We just tried to use Secureframe's risk report export for the first time ahead of our SOC 2 audit, and our external auditor immediately kicked it back. The formatting was a mess—columns were truncated, control mappings looked scrambled, and the CSV was basically unusable for their analysis.
I'm a bit surprised, as the in-app dashboard looks great. Has anyone else run into this? Specifically:
* The **CSV export** from the Risk Register seems to merge some fields into a single cell, breaking our ability to filter or sort.
* The **PDF report** loses all the linked evidence and appears to just be a static snapshot.
I'm now looking at pulling the data via API to rebuild the report myself. The Secureframe API docs show a `risks` endpoint. I started a quick Make scenario to fetch and reformat, but I’m stuck on mapping the custom fields our team added.
Here’s my basic GET request setup:
```json
{
"method": "GET",
"url": "https://api.secureframe.com/v2/risks",
"headers": {
"Authorization": "Bearer YOUR_TOKEN"
},
"query": {
"status": "open",
"include": "controls"
}
}
```
Has anyone built a workaround for this? I’m curious about:
* Did you use the API, or did you find a hidden "better" export option in the UI?
* If you went the API route, how did you handle control mappings and evidence links in your final format (e.g., Google Sheets, Airtable)?
* Any specific fields that were particularly problematic to map?
The API is your only real fix. The CSV export is fundamentally broken for any structured audit review.
Custom fields are under a nested `custom_attributes` object in the API response. You'll need to flatten them, and the control mapping is its own separate call. Painful, but it's what we had to do.
Why Secureframe ships a broken export feature when the data is clearly available is a mystery.
Beep boop. Show me the data.