Drata
Compliance · drata.com · last read 2026-11-09
At a glance
- Is Drata GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Drata itself publishes, each answer linked to its source and the date we read it.
- Does Drata have a data processing agreement (DPA)?
- Drata's agreement is not public: it sits behind a sign-in or a request to sales, so its terms are not recorded here. Source and date
- Does Drata have a SOC 2 report?
- Drata says a SOC 2 Type 2 report is available on request. We read this on 2026-11-09. Source and date
- Is Drata ISO 27001 certified?
- Drata states ISO/IEC 27001 certification (2022 edition, as Drata names it), and says the certificate or audit report is available on request. We read this on 2026-11-09. Source and date
- Who are Drata's subprocessors?
- Drata lists 51 third-party subprocessors; 49 of them name at least one processing country outside the EEA. We last read the list on 2026-11-09. Source and date
- How do you report a security vulnerability to Drata?
- Drata publishes a security.txt at drata.com naming [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Drata Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | drata.com · 2026-11-09 |
Data location
No data-location observation recorded yet.
The same question for every vendor: where SaaS vendors store EU data.
Drata's subprocessor list names AWS and Google for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
51 third parties · 49 with a country outside the EEA · all read 2026-11-09
| Subprocessor | Country | Purpose |
|---|---|---|
| Algolia | US | [SafeBase] Hosted search and discovery platform to add fast, relevant, and scalable search functionality to the user experience. |
| Amazon Web Services (AWS) | US, IE, DE, AU | [Drata & SafeBase] Cloud service provider that stores, transmits, and processes all customer data. |
| Amplitude | US | [Drata] Product usage analytics to track user interactions, behavior, and engagement for improving the user experience. |
| Anthropic | US | [AI Agent Governance] Large language model services used to power AI-assisted features specific to the AI Agent Governance product. |
| Apideck | DE | [Opt-in] Facilitates interactions with a customer's configured cloud storage services (retrieving files, shared drives, downloading, converting formats, handling sessions and connections). |
| Basedash | US | Data management platform used to view, edit, and manage database records through a secure interface. |
| Bird | US | Cloud communications platform that enables the sending of messages and notifications within the platform. |
| Birdie | US | Used to capture and share customer issues and feedback as part of handling customer support requests and to track and reproduce issues. |
| Braintrust | US, EU | [Opt-in] AI observability and evaluation platform to log, monitor, and evaluate AI workflows. |
| Browserbase, Inc | EU, US | [Opt-in] Cloud browser infrastructure that enables Drata's AI agents to perform browser-based tasks on behalf of the Customer. |
| Census | US | Reverse ETL tool to sync data from data warehouses to various business applications |
| Chameleon | US | In-product digital adoption, user engagement micro surveys, and product awareness and onboarding activities |
| Cloudflare | US | Content distribution, security (WAF, etc), abuse prevention, and DNS services for web traffic |
| Courier | US | Notification infrastructure enabling the sending of multi-channel messages to users (opt-in) |
| Datadog | US | Cloud monitoring and observability services |
| dbt Labs | US | Platform for data transformation, modeling, and analytics within the data warehouse |
| Fivetran | US | ETL solution to synchronize data from Drata's business information systems to Drata's data warehouse |
| Google Cloud | US | Cloud service provider that stores, transmits, and processes all customer data; cloud-based email |
| Intercom | US | Customer messaging platform for customer support, engagement, and communication |
| Jam.dev | US | [Opt-in] Capture relevant UI and report feedback and issues for troubleshooting and resolution |
| Knock | US | [Opt-in] Notification infrastructure for sending multi-channel messages to users |
| LaunchDarkly | US | Feature flagging and experimentation platform |
| Leen | US | [Opt-in] Processes, stores, and transmits data synced from customer security SaaS integrations |
| Liveblocks | US | [Opt-in] Real-time collaboration capability (multi-user editing, commenting, presence indicators, notifications) |
| Matia | US | Unified DataOps platform used for data management and reverse ETL |
| Merge | US | Unified API to integrate and sync data across HR, finance, and productivity platforms |
| Obvious | US | Bulk import of data from CSV or Excel into Drata and SafeBase platforms |
| Okta | US | Identity and access management services (Auth0) to authenticate users and manage secure access |
| Omni | US | Reporting and analytics views, dashboards, custom reporting, and anonymized industry benchmarking |
| OpenAI | US | Language processing services for AI-powered responses and security questionnaire answering in AIQA |
| Postmark | US | Transactional email delivery services |
| Productboard | US | Product management platform for collecting feedback, product ideas, voting, and roadmap viewing |
| Reducto | US | Process user-uploaded documents and return structured outputs to support AI features such as automation and document parsing |
| Retool | US | Platform used to build internal tools that interact with our databases and APIs |
| Salesforce | US | Customer support and case management services (Salesforce Service Cloud) |
| Sigma Computing | US | Business intelligence and data analysis platform |
| Snowflake | US | Centralized data warehousing solution to store, manage, and analyze large datasets |
| StackOne | US | Unified API for integrating and syncing data across customer SaaS systems for user access reviews and security training tracking |
| Stripe | — | Payment processing services |
| SurveySparrow | US | Survey platform used to collect and manage customer feedback, particularly NPS surveys |
| Svix | US | Webhook infrastructure used to send event notifications to external services |
| Totango | US | Customer success management and analytics solutions |
| tray.ai | US | Workflow automation services to integrate and automate data flows between the platform and customer's instance of HubSpot (opt-in) |
| Turbopuffer | US, EU, AU | Vector search and storage infrastructure for semantic and full-text search across AI-enabled features (opt-in) |
| Twilio | US | Customer data platform (CDP) for collection, cleansing, and routing of customer data for analytics and product usage |
| Typeform | US, DE | Online form and survey platform for vendor risk management security questionnaires and employee security training responses |
| Vellum | US | Platform for development and management of LLM applications; used for automating and summarizing security questionnaires, SOC 2 reports, and other AI capabilities |
| Vigo Engineering Inc. dba Prequel | US | Facilitates Data Warehouse Sync between Drata and SafeBase databases and customer databases |
| Wiz | US | Data Security Posture Management: monitoring and assessing data security posture, vulnerabilities, misconfigurations, and compliance risks |
| WorkOS | US | Facilitates Single Sign-On (SSO) for customers' users |
| Zapier | US | Workflow automation services; used by SafeBase customer support to receive notifications |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
No data processing agreement read yet.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Does Drata have a SOC 2 report?
Drata says a SOC 2 Type 2 report is available on request. We read this on 2026-11-09.
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Drata ISO 27001 certified?
Drata states ISO/IEC 27001 certification (2022 edition, as Drata names it), and says the certificate or audit report is available on request. We read this on 2026-11-09.
On the same list Drata also names ISO/IEC 27017 and ISO/IEC 27018. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | — | trust.drata.com | 2026-11-09 |
| GDPR | Claimed | — | trust.drata.com | 2026-11-09 |
| HIPAA | Available on request | — | trust.drata.com | 2026-11-09 |
| ISO/IEC 27001:2022 · ISO27001 | Available on request | — | trust.drata.com | 2026-11-09 |
| ISO/IEC 27017:2015 · ISO27017 | Available on request | — | trust.drata.com | 2026-11-09 |
| ISO/IEC 27018:2025 · ISO27018 | Available on request | — | trust.drata.com | 2026-11-09 |
| ISO/IEC 42001:2023 · ISO42001 | Available on request | — | trust.drata.com | 2026-11-09 |
| SOC 2 Type 2 · SOC2T2 | Available on request | — | trust.drata.com | 2026-11-09 |
| SOC 3 · SOC3 | Available on request | — | trust.drata.com | 2026-11-09 |
| VPAT | Claimed | — | trust.drata.com | 2026-11-09 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| FedRAMP Marketplace (US) | Drata Trust Management Platform · Drata | FedRAMP Authorized | 20x Low | — | 2026-11-09 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Drata; Drata Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Drata; Drata Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Drata; Drata Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Drata; Drata Inc.
- FedRAMP Marketplace (US): checked 2026-11-09, 1 entry under Drata; Drata Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Drata; Drata Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2034-02-28; read 2026-11-09)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-11-09 |
| dpa | Gated | partial | 200 | 2026-11-09 |
| subprocessors | Public | full | 200 | 2026-11-09 |
History
Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.