Secfix
Munich-based compliance automation platform for ISO 27001, TISAX and NIS2 with expert support alongside the software
Quick Overview
| Company | Secfix GmbH |
|---|---|
| Category | Compliance Automation Software |
| Headquarters | Munich, Germany |
| Founded | Not stated |
| EU Presence | Yes - Germany (EU) |
| Data Location | EU (European cloud infrastructure, per Secfix security page) |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | No |
| Main Features | Automated checklist of 250+ checks, risk management with 100+ pre-mapped controls, policy management, vendor management, employee onboarding and offboarding, device monitoring, trust center, AI questionnaires |
| Pricing | Not published, see website |
| Best For | European startups and SMEs aiming for ISO 27001, TISAX or NIS2 |
| Replaces | Vanta, Drata, Secureframe |
Detailed Review
Secfix is a Munich company (Secfix GmbH, registered in the Munich commercial register) that sells an ISO 27001 and NIS2 automation platform to European companies. Its homepage describes the product as an all-in-one security compliance platform for Europe and lists ISO 27001, SOC 2, TISAX, GDPR, DORA, NIS2, ISO 27701, ISO 27018, ISO 42001 and ISO 9001.
The security page states that Secfix operates exclusively on European cloud infrastructure and that customer data is stored and processed within the EU, with no transfer outside the EEA without a documented legal basis.
Automation and checks
Secfix generates a checklist of 250+ checks that run against connected systems, covering cloud providers (AWS, Google Cloud, Azure), identity providers (Microsoft 365, Azure AD, Google Workspace) and ticketing tools such as Jira.
Employee compliance, onboarding and offboarding tasks and security training are handled in the same workflow, so HR changes feed into the evidence record.
Risk, policy and vendor management
Risk assessments are linked to more than 100 pre-mapped controls, with guided questions to identify new risks. Policy management ships 20+ customisable templates with acceptance tracking.
Vendor management can discover new vendors through Google Workspace or Office 365 SSO and keep security reviews up to date.
Experts alongside the software
The homepage says Secfix pairs automation with dedicated experts. The about page describes a team of auditors, engineers and customer success managers, with teams in Munich, Berlin, London and other cities.
Limitations to Consider
Secfix does not publish prices, so you need a demo to compare cost with Cyberday, which lists prices by headcount. The platform is aimed at startups, SMEs and mid-market firms; large enterprises with complex multi-entity setups may want Kertos or Hicomply enterprise tiers. There is no self-hosted option.
Who Should Use Secfix
European startups and SMEs that want ISO 27001, NIS2 or TISAX certification on EU infrastructure with a German contracting entity.
Pros and Cons
Pros
- Hosted exclusively on European cloud infrastructure
- Covers ISO 27001, NIS2, DORA, TISAX and GDPR
- Experts available alongside the software
- Vendor and risk management included
- German GmbH with a public commercial register entry
Cons
- Pricing not published
- No self-hosting
- Integration catalogue is smaller than the large US platforms (inferred, not verified)
- Aimed at SME and mid-market
Alternatives to Secfix
Other European compliance automation software worth comparing before you decide:
Kertos
Germany · ISMS and privacy automation with certified experts on call
ISMS.online
United Kingdom · Established ISMS platform with a guided path to certification
Cyberday
Finland · Employee-based pricing and a very wide framework library
Hicomply
United Kingdom · UK ISMS platform with a customer success manager on every plan
See all European compliance automation software or compare them directly against Vanta on our alternatives page.
Frequently Asked Questions
Its security page states that Secfix operates exclusively on European cloud infrastructure and that customer data is stored and processed within the EU.
Its site lists ISO 27001, SOC 2, TISAX, GDPR, DORA, NIS2, ISO 27701, ISO 27018, ISO 42001 and ISO 9001.
No. The pricing page does not show amounts, so you have to book a demo to get a quote.