Secureframe
Secureframe, Inc.
Compliance automation platform with published entry pricing and support for ISO 42001, NIST AI RMF and the EU AI Act
Last checked October 15, 2026Quick facts: Secureframe is an AI compliance vendor founded in 2020 and headquartered in San Francisco, United States. The vendor publicly documents coverage for ISO/IEC 42001, NIST AI RMF, EU AI Act, and HIPAA. Pricing is tiered. Profile last checked October 15, 2026; sources are cited at the bottom of this page.
About Secureframe
Secureframe is a compliance automation (GRC) platform founded in January 2020 by Shrav Mehta and Natasja Nielsen. It is based in San Francisco, lists more than 200 employees across hubs in San Francisco, New York, Austin, Denver, Toronto and London, and has raised $79 million, most recently a $56 million Series B led by Accomplice in February 2022. The platform covers infrastructure monitoring, evidence collection, policy and risk management, vendor reviews and a Trust Center across more than 30 security, privacy and federal frameworks, including SOC 2, ISO 27001, HIPAA, CMMC and FedRAMP. Its AI features (Comply AI and Trust AI) draft questionnaire answers, suggest control mappings, score risks, pull answers from vendor SOC 2 reports, generate infrastructure-as-code fixes and check uploaded audit evidence. Its MCP server lets AI assistants such as ChatGPT, Claude and Cursor read compliance data. **AI compliance coverage** Secureframe added NIST AI RMF and ISO 42001 support in May 2024; its framework pages describe policy templates, pre-built tests, continuous monitoring and AI risk management for each. It says it added full support for the EU AI Act in September 2025, but has no dedicated EU AI Act page describing what is included. **Who it's for** Startups and mid-market companies, including defense contractors through its Defense plan, that want a published starting price. The case studies we found cover security and privacy frameworks, not AI governance.
Featured in
Secureframe is ranked in the following independent collection.
Frameworks supported
Regulations, voluntary standards and compliance programs Secureframe documents support for on their own materials. Chip shading reflects the strength of the claim, not an independent audit.
Voluntary standard · Global · voluntary
Voluntary standard · US · voluntary
Regulation · EU · Phased — in force; high-risk rules deferred
Regulation · United States · active
Compliance program it supports (not its own certification) · United States (AICPA)
Compliance program it supports (not its own certification) · International (ISO)
Compliance program it supports (not its own certification) · United States Federal
Compliance program it supports (not its own certification) · International (PCI SSC)
Secureframe features
Capabilities Secureframe markets publicly. Inclusion means the feature is documented on the vendor's site — not that it's best-in-class. Last checked October 15, 2026.
Audit Evidence Collection
Automated collection, hashing, and retention of evidence (model cards, test results, approvals) for audit.
Policy Management
Authoring, versioning, and distribution of AI usage policies mapped to regulations.
Risk Assessment Workflow
Guided workflows for completing AI impact assessments, risk scoring, and approval routing.
Risk Scoring
Quantitative risk assessment for AI use cases, vendors, or model deployments.
Third-Party AI Vendor Risk
Intake and assessment of AI features in third-party SaaS used by the organization.
Third-Party AI Risk Management
Due diligence and ongoing monitoring of AI vendors, subprocessors, and foundation model providers against compliance and security criteria.
Integrations
Documented by Secureframe in public product materials.
- Okta
- Microsoft Entra ID
- Google Workspace
- GitHub
- Jira
- Slack
- Microsoft Teams
- Datadog
- MongoDB
- Rippling
- AWS GovCloud
Secureframe pricing
Three plans: Fundamentals (starting at $7,500/year, one compliance framework), Complete (quote only; adds advanced versions of third-party risk, risk management, user access reviews, Trust Center and questionnaire automation, plus SSO/SCIM and custom integrations) and Defense (quote only; CMMC tooling such as SSP and POA&M). Additional workspaces are an add-on.
Pros and cons of Secureframe
Pros
- Published starting price: the Fundamentals plan starts at $7,500 a year, unusual among the larger compliance automation platforms.
- ISO 42001 and NIST AI RMF each have a dedicated page with policy templates, pre-built tests, continuous monitoring and AI risk management; the EU AI Act is also listed as supported.
- AI assistance across the workflow: questionnaire drafting, control mapping, risk scoring, vendor document review, remediation code and evidence validation.
- Strong federal coverage (CMMC, FedRAMP, NIST 800-171, GovRAMP) for companies that sell to government.
Cons
- Only the entry plan has a public price, and both Fundamentals and Complete include a single compliance framework; Complete and Defense are quoted.
- EU AI Act support is documented only as a short help-center update (September 2025) and a framework-list entry, with no page describing its controls or templates.
- No published customer case study for ISO 42001 or AI governance; the case studies we found cover SOC 2, HIPAA, GDPR and CMMC.
- Not a technical AI testing tool: no model inventory, model evaluation, bias testing or runtime monitoring, so teams building AI systems will need one alongside it.
Alternatives to Secureframe
Frequently asked
What is Secureframe?+
Secureframe is a San Francisco-based compliance automation (GRC) platform founded in 2020. It automates evidence collection, monitoring, policies, risk and vendor management for more than 30 frameworks, including SOC 2, ISO 27001, HIPAA, CMMC, ISO 42001 and the NIST AI RMF.
Does Secureframe support ISO 42001, the NIST AI RMF and the EU AI Act?+
Yes. Secureframe added ISO 42001 and the NIST AI RMF in May 2024; its framework pages describe policy templates, pre-built tests and AI risk management. It says it added full support for the EU AI Act in September 2025. It hasn't published a page describing its EU AI Act controls, so ask to see that framework in a demo.
How much does Secureframe cost?+
Secureframe's Fundamentals plan starts at $7,500 a year and includes one compliance framework. The Complete and Defense plans are quoted on request.
What are the alternatives to Secureframe?+
The closest alternatives in this directory are Vanta, Drata, Sprinto, Scrut Automation, Hyperproof and Thoropass: compliance automation platforms built around SOC 2 and ISO 27001 that also cover AI frameworks.
Sources
- Secureframe: Frameworks (AI section lists NIST AI RMF, ISO 42001, EU AI Act)
- Secureframe: ISO 42001 compliance
- Secureframe: NIST AI RMF compliance
- Secureframe: New suite of AI capabilities and AI framework support (May 2, 2024)
- Secureframe help center: 2025 product updates (EU AI Act, MCP server, AI Evidence Validation)
- Secureframe: AI features (Comply AI, Trust AI)
- Secureframe: Pricing (Fundamentals, Complete, Defense)
- Secureframe: About (founded 2020, 200+ employees, $79M raised, hubs)
- Secureframe: Privacy policy (legal entity, San Francisco address)
- Secureframe: Customer case studies
- Secureframe: Integrations
- Secureframe help center: Identity providers (Okta, Microsoft Entra ID, Google Workspace)
- Secureframe help center: Rippling integration
- TechCrunch: Secureframe raises $18M Series A (March 2021; founders, founding date)
- PR Newswire: Secureframe raises $56M Series B (February 2022)
- IT Brief: Secureframe unveils AI Evidence Validation (May 2025)
Keep reading
See an error or outdated detail?
Profiles carry a last-checked date. If something is out of date or wrong, send a correction and we will review it.
Work at Secureframe?
Claim this listing to propose edits to the tagline, description, pricing notes, and headquarters details. Every change is still reviewed by our editorial team.