Short answer: the Msafe API for compliance makes secure file transfer part of your governance, risk and compliance environment. Through the API you read the action log of every share and pass it on to your SIEM or GRC system, manage access through AD groups and clean up shares and files automatically according to your retention periods. That makes every file transfer demonstrable for NIS2, DORA and the GDPR. Standard integrations with Workiva, ServiceNow, Splunk, Microsoft Sentinel, Okta, OneTrust and BigID, among others, are on the roadmap for Msafe 2.8 in 2027.
Updated on 4 November 2026
Why integration is becoming the foundation of compliance
In modern organisations, information rarely stands still. It flows between systems, departments, suppliers and customers, and it is in that movement that the greatest risks arise. To make compliance measurable and sustainable, your systems need to talk to each other. A separate tool with its own log file that you export by hand no longer fits that picture.
“Integration is the missing link in many compliance strategies. With the Msafe API, organisations can feed audit information directly into their GRC dashboard. That saves weeks of preparation for internal audits.”
Thijs van der Linden, COO of Msafe
What an API means for compliance
An API (Application Programming Interface) is the digital bridge between systems. Data, logs and user activity then flow automatically between Msafe Secure File Transfer and your other tools, without manual exports or double entry. For compliance, that means:
- evidence of file transfers ends up in your governance and risk platform automatically;
- access and permissions are managed centrally;
- risk data stays consistent across applications.
What you can connect today with the Msafe API for compliance
The Msafe API is a REST API with API keys that are given permissions per share. You will find all endpoints in the public Swagger documentation. This is what you can do with it today:
1. Send the audit trail to your SIEM or GRC system
For each share, you request the action log through the API: who uploaded, downloaded, shared or deleted what, and when. With your own integration, you pass that data on to a SIEM system for security monitoring or to a GRC platform for risk analyses and audit reports. As a result, an unusual download becomes visible in context, and every transfer also gets a place in your governance overview.
2. Manage access centrally
Through the API you add AD groups, internal and external participants and administrators to a share, or remove them. Employees log in with Single Sign-On through Microsoft Entra ID, and SCIM provisioning handles joiners and leavers automatically. External recipients confirm their identity with, for example, an SMS code or authenticator. The integrations themselves are limited too: an API key only works for the shares it has been added to, with only the permissions it needs.
3. Enforce retention periods automatically
The GDPR requires data minimisation and retention periods. With the API you create temporary shares and delete files or entire shares automatically as soon as they are no longer needed. As a result, no old copies remain. This is another way the Msafe API for compliance reduces risk. Read more about the GDPR and secure file sharing.
4. Share securely from the workplace
For Outlook, there is the ready-made Msafe Connector. In addition, you can connect other applications, such as Microsoft Teams or SharePoint, through the API. Users then share securely without leaving their familiar environment.
“Security shouldn’t feel like extra work. Thanks to our Msafe integration in Microsoft applications, compliance becomes part of how modern organisations operate.”
Thijs van der Linden, COO of Msafe
On the roadmap: standard integrations in Msafe 2.8
Today, you build the integration with your GRC, SIEM, IAM or privacy platform yourself on top of the API. Msafe 2.8, planned for 2027, will add standard integrations with, among others:
- GRC platforms: Workiva and ServiceNow;
- SIEM: Splunk and Microsoft Sentinel;
- Identity & Access Management: Okta;
- Privacy and data governance: OneTrust and BigID.
The roadmap may still change. Want to know what this means for your environment? Get in touch through a Proof of Concept.
What the Msafe API for compliance delivers
- Technically: Msafe automates evidence and logging. In addition, it records every upload, download and deletion, so you can retrieve it straight away.
- Organisationally: compliance, IT and security work from the same data. That reduces silos and errors.
- Strategically: transparency becomes measurable. For example, executives see where things stand, regulators see demonstrable control and customers gain confidence in how their data is handled.
The Msafe API for compliance under NIS2, DORA and the GDPR
The Dutch Cybersecurity Act, the Dutch implementation of NIS2, has applied since 15 August 2026 and requires appropriate measures and evidence that they work. DORA requires financial institutions to manage ICT risks and ICT providers. The GDPR requires accountability for every processing activity. An audit trail that flows into your own systems automatically helps with all three. Read more about NIS2 and secure file sharing, DORA and demonstrable compliance.
Compliance as an ecosystem
Compliance is no longer a standalone function, but a connected whole of people, processes and systems. The Msafe API connects secure file transfer to that whole. That turns compliance into something you do not just check, but can prove. Want to see how the API works in processes such as sharing incident footage or client documents? Read how to automate secure file sharing with the Msafe API.
Frequently asked questions about the Msafe API for compliance
Integrations and logging
Yes. Through the Msafe API you request the action log per share and pass it on to your SIEM or GRC system with your own integration. Standard integrations with Splunk, Microsoft Sentinel, Workiva and ServiceNow, among others, are on the roadmap for Msafe 2.8 in 2027.
Msafe 2.8, planned for 2027, will add standard integrations with Workiva, ServiceNow, Splunk, Microsoft Sentinel, Okta, OneTrust and BigID, among others. The roadmap may still change.
Access and retention
You add AD groups, internal and external participants and administrators to a share, or remove them. API keys only work for the shares they have been added to and with the permissions they need.
Yes. You can create temporary shares and delete files or shares automatically as soon as they are no longer needed. As a result, no old copies remain.
Want to know how the Msafe API fits your governance and compliance environment? Request a free Proof of Concept.
