicated tab for a single evidence to see, to which Framework controls it is linked. Coming from the Framework, you can drill down to the evidences, but in practice I feel, the other way around would be even more helpful. It’s a kind of cross-reference, should not be too difficult to implement.

Frank Tiex about 1 month ago

Manual evidence

💡

Feature Request

We use Wiz as our cloud security platform and would like to see a native integration with Secfix. Wiz already contains relevant cloud security posture, monitoring, and control evidence, so being able to sync this information automatically into Secfix would reduce manual evidence collection and make audit preparation more efficient. This would also help us demonstrate our cloud security controls more clearly during ISO 27001 audits. We’ve also noticed that similar compliance automation platforms already support Wiz integrations, so having this available in Secfix would provide significant additional value for teams using modern cloud security tooling.

Matt Sleeman 2 months ago

Connections

💡

Feature Request

I need to export all SOC 2 evidence files as a ZIP package. I want to download all the evidence to my folder and not go over it 1 by 1. I am the auditor and want to save it in my DB.

meni.b 2 months ago

💡

Feature Request