Drata

Security and trust center evidence

Drata’s AI-native compliance automation & agentic trust management platform powers GRC and assurance (GRC +A) for startups, mid-size

drata.com Compliance and GRCLast verified 2 Nov 2026

Request the report Are you Drata?

ISO 27001Vendor-stated

CSA STARVerified

ISO 42001Vendor-stated

SOC 3Vendor-stated

ISO 27017Vendor-stated

ISO 27018Vendor-stated

DPFVerified

CCPAVendor-stated

Drata has 3 registry-verified rows and 9 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Drata is listed in the FedRAMP registry as FedRAMP Authorized, effective 5 Dec 2025 and audited by Schellman Compliance, LLC (FedRAMP, as of 19 Sep 2026). Drata is listed in the CSA STAR registry with a Level 1 self-assessment (CAIQ) and Trusted Cloud Provider status, submitted 24 Aug 2021 (CSA STAR, as of 17 Sep 2026). Drata is listed in the Data Privacy Framework registry with active EU-US Certification, Swiss-US Certification and UK Extension Certification, issued 5 May 2022 and expiring 14 Apr 2027 (Data Privacy Framework, as of 17 Sep 2026). Drata states on its trust centre that it holds SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 42001:2023, SOC 3, ISO/IEC 27017:2015, ISO/IEC 27018:2019, GDPR and CCPA/CPRA (as of 17 Sep 2026). Drata's trust centre also displays a HIPAA badge, though the evidence does not confirm BAA availability (HIPAA, as of 17 Sep 2026).

FedRAMP Authorized, effective 5 Dec 2025, audited by Schellman Compliance, LLC (FedRAMP, as of 19 Sep 2026).
Listed in Data Privacy Framework registry, active through 14 Apr 2027 (Data Privacy Framework, as of 17 Sep 2026).
HIPAA badge displayed on trust centre - BAA availability not confirmed in evidence (HIPAA, as of 17 Sep 2026).

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.

Among compliance and grc vendors

3verified rows

Category median 1, across 179 indexed compliance and grc vendors. Drata has more verified rows than 98 percent of them.

audit managementcompliance automationgovernancesoc 2

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for PCI DSS, Cyber Essentials, ISO 27701. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

AI and data use policy

On request · Listed on the trust centre as "AI Policy" · as of 2 Nov 2026

Open

Data processing agreement

On request · Listed on the trust centre as "Data Processing Addendum" · as of 2 Nov 2026

Open

Subprocessor list

On request · Listed on the trust centre as "Subprocessors" · as of 2 Nov 2026

Open

Subprocessors

No subprocessor list captured yet.

Security profile

Pen test cadence: report available

Displayed as a security profile from public statements, not as attestations, as of 2 Nov 2026.

Change history

22 Sep 2026DPA changedThe data processing agreement URL changed.
17 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
17 Sep 2026HIPAA evidence addedA HIPAA row entered the index with state Vendor-stated.
17 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Vendor-stated.
17 Sep 2026ISO/IEC 27017 evidence addedA ISO/IEC 27017 row entered the index with state Vendor-stated.
17 Sep 2026CCPA / CPRA evidence addedA CCPA / CPRA row entered the index with state Vendor-stated.
17 Sep 2026ISO/IEC 42001 evidence addedA ISO/IEC 42001 row entered the index with state Vendor-stated.
17 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
17 Sep 2026SOC 3 evidence addedA SOC 3 row entered the index with state Vendor-stated.
17 Sep 2026ISO/IEC 27018 evidence addedA ISO/IEC 27018 row entered the index with state Vendor-stated.

Similar vendors with evidence

Related by product tags and the Compliance and GRC category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.