We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk
Secureframe logo

Secureframe review

Software product

US subscription software that automates compliance evidence, with an ISO 42001 module for AI governance. You run it yourself; advice is not part of the core product.

Relevant if you want ISO 42001 software on the same platform as SOC 2 and ISO 27001

Price Not published
Indemnity cover Published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

Secureframe scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 4/5
Qualifications of the people who do the work 5/5
What it publishes about fees 1/5
Knowledge of your sector 4/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 3/5

What Secureframe offers, and what it publishes

Secureframe is software you run, not advice; any consulting is sold separately. Its ISO 42001 module gives ready-made AI management policy templates, control tests and continuous monitoring, and it supports NIST AI RMF. The same platform covers SOC 2, ISO 27001, PCI DSS, and the US rules HIPAA, FedRAMP and CMMC.

Secureframe does not publish a price. Its three tiers, Fundamentals, Complete and Defense, each ask you to request a quote. It does publish its own certifications with dates: SOC 2 Type II, ISO 27001:2022, FedRAMP 20x Low, CMMC Level 2 and TX-RAMP. ISO 42001 is not among them.

Secureframe has a UK company, Secureframe Europe Limited, and lists a London office. We found no UK government G-Cloud listing. Its public subprocessor list names OpenAI as the supplier behind its AI features, and no other AI provider. Its terms, governed by California law in the US, cap liability at the fees paid in the previous 12 months.

Strengths

  • Holds a broad independently-audited certification base of its own (SOC 2 Type II, ISO 27001:2022, FedRAMP 20x Low, CMMC Level 2, TX-RAMP), each with published validity dates
  • Explicitly names OpenAI as its only AI/LLM subprocessor in a public subprocessor list, rather than leaving AI usage undisclosed
  • Offers a dedicated ISO 42001 framework module with pre-built AIMS policy templates and continuous control monitoring

Things to check

  • Secureframe does not itself hold ISO/IEC 42001 certification, it is offered only as a customer-facing compliance framework, so buyers evaluating Secureframe's own AI governance maturity cannot point to an equivalent independent certification the vendor holds.
  • Its pricing page gives no prices. Each plan asks you to request a quote.

Common questions

Does Secureframe publish its prices?

No. Its three tiers, Fundamentals, Complete and Defense, each carry a 'Get a quote' button and no figures.

Does Secureframe have a UK company?

Yes. Secureframe Europe Limited was incorporated on 3 May 2022 with a registered office in London, and appears as an affiliate on Secureframe's own subprocessor list.

Evidence for each Secureframe score

Show our working

Notes behind each thing to check

  • Secureframe does not itself hold ISO/IEC 42001 certification, it is offered only as a customer-facing compliance framework, so buyers evaluating Secureframe's own AI governance maturity cannot point to an equivalent independent certification the vendor holds. (trust.secureframe.com lists SOC 2 Type II, ISO 27001:2022, FedRAMP 20x Low, CMMC Level 2 and TX-RAMP as certifications Secureframe holds, with no ISO 42001 entry; ISO 42001 appears only on secureframe.com/frameworks/iso-42001 as a customer-facing offering.)
  • Its pricing page gives no prices. Each plan asks you to request a quote. (secureframe.com/pricing shows three tiers (Fundamentals, Complete, Defense) each with a 'Get a quote' CTA and no dollar amounts.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 4/5 Secureframe documents continuous, integration-driven evidence collection generating an audit trail directly from source systems (AWS, Azure, GCP, Okta etc.) with cross-framework control mapping, though this is framed around audit readiness rather than explicit ICO/AI Act enforcement scenarios.
Qualifications of the people who do the work 5/5 Secureframe names a CISO (Drew Daniels) in its newsroom and holds verifiable SOC 2 Type II, ISO 27001:2022, FedRAMP 20x Low and CMMC Level 2 certifications listed with validity dates on trust.secureframe.com.
What it publishes about fees 1/5 secureframe.com/pricing shows only three tier names and 'Get a quote' CTAs with zero dollar figures published anywhere on the site.
Knowledge of your sector 4/5 Secureframe publishes named sector-specific certifications/frameworks including CMMC Level 2 (defense contractors), FedRAMP 20x and TX-RAMP (US government), and HIPAA/PCI DSS support, each with documented validity dates on its trust centre.
Independence from what it sells 4/5 Secureframe's CMMC Level 2 certification names its certifying body (Cyber AB) explicitly, and its SOC 2 Type II/ISO 27001 are standard independent audits, all listed with dates on trust.secureframe.com.
Who carries the risk if the advice is wrong 3/5 Secureframe's Terms of Service cap aggregate liability at fees paid in the prior 12 months and include mutual IP indemnification, but no specific numeric uptime/SLA commitment was found in the published Terms text itself.

Sources for Secureframe

  • Corporate entity/UK subsidiary (Secureframe, Inc. is headquartered at 548 Market St., Suite 30287, San Francisco, CA, with California named as the governing law in its Terms of Service; its UK subsidiary, Secureframe Europe Limited (company number 14082881), is registered with Companies House, incorporated 3 May 2022, registered office London EC4R 3TT) (Companies House, checked 17 July 2026)
  • AI governance product scope (Secureframe offers a dedicated ISO 42001 framework page with pre-built AI Management System (AIMS) policy templates, control tests and continuous monitoring, plus an 'AI-powered risk management tool' to identify, assess and mitigate AI risks; it also supports NIST AI RMF) (secureframe.com, checked 17 July 2026)
  • Pricing disclosure (No dollar figures are published on secureframe.com/pricing; three named tiers (Fundamentals, Complete, Defense) each carry a 'Get a quote' call to action linking to a quote-request form, pricing is fully gated) (secureframe.com, checked 17 July 2026)
  • UK presence/government availability (Secureframe is not listed as a supplier on the UK Digital Marketplace/G-Cloud (a direct site search returns zero results), but it maintains a UK legal entity (Secureframe Europe Limited) and lists London among its office hubs) (G-Cloud, checked 17 July 2026)
  • Own certifications (Secureframe's trust centre lists SOC 2 Type II (period 1 July 2024-30 June 2025), ISO/IEC 27001:2022 (issued January 2025), FedRAMP 20x Low (authorised to 20 Aug 2026), CMMC Level 2 (Cyber AB-certified, valid to 9 Sep 2028) and TX-RAMP Level 1 (valid to 6 Mar 2028); ISO 42001 is offered as a customer framework but is not listed as a certification Secureframe itself holds) (trust.secureframe.com, checked 17 July 2026)

SOC 2 Type II ISO/IEC 27001:2022 FedRAMP 20x Low CMMC Level 2 TX-RAMP Level 1

Seeking ISO 42001 certificationExposed to the EU AI ActSwitching provider

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.