# Secureframe - **Type:** Software product - **Website:** https://secureframe.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) US subscription software that automates compliance evidence, with an ISO 42001 module for AI governance. You run it yourself; advice is not part of the core product. ## Secureframe scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 4/5 Secureframe documents continuous, integration-driven evidence collection generating an audit trail directly from source systems (AWS, Azure, GCP, Okta etc.) with cross-framework control mapping, though this is framed around audit readiness rather than explicit ICO/AI Act enforcement scenarios. ### Qualifications of the people who do the work: 5/5 Secureframe names a CISO (Drew Daniels) in its newsroom and holds verifiable SOC 2 Type II, ISO 27001:2022, FedRAMP 20x Low and CMMC Level 2 certifications listed with validity dates on trust.secureframe.com. ### What it publishes about fees: 1/5 secureframe.com/pricing shows only three tier names and 'Get a quote' CTAs with zero dollar figures published anywhere on the site. ### Knowledge of your sector: 4/5 Secureframe publishes named sector-specific certifications/frameworks including CMMC Level 2 (defense contractors), FedRAMP 20x and TX-RAMP (US government), and HIPAA/PCI DSS support, each with documented validity dates on its trust centre. ### Independence from what it sells: 4/5 Secureframe's CMMC Level 2 certification names its certifying body (Cyber AB) explicitly, and its SOC 2 Type II/ISO 27001 are standard independent audits, all listed with dates on trust.secureframe.com. ### Who carries the risk if the advice is wrong: 3/5 Secureframe's Terms of Service cap aggregate liability at fees paid in the prior 12 months and include mutual IP indemnification, but no specific numeric uptime/SLA commitment was found in the published Terms text itself. ## Sources for Secureframe Every line carries the page it was read on and the date it was checked. - Corporate entity/UK subsidiary - Source: https://find-and-update.company-information.service.gov.uk/company/14082881 - Checked: 2026-07-17 - AI governance product scope - Source: https://secureframe.com/frameworks/iso-42001 - Checked: 2026-07-17 - Pricing disclosure - Source: https://secureframe.com/pricing - Checked: 2026-07-17 - UK presence/government availability - Source: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/search?q=secureframe - Checked: 2026-07-17 - Own certifications - Source: https://trust.secureframe.com/ - Checked: 2026-07-17 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Published - Credentials: Published - Independent accreditation: Published - Client results: Published - How it uses AI: Published ## Strengths - Holds a broad independently-audited certification base of its own (SOC 2 Type II, ISO 27001:2022, FedRAMP 20x Low, CMMC Level 2, TX-RAMP), each with published validity dates - Explicitly names OpenAI as its only AI/LLM subprocessor in a public subprocessor list, rather than leaving AI usage undisclosed - Offers a dedicated ISO 42001 framework module with pre-built AIMS policy templates and continuous control monitoring ## Things to check Each one carries the factual basis it rests on. - Secureframe does not itself hold ISO/IEC 42001 certification, it is offered only as a customer-facing compliance framework, so buyers evaluating Secureframe's own AI governance maturity cannot point to an equivalent independent certification the vendor holds. - Basis: trust.secureframe.com lists SOC 2 Type II, ISO 27001:2022, FedRAMP 20x Low, CMMC Level 2 and TX-RAMP as certifications Secureframe holds, with no ISO 42001 entry; ISO 42001 appears only on secureframe.com/frameworks/iso-42001 as a customer-facing offering. - Its pricing page gives no prices. Each plan asks you to request a quote. - Basis: secureframe.com/pricing shows three tiers (Fundamentals, Complete, Defense) each with a 'Get a quote' CTA and no dollar amounts. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [How do you change your data protection provider?](https://theassurancedesk.com/best/switching-provider) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.