Share it with us, and upvote other users' ideas.
Got an idea for how to improve Secfix?
Complete
Inventory: Sub-categories for Custom Assets and/or tag sorting
Right now, all Custom Assets appear in the Inventory → Custom Assets in a single flat list. As the number of assets grows, it gets harder to keep an overview and find related items quickly. It would be great, to be able to have one of the following for Custom Assets: Sub-categories: Being able to create our own categories (e.g. AI Assets, Physical documents, Products) and assign each asset to one. Improved Sorting/Filtering: A new field where we are able to tag each asset with a type or category, and the option to sort or filter the list by it. This would make it much easier to: Have a structured overview over assets by type Review and maintain the inventory during audits Make sure they have the right classification and owner
Multi-entity / multi-product Trust Center
As a Trust Center admin for a group with several entities or products, I want to show separate compliance information per entity/product within one Trust Center, so visitors see exactly what applies to the entity they work with, without us maintaining separate workspaces. What would help: - Define entities/products and let visitors switch between them (e.g. dropdown) - Assign documents, certifications, frameworks and sub-processors per entity, or share them across all entities - Grant access per entity (a visitor approved for entity A doesn't automatically see entity B) - Branding/URL per entity (nice to have)
Trust Center visitor activity: see who viewed or downloaded which documents
As a Trust Center admin, I want to see which visitors and companies viewed or downloaded which documents, so we know who is interested in what and can follow up (e.g. sales or account managers). What would help: - Activity log per visitor/company: documents viewed and downloaded, with timestamps - Per-document stats: number of views and downloads - Filter by company or date range - Export (CSV/Excel)
Require visitors to accept an NDA before accessing restricted Trust Center documents
As a Trust Center admin, I want to require visitors to accept or sign an NDA before they can request or open restricted documents, so I don't have to handle NDAs manually by email. What would help: - Upload our own NDA template (or use a standard one) and choose which documents require it - Visitors accept/sign the NDA as part of the access request flow - The signed NDA is stored with the access request so we can show it to auditors - NDA acceptance can be used as a condition for auto-approving access.
Custom categories in Risk Register
The Risk Register is currently a flat list with no way to group entries. Risks under the same asset but with different risk levels are hard to tell apart unless you artificially fragment them into smaller, overly granular risks, and the overview gets lost as the list grows. Suggestion: Consider adding a function that lets users create custom risk categories and assign risks to them. The register could then be grouped (e.g. collapsible sections) and filtered by category.
Sub-processor change notifications and subscriptions in the Trust Center
As a Trust Center admin, I want visitors and customers to subscribe to our sub-processor list and be notified automatically when it changes, so we can meet our GDPR Art. 28 notification obligations without emailing customers manually. What would help: - "Subscribe to sub-processor updates" on the Trust Center's Subprocessors section - When we add, remove or replace a sub-processor, subscribers get an email with what changed (name, purpose, location, effective date) - Optional advance notice period (e.g. 30 days before the change takes effect) - Change history / previous versions of the list - Log of who was notified and when, as evidence for audits Context: a customer raised this while comparing Trust Center platforms (alongside sending an updated sub-processor list to customers when changes are made).
Complete
Allow custom classifications on the Inventory
We’d like to be able to adjust the data classification options available on inventory assets. Our classification scheme has four levels, including a Restricted category for our most sensitive assets, but the platform only offers a fixed set of classifications, and Restricted isn’t one of them. What we’d like: Either: Add Restricted as a standard classification option, or Let workspace admins edit or add classification levels to match their own information classification policy.
Upload Custom Profile Pictures for Users
User avatars can currently only come from the connected identity provider, which makes it hard to tell users and task owners apart in overviews. Requested Functionality Allow profile pictures to be uploaded directly in Secfix, by the users themselves or by workspace admins. Example: Manual evidence task list → each owner is recognizable by their picture at a glance.
GitLab integration: sync members of all projects/repositories within the selected group
Secfix syncs members of the group selected in the integration settings. Members who were added directly to individual projects, but not to the group itself, aren’t included in the sync. It would be great if Secfix checked all members of all repositories in the group, since there are more members accessing the repositories.
In Progress
Vendor List: Flag for Stored Assessment Docs (+Expiration Date)
For convenience it would be a very nice feature to have a column in the Vendor Overview List, which contains a flag showing, if a certificate and/or a questionnaire was provided. This avoids clicking through all the vendor records. A+ it would be to see also the expiration date (could be a manually added value).
Customizable time/closing thresholds for Jira automated checks
Problem: Currently, the time thresholds for Jira automated checks are fixed and cannot be customized to match users’ internal policies and workflows. This leads to checks failing even when the underlying processes are being followed correctly. Requested Improvement: Allow users to customize SLA/Closing thresholds for Jira automated checks based on their internal policies. Ideally, users should also be able to configure which date triggers the SLA calculation (e.g., ticket creation date vs. employee departure/due date).
Linux Agent: Detect Snap and AppImage apps in Installed apps
The Linux Agent currently lists only applications installed as Debian (.deb) packages under “Installed apps.” Applications installed via Snap or run as AppImages are not detected, so the app inventory for Linux devices is incomplete. Installed apps should also include Snap packages and AppImage applications, so the device inventory reflects everything installed on the machine.
In Progress
Make Treatment Task input fields expandable text areas
It would be nice if the input fields of the Treatment Tasks were text areas instead of single-line inputs. Then you can also read the entire task while editing.
Sync AWS IAM Identity Center users through the AWS integration
We manage all our AWS users in AWS IAM Identity Center. They're created there directly, not synced from an external identity provider like Google Workspace, Entra ID, etc. Since the Secfix AWS integration only reads IAM users, none of these users show up in Secfix, and connecting an identity provider doesn't help because the users don't exist there. We'd like to see our Identity Center users in Secfix so we can review AWS access in one place. Specifically, we'd like to see: A list of all Identity Center users, with name, email and status Whether each user is actively using their account, for example their last sign-in Whether each user has MFA enabled, so we can quickly spot users with MFA disabled This would let us run user access and MFA reviews for AWS directly in Secfix, instead of checking Identity Center manually.
Secfix Agent: report the inactivity timeout for screen lock, not only the grace period
The "Configured Screen Lock" value in the Secfix Agent shows the grace period: the time after the screen turns off before a password is required. On my macOS, this shows as 0.0833 min on the Computers page. Problem: The grace period doesn't show how long a device can stay idle before it locks. A Mac with the display set to never turn off would still report 5 seconds. Requested improvements Show the inactivity timeout, meaning how long a device can sit idle before the screen turns off or locks. Flag it against a configurable threshold (e.g. ≤ 5 min) so admins can see compliance at a glance. Check battery and plugged-in settings separately. macOS and Windows allow different timers for each, so a device can be compliant on battery but not when plugged in. Reporting the less strict of the two would be a reasonable default.
Add the ability to rename policy names
We’d like to be able to rename the policies in the Policies page. During certification and surveillance audits, the auditor traces each control from the Statement of Applicability, risk treatment plan and prior audit reports to the governing document by its title, and then verifies identification, version control and approval under ISO/IEC 27001 clause 7.5. The renaming of our policies and management system in Secfix means the titles in our controlled documentation no longer match what the auditor sees in the platform. This forces us to demonstrate, during the audit, that the renamed document is the same approved artefact, that its approval and version history remain valid, and that staff acknowledgements against the original title still hold. That is an avoidable audit finding risk on document control, and it also breaks the evidence trail for our concurrent SOC 2 observation period. We need the platform to display our approved document titles, or at minimum a customer-defined display name alongside your framework mapping, so that what the auditor sees in Secfix is consistent with our documented information.
Add pacman/Arch Linux package detection support for Linux antivirus check
The Linux antivirus check currently relies on package-inventory tables (deb_packages, rpm_packages, etc. via osquery), which have no equivalent for pacman-based distributions (Arch Linux, Manjaro, EndeavourOS, Omarchy, and others). As a result, any antivirus solution installed via pacman — including ClamAV, which is on your supported list — can never be detected, regardless of whether it's correctly installed and running. We verified this on an Omarchy (Arch-based) device: ClamAV was installed, running, and actively detecting malware (confirmed via EICAR test), and the underlying osquery processes table showed clamd/freshclam running correctly — but no pacman_packages table exists for the compliance check to query against, so the device was flagged as having no antivirus.
Separation of Vendors Management and the Software List
Currently, the software we use has to be maintained as part of the Vendor Management functionality. In my view, this is not factually correct and makes working with SECFIX unnecessarily complicated and less user-friendly than it needs to be. There are several reasons why the software list should be separated from Vendors: Software is an asset Software represents a supporting information asset in the context of ISO 27001. Therefore, it would be logical and appropriate to maintain the software inventory as part of the Assets section. Currently, this is not possible, as software has to be maintained within the Vendor Management as per the templates and our contact at Secfix. Software information is not accessible to non-admin users Users without administrator permissions cannot access the Vendor Management section. They only see the “My Task” page. As a result, the software inventory maintained there is not visible to our regular users within the platform. This forces us to maintain a second software inventory outside of SECFIX, which defeats the purpose of having a centralized inventory within the platform. At the moment, it is actually easier for us not to use SECFIX for managing our software inventory at all. The current approach makes the process unnecessarily complicated and requires us to maintain the software inventory outside of SECFIX. Suggested solution: Provide a dedicated Software / Software Assets section within the Assets area. This inventory should be accessible to users according to their assigned permissions and should be managed independently from Vendor Management. Vendor Management should remain focused on vendors and their associated risks, assessments, contracts, and security requirements, while the software inventory should be maintained as an independent asset inventory.
Option to Publish and Distribute Various Training Courses to Employees
Currently, the only options are to assign the SECFIX Security Awareness Training or to provide an in-house training course. However, in many cases, relying on a single type of training is not sufficient. As compliance requirements continue to evolve, it would be very useful to have the ability to distribute and manage additional training courses through the platform (for example, training for the EU AI Act or other topic-specific compliance requirements). Ideally, the platform could allow administrators to add an external training course simply by providing a link. The course could then be assigned to specific users or groups as a mandatory requirement, with the completion status tracked within the platform. This would make it possible to use SECFIX as a central platform for managing different security, compliance, and awareness training requirements without requiring every training course to be hosted directly within SECFIX.
Support for Selecting Individual Assets in Risk Register Impacted Assets
Please add the ability to select individual assets, potentially within the respective categories, rather than only asset categories, in the Risk Register's "Impacted Assets" section. This would enable more precise mapping and improve visibility.