> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Secureframe

> Connect Secureframe to read your compliance posture — the failing tests that need attention.

Nuphos authenticates to Secureframe with an **API key and secret** you create
in your organization's settings. The connector is **read-only**: the agent
reads which compliance tests are failing (SOC 2, ISO 27001, HIPAA, PCI, GDPR)
and helps you remediate — it never writes to Secureframe.

## Connect

### Create an API key

<Steps>
  <Step title="Open API keys">
    Sign in to Secureframe as an admin and open **Company settings → API
    keys**.
  </Step>

  <Step title="Create the key">
    Click **Create API key**.
  </Step>

  <Step title="Copy both values">
    Copy the **API key** (the key id) and the **API secret** — the secret is
    shown once.
  </Step>
</Steps>

### Connect in Nuphos

In **Connectors → Connect → Secureframe**, enter:

| Field          | Notes                                                    |
| -------------- | -------------------------------------------------------- |
| **Label**      | A friendly name, e.g. "Acme Secureframe"                 |
| **Region**     | **US** or **UK** — must match your account's data region |
| **API Key**    | The key id                                               |
| **API Secret** | Shown once when you create the key — stored encrypted    |

Nuphos verifies the credentials against the Secureframe API before saving. The
secret is held server-side only — the agent reads through a Nuphos proxy and
never sees your Secureframe credentials.

## In the Nuphos app

Compliance work happens **through the agent** — there's no dedicated Secureframe
browsing surface. The binding itself lives in **Connectors**, where an
Administrator can manage its allow-list or remove it.

## What the agent can do for you

The agent reads your compliance posture: the failing tests (or all tests, or a
custom query), each with its failure message and recommended remediation steps.
Where this gets powerful is **cross-connector remediation**:

* *"What's failing in Secureframe right now?"* — it lists the failing tests
  with their remediation steps.
* When a failing test maps to a system you've connected — an S3 bucket without
  encryption on [AWS](/connectors/aws), a missing DNS record on
  [Cloudflare](/connectors/cloudflare), a repo setting on
  [GitHub](/connectors/github) — the agent can offer to **fix it there**,
  proposing a [plan](/agent/plans) for your approval.
* After the fix, Secureframe's next check reflects it — the agent can track the
  test back to passing.

## Permissions & authorization

Two boundaries govern what happens through this connector:

* **Hard boundary — who can use it.** Only team **Administrators** can bind or
  remove the credentials, and they can restrict the binding to specific members
  with a [member allow-list](/security/access-control). Within a session the
  agent only holds credentials you explicitly selected, re-checked on every
  request.
* **Soft boundary — what the agent may do with it.** Toward Secureframe itself
  the connector is read-only, so there is nothing to gate. Remediation happens
  through your **other** connectors, where the usual rules apply — changes go
  through [plan approvals](/security/approvals) and
  [Auto-authorization](/security/auto-mode) on that connector.

The outer limit is the API key's grant: the agent reads test results and cannot
alter your compliance data even in principle.

## Good to know

* Pick the **region** carefully — a US key against the UK endpoint (or vice
  versa) fails verification.
* If you rotate the key in Secureframe, update the binding in Nuphos; the old
  key stops working immediately.