Docs / Observability and data
Secureframe
Connect Secureframe read-only so the agent can find failing compliance tests and help you fix them.
Pangea connects to Secureframe with an API key and secret that you create in your company settings. The connector is read-only. The agent reads which compliance tests are failing, for frameworks such as SOC 2, ISO 27001, HIPAA, PCI and GDPR, and helps you fix them. It never writes to Secureframe.
Connect
1. Create an API key
- Sign in to Secureframe as an admin.
- Open Company settings → API keys.
- Click Create API key.
- Copy the API key (the key id) and the API secret. Secureframe shows the secret only once.
2. Connect in Pangea
As a team Administrator, open Connectors → Connect → Secureframe and fill in:
| Field | Notes |
|---|---|
| Label | A friendly name, for example Acme Secureframe |
| Region | US (api.secureframe.com) or UK (api-uk.secureframe.com). It must match your account's data region |
| API Key | The key id |
| API Secret | Shown once when you create the key. Stored encrypted |
Pangea verifies the credentials with the Secureframe API before it saves them. The secret stays on Pangea's servers. The agent reads through a Pangea proxy and never sees your Secureframe credentials.
In the Pangea app
A connected organization gets a Failed Tests page. The connection itself lives in Connectors, where an Administrator can manage its allow-list or remove it.
What the agent can do for you
The agent reads the failing tests, all tests, or a custom query, each with its failure message and fix steps. The real value is fixing things across connectors:
- "What's failing in Secureframe right now?" The agent lists the failing tests with their fix steps.
- When a failing test points to a system you've connected, such as an unencrypted S3 bucket in AWS, a missing DNS record in Cloudflare or a repository setting in GitHub, the agent can offer to fix it there. It uses that connector's permissions and the normal review flow.
- After the fix, Secureframe's next check picks it up, and the agent can follow the test back to passing.
Permissions
Team Administrators connect and remove this connection. They can limit who uses it with a member allow-list. Fixes made through other connectors follow Auto Mode and Full Access, and significant infrastructure work goes through plans.
Good to know
- Pick the region carefully. A US key against the UK endpoint, or the other way round, fails verification.
- If you rotate the key in Secureframe, the old key stops working at once. Remove the connection and connect again with the new key.