Been using Secureframe for about six months now. It’s fine for the basics—collecting evidence, mapping controls, the usual SOC 2 checklist theater. But the moment you need to actually *proactively* manage compliance instead of just react to it, you hit a wall.
Case in point: I wanted to know when critical controls were sitting without evidence for more than a week. You know, before an auditor asks. Out of the box? Not an option. So I spent an afternoon with their API and a lightweight internal script to bridge the gap.
Here’s the gist of what I had to pull together:
- Query the `/controls` endpoint, filter for `status: 'non_compliant'` and `critical: true`
- Cross-reference with the evidence logs to find the last `submitted_at` date
- If the delta is >7 days, it triggers an alert to our internal ops channel
It works, but it feels like something that should be a native feature, or at least a configurable workflow. For a platform that touts automation, having to build this externally is a bit rich. The API is decent, but it’s another system to maintain.
I’m curious if anyone else has patched similar gaps. Are you all just relying on the standard report schedules, or have you also resorted to DIY monitoring for what feels like basic oversight?