A free security architecture review tool
Upload an architecture document or draw it. SecArch checks the design against the standards you pick, lists the findings and writes the report.
Start freeSee threat modelling
How a review works
- Bring the design. Import a document or diagram, paste text, or draw on the canvas.
- Describe what matters. Each component and connection carries security facts: authentication, encryption at rest and in transit, TLS version, logging, internet exposure and the data it handles.
- Run the review. A rules engine checks the model against the standards you selected. The same design always gives the same result.
- Download the report. Findings, control requirements and recommendations, as PDF and Excel.
Standards and frameworks covered
201 review rules are mapped to 27 standards and frameworks. The mappings cover selected controls, not the full text of each standard.
| Area | Included |
|---|---|
| Information security | ISO/IEC 27001:2022 Annex A, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev. 5, CIS Critical Security Controls v8.1, CIS Benchmarks |
| Payments and resilience | PCI DSS v4.0.1, DORA (Regulation (EU) 2022/2554) |
| Application security | OWASP Top 10 (2021 and 2025), OWASP API Security Top 10:2023 |
| AI systems | OWASP Top 10 for LLM Applications 2025, OWASP Machine Learning Security Top 10, OWASP Top 10 for Agentic Applications, EU AI Act, NIST AI RMF 1.0, NIST AI 600-1, CSA AI Controls Matrix |
Honest limits
The standards content is draft until a security specialist has checked each mapping. Treat references as guidance and confirm them against the published text before relying on a report for audit. A design review shows what the design says, not how a system is built or configured.
Your data
Imports, diagrams, reviews and reports are processed in your browser. For the web app you need a free account, which holds your email address. The desktop app works without an account.