Skip to main content
Nuphos authenticates to Secureframe with an API key and secret you create in your organization’s settings. The connector is read-only: the agent reads which compliance tests are failing (SOC 2, ISO 27001, HIPAA, PCI, GDPR) and helps you remediate — it never writes to Secureframe.

​
Connect

​
Create an API key

1

Open API keys

Sign in to Secureframe as an admin and open Company settings → API keys.
2

Create the key

Click Create API key.
3

Copy both values

Copy the API key (the key id) and the API secret — the secret is shown once.

​
Connect in Nuphos

In Connectors → Connect → Secureframe, enter: Nuphos verifies the credentials against the Secureframe API before saving. The secret is held server-side only — the agent reads through a Nuphos proxy and never sees your Secureframe credentials.

​
In the Nuphos app

Compliance work happens through the agent — there’s no dedicated Secureframe browsing surface. The binding itself lives in Connectors, where an Administrator can manage its allow-list or remove it.

​
What the agent can do for you

The agent reads your compliance posture: the failing tests (or all tests, or a custom query), each with its failure message and recommended remediation steps. Where this gets powerful is cross-connector remediation:
  • “What’s failing in Secureframe right now?” — it lists the failing tests with their remediation steps.
  • When a failing test maps to a system you’ve connected — an S3 bucket without encryption on AWS, a missing DNS record on Cloudflare, a repo setting on GitHub — the agent can offer to fix it there, proposing a plan for your approval.
  • After the fix, Secureframe’s next check reflects it — the agent can track the test back to passing.

​
Permissions & authorization

Two boundaries govern what happens through this connector:
  • Hard boundary — who can use it. Only team Administrators can bind or remove the credentials, and they can restrict the binding to specific members with a member allow-list. Within a session the agent only holds credentials you explicitly selected, re-checked on every request.
  • Soft boundary — what the agent may do with it. Toward Secureframe itself the connector is read-only, so there is nothing to gate. Remediation happens through your other connectors, where the usual rules apply — changes go through plan approvals and Auto-authorization on that connector.
The outer limit is the API key’s grant: the agent reads test results and cannot alter your compliance data even in principle.

​
Good to know

  • Pick the region carefully — a US key against the UK endpoint (or vice versa) fails verification.
  • If you rotate the key in Secureframe, update the binding in Nuphos; the old key stops working immediately.