# Secfix — Information Security

Secfix by Secfix GmbH holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-10-15. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Secfix GmbH (https://www.secfix.com)
- Category: [Information Security](https://whats-best.ai/software/information-security.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/information-security/secfix
- Alternatives: https://whats-best.ai/software/information-security/secfix/alternatives ([markdown](https://whats-best.ai/software/information-security/secfix/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Secfix GmbH
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Secfix, an all-in-one security compliance platform from Secfix GmbH, earns its highest scores on breadth and control mechanics. Framework coverage is the most consistent strength at a flat 8 — ten regimes, from ISO 27001 to NIS2, on one data basis, with one risk scenario and one piece of evidence mapping across frameworks. Controls and statement of applicability score 7-8, audit readiness 7-8, and integrations and automation 7-8, supported by 100+ pre-built integrations, 250+ automated checks and a well-documented public API. Sovereignty sits at a flat 2 — no public information on hosting location, a data processing agreement or a subprocessor list — and the German legal form is the only European signal in the captures. Information security management scores 6-7, held there by an unevidenced incident side: no incident module appears in the published module lists. The judges did not meaningfully split — no criterion spans more than one point and no meaningful disagreement was flagged; the single-point spreads reflect degree, not direction. Prices are unpublished; the demo is free and non-binding.

**Speaks for it:**
- Statement of Applicability generates as controls are assessed, with exclusion justifications and each control linked to the evidence proving it.
- One risk scenario and one piece of collected evidence map across the ten supported frameworks, including DORA pre-mapped against ISO 27001, SOC 2 and GDPR.
- Assets are discovered live from MDM, SaaS and cloud sources with automatic owner assignment, bulk classification and in/out-of-scope tracking.
- 100+ pre-built integrations across SSO, Cloud, Ticketing and HRIS feed 250+ automated checks running continuously across systems, people, devices and vendors.
- A public API with OAuth 2.0 client credentials, an OpenAPI 3.0 contract the vendor states is generated from the same source as production, RFC 7807 errors and additive-only versioning.

**Held against it:**
- Sovereignty scored a flat 2, with no public information on hosting location, a data processing agreement or a subprocessor list.
- No incident module appears in the published module lists, and judges found no public information on incident workflows with statutory reporting clocks.
- The documented API surface covers computers and inventory assets, and judges found no public information on webhooks, SCIM or event streams.
- Judges found no public information on exportable audit-scoped proof packs or on reconstructing the state on a given past date.
- No prices are published — the only pricing fact captured is a free, non-binding demo.

**Best for:**
- You run compliance against several frameworks at once and want each control answered once, with evidence reused across ISO 27001, SOC 2, TISAX, GDPR, DORA and NIS2.
- You are a startup or SME preparing a first ISO 27001 certification and want the internal audit run inside the tool before the external auditor arrives.
- Your estate already runs on AWS, Azure, GCP, Intune, Jamf or Google Workspace and you want a live inventory with continuous checks instead of a spreadsheet.
- You want a dedicated team of compliance experts bundled with the platform rather than a separate consultancy.

**Avoid if:**
- You need incident handling with statutory reporting clocks in the same tool — ask the vendor: the public pages we read do not show it
- You must verify hosting location, a data processing agreement or the subprocessor list before committing — judges found no public information on any of these, and sovereignty scored a flat 2.
- You need the API to reach risks, controls and evidence — the documented API surface covers computers and inventory assets, with no public information on webhooks or SCIM.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The GRC Consultant | The Drafted IT Officer | The Lead Auditor | The Evidence Integrator | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Asset & risk management depth | 3/5 | 3/5 | 3/5 | 3.5/5 | 3/5 | 3/5 |
| Controls, SoA & measures | 4/5 | 4/5 | 3.5/5 | 4/5 | 4/5 | 4/5 |
| Framework & standard coverage | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Audit readiness & evidence | 4/5 | 4/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 |
| Integrations & automation | 4/5 | 4/5 | 3.5/5 | 4/5 | 4/5 | 3.5/5 |
| European sovereignty | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **3.5/5** | **3.5/5** | **3/5** | **3.5/5** | **3.5/5** | **3/5** |

### The judges

- **The CISO** (v1.0): Owns the ISO 27001 certificate and the NIS2 exposure of a 400-employee company. Optimizes for a real risk backbone: methodology, inheritance, incident clocks, a statement of applicability that is never stale. Rejects checklist theater and risk registers that cannot answer who accepted what.
- **The GRC Consultant** (v1.0): Builds and runs ISMSs for a dozen clients at once. Optimizes for reusable control catalogs, multi-framework mapping that answers a control once, and templates that make client twelve cheaper than client one. Rejects single-tenant tools and frameworks bolted on as checklists.
- **The Drafted IT Officer** (v1.1): SME IT admin who became the information security officer by an email from management. Optimizes for guided setup, sane defaults, plain-language controls and a tool that runs alongside the day job. Rejects platforms that assume a security team and a consultant on retainer.
- **The Lead Auditor** (v1.0): Certifies ISMSs for a living and has seen every folder of screenshots. Optimizes for revision-safe history, an SoA generated from live control status, and a defensible answer to "show me the state on date X". Rejects audit trails assembled the week before the audit.
- **The Evidence Integrator** (v1.0): Believes evidence that is typed is evidence that is stale. Optimizes for connectors to the live estate — directory, CMDB, ticketing, cloud — continuous control checks, and an API with parity to the UI. Rejects data islands with a CSV drawbridge.
- **The Skeptic** (v1.1): Hunts "100% audit success" claims, framework logos that link nowhere, "coming soon" integrations sold as shipped, consulting bundled as software, and customer counts that disagree between pages. Exists to keep the rest of the bench honest.

## European sovereignty — proven facts

No sovereignty finding yet.

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Integrations**
- API auth: oauth2_client_credentials_bearer · POST /oauth/token [S10]
- API base URL: https://api.secfix.com [S10]
- API computers endpoints: all:read · GET /v1/computers · GET /v1/computers/{id} [S10]
- API errors format: rfc7807_problem_json [S10]
- API inventory endpoints: all:read / all:write · GET /v1/inventory/assets · GET /v1/inventory/assets/{id} · PATCH /v1/inventory/assets/{id} · PATCH /v1/inventory/assets (bulk) · GET /v1/inventory/categories [S10]
- API openapi spec: /api-reference/openapi.yaml · yes [S10]
- API openapi sync: yes [S10]
- API pagination: opaque_cursor [S10]
- API rate limits: per_client_id [S10]
- API unauthenticated endpoints: GET /v1/health [S10]
- API versioning: additive_only_v1 [S10]
- Asset management: Asset Management module [S5]
- Count: 100 [S3]
- Count: 100 [S4]
- Device monitoring: Device Monitoring module [S5]
- Named: AWS · Azure · GCP · Google Workspace · Office 365 · Microsoft Intune · Jamf [S3]
- People management: People Management module [S5]
- Policy management: Policy Management module [S5]
- Prebuilt: yes · SSO · Cloud · Ticketing · HRIS [S7]
- Risk management: Risk Management module [S5]
- Security monitoring: Security Monitoring module [S5]
- Trust center: Trust Center feature [S5]
- Vendor management: Vendor Management module [S5]

**Legal**
- Terms: Terms of Service · EULA · Privacy · Cookies · Security · Imprint [S5]

**Pricing**
- Pricing page availability: no [S1]

**Product**
- AI questionnaires: AI Questionnaires feature [S5]
- Audit lifecycle: Supports Stage 1, Stage 2, annual surveillance audits and recertification [S8]
- Audit success rate: 100 [S2]
- Audit success rate: 100 [S4]
- Auditor view only access: Auditors get structured, view-only access to evidence, controls, and non-conformities [S8]
- Audits supported: 1000 [S2]
- Audits supported: 1000 [S4]
- Audits supported: 1000 [S8]
- Automated checklist: yes · 250 [S1]
- Automated checks: systems, people, devices, vendors; cloud, on-premises, or mixed · 250 [S8]
- Capabilities: automated documentation · real-time updates · continuous monitoring · automated evidence collection · document upload · security reports · alerts and notifications [S6]
- Continuous completeness checks: yes [S3]
- Continuous evidence: Continuous evidence collection with due-soon and overdue flags [S8]
- Control evidence linking: Each control links to the evidence proving it [S4]
- Cross framework mapping: /ISO 27001 · /SOC 2 · /TISAX · /GDPR [S2]
- Custom assets import: yes · bulk Excel [S3]
- Customer satisfaction: 98 [S2]
- Customer satisfaction: 98 [S4]
- Customer satisfaction: 98 [S8]
- Demo free: yes · yes [S7]
- Demo offer: free · no · yes [S6]
- Dora target: DORA compliance for small businesses [S7]
- Employee compliance: Employee Compliance: automate onboarding/offboarding, task reminders, security trainings across frameworks [S1]
- Employee modules: security training · privacy training · onboarding · offboarding [S6]
- Employees module: security & privacy training, onboarding/offboarding automation [S7]
- Evidence metadata: Evidence items show owner, due frequency, and auditor expectations [S4]
- Evidence upload once reuse: Evidence collected once is mapped to every framework and reuse supported [S4]
- Expert support: yes [S7]
- Expiry notifications: Owner notifications before evidence expires [S4]
- Finding tracking: Non-conformities logged, assigned an owner, tracked to closed; internal audit run first [S8]
- Framework mapping: ISO 27001 · SOC 2 · TISAX · NIS2 · ISO 42001 · DORA [S3]
- Framework mapping: ISO 27001 · SOC 2 · TISAX · NIS 2 · GDPR · ISO 42001 · EU AI Act [S4]
- Framework mapping: yes · 27001 · SOC 2 · GDPR [S7]
- Frameworks: ISO 27001 · SOC 2 · TISAX · GDPR · DORA · NIS2 · ISO 9001 · ISO 27701 · ISO 27018 · ISO/IEC 42001 [S5]
- Frameworks: ISO 27001 · SOC 2 · TISAX · GDPR · DORA · NIS2 · ISO 9001 · ISO 27701 · ISO 27018 · ISO/IEC 42001 [S9]
- Frameworks footer: ISO 27001 · SOC 2 · TISAX · GDPR · DORA · NIS2 · ISO 9001 · ISO 27701 · ISO 27018 · ISO/IEC 42001 [S8]
- Frameworks supported: ISO 27001 · SOC 2 · TISAX · GDPR · DORA · NIS2 · ISO 9001 · ISO 27701 · ISO 27018 · ISO/IEC 42001 [S6]
- Frameworks supported list: ISO 27001 · SOC 2 · TISAX · GDPR · DORA · NIS2 · ISO 9001 · ISO 27701 · ISO 27018 · ISO/IEC 42001 [S3]
- G2 leader: /G2 industry leader [S2]
- G2 leader: yes [S4]
- G2 rating: Rated a leader on G2 based on hundreds of customer reviews [S8]
- Integration purpose: Secfix integrates with infrastructure and business tools to automate checks, reduce workload, and stay audit-ready [S9]
- Integrations: yes · SSO · Cloud · Ticketing · HRIS [S6]
- Integrations count: 100 [S2]
- Integrations count: 100 [S8]
- Inventory: yes [S6]
- Inventory: asset inventory via MDM/SaaS import [S7]
- ISO 27001 case: Customer reports achieving ISO 27001 certification using Secfix [S8]
- ISO 27001 support: Secfix helps organizations achieve ISO 27001 in weeks with real experts [S5]
- Iso27005 methodology: ISO 27005 · /identification · /analysis · /evaluation · /treatment · /monitoring [S2]
- Languages: German · Spanish · English · Portuguese [S6]
- Live inventory: Automatic asset discovery with owners and classification, audit-ready inventory [S3]
- Manual work reduction: 90 [S2]
- Manual work reduction: 90 [S3]
- Manual work reduction: 90 [S4]
- Manual work reduction: 90 [S8]
- Modules: Integrations · Security Monitoring · Risk Management · Vendor Management · Policy Management · People Management · Asset Management · Device Monitoring · Trust Center · CISO AI · AI Questionnaires [S3]
- Modules: Security Monitoring · Risk Management · Vendor Management · Policy Management · People Management · Asset Management · Device Monitoring · Trust Center · CISO AI · AI Questionnaires [S9]
- Modules footer: Security Monitoring · Risk Management · Vendor Management · Policy Management · People Management · Asset Management · Device Monitoring · Trust Center · CISO AI · AI Questionnaires [S8]
- Modules list: Integrations · Security Monitoring · Risk Management · Vendor Management · Policy Management · People Management · Asset Management · Device Monitoring · Trust Center · CISO AI · AI Questionnaires [S6]
- Monitoring checks: 250 [S6]
- Monitoring checks: ISO 27001 controls · 250 [S7]
- New feature ciso AI: new · CISO AI [S7]
- Nis2 claim speed: claims NIS2 compliance 90% faster [S6]
- Owners bulk assignment: yes · internal · confidential [S3]
- Platform description: All-in-one security compliance platform automating ISO 27001, NIS2, GDPR and more, with dedicated experts [S1]
- Policies: yes · 20 [S7]
- Policy management: 20 [S1]
- Policy templates: 20 · yes [S6]
- Prebuilt controls: 100 [S4]
- Prebuilt controls: 100 [S8]
- Prebuilt scenarios owners: yes · yes · yes [S2]
- Premapped controls: 250 [S8]
- Risk linkage: /controls · /evidence · /policies · /vendors [S2]
- Risk management: 100 [S1]
- Risk management: yes [S6]
- Risk management: risk management with automated workflows, real-time alerts, treatment plans [S7]
- Risk register controls: 100 · ISO 27001 · SOC 2 · NIS 2 [S2]
- Satisfaction stat: 98 [S3]
- Scope tracking: yes · yes [S3]
- Segments: Startups · SMEs · Mid-Market [S9]
- Soa generation: Statement of Applicability generated as controls are assessed, with justifications for exclusions [S4]
- Solutions segments: Startups · SMEs · Mid-Market [S5]
- Stats: 1000 · 100 [S3]
- Target segment: platform tailored for small businesses [S6]
- Templates: yes · yes [S7]
- Time saving claim: 90 [S7]
- Vendor management: Vendor management with automatic discovery via Google Workspace/Office365 SSO, risk tracking, security reviews [S1]
- Version history: Full version history for evidence and controls with AI change summaries [S4]

**Support**
- Availability: 24/7 [S6]
- Availability: yes [S7]
- Resources: Courses · Webinars · Blog [S5]
- Round the clock: 24/7 · all customers [S5]

## Questions

### Is Secfix European?

Not determined: the vendor’s pages as captured do not say where Secfix is based.

### Where does Secfix store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Secfix have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Secfix?

As of 21 Oct 2026, the panel rates [6clicks (3.5/5)](https://whats-best.ai/software/information-security/6clicks), [preeco | informationssicherheit (3.5/5)](https://whats-best.ai/software/information-security/preeco-informationssicherheit) and [Akarion GRC Cloud (ISMS) (3/5)](https://whats-best.ai/software/information-security/akarion-isms) highest among the other 26 Information Security products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | informationssicherheit](https://whats-best.ai/software/information-security/preeco-informationssicherheit) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Secfix alternatives](https://whats-best.ai/software/information-security/secfix/alternatives).

## What this page leaves out

- We could not confirm any compliance information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind.
- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 18 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor page: https://www.secfix.com (checked 2026-10-13)
- [S2] Asset & risk management depth — found from sitemap: https://www.secfix.com/product/risk-management (checked 2026-10-13)
- [S3] Asset & risk management depth — found from sitemap: https://www.secfix.com/product/asset-management (checked 2026-10-13)
- [S4] Controls, SoA & measures — found from sitemap: https://www.secfix.com/product/controls-and-evidence (checked 2026-10-13)
- [S5] Controls, SoA & measures — found from sitemap: https://www.secfix.com/post/identify-non-applicable-controls-in-statement-of-applicability-soa (checked 2026-10-13)
- [S6] Framework & standard coverage — found from sitemap: https://www.secfix.com/frameworks/nis2 (checked 2026-10-13)
- [S7] Framework & standard coverage — found from sitemap: https://www.secfix.com/frameworks/dora (checked 2026-10-13)
- [S8] Audit readiness & evidence — found from sitemap: https://www.secfix.com/product/audit-hub (checked 2026-10-13)
- [S9] Integrations & automation — found from sitemap: https://www.secfix.com/integrations (checked 2026-10-13)
- [S10] Integrations & automation — found from sitemap: https://developer.secfix.com/api-reference/overview (checked 2026-10-13)

---

Cite as: whats-best.ai, "Secfix — Information Security", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/information-security/secfix

Corrections: https://whats-best.ai/correct/716?target=page