Menu
Drata
Drata is a compliance automation and trust-management platform for SOC 2 and multi-framework programs. It collects evidence and monitors controls across cloud, identity, endpoint, and ticketing systems, with risk, audit, and third-party assessment workflows.
Best for: Growth-stage SaaS teams on mainstream stacks that expect to add frameworks over timeWatch for: Renewal-price growth is a recurring complaint, and native SCIM provisioning is not publicly documented Read our Drata review →
AI and MCP
MCP server: Official. Access: Read, write and delete. Checked 12 Oct 2026.
What does Drata do?
Drata was founded in 2020. Drata is led by Adam Markowitz. Drata says it serves 8,500+ global customers.
What does the Drata device agent check?
On macOS, Windows, supported Linux LTS distributions, the documented checks include disk encryption, screen lock, antivirus, password manager, automatic updates. Support varies by operating system.
Security configuration status, installed application and browser-extension lists used to identify antivirus and password managers, operating system, and device serial number. Drata says the read-only agent does not modify files or folders.
Read the vendor's device documentation · checked 2026-09-29
Evidence collection
Available · Automated tests run across connected systems and map to in-scope controls.
Auditor workspace
Available · Audit Portal exposes assigned clients and audits, request lists, audit resources, and downloadable evidence packages.
Scope and limits
Audit Portal exposes assigned clients and audits, request lists, audit resources, and downloadable evidence packages. The customer sets the framework, period, and auditor assignment; the exact view and actions depend on audit configuration and the New or Classic Experience.
Trust center
Available · Current Compliance Foundation names Trust Center Standard.
Scope and limits
Current Compliance Foundation names Trust Center Standard. Separate Assurance packages publish their own portal, domain and access scope; do not infer every Assurance entitlement in the Compliance package.
Security questionnaires
Available · Current Compliance Foundation names AI Questionnaire Assistance Standard.
Scope and limits
Current Compliance Foundation names AI Questionnaire Assistance Standard. Assurance packages publish questionnaire allowances and add-ons separately; do not transfer those limits to a different package without confirmation.
Enterprise administration
Partial · SSO, RBAC, Enterprise-Grade Workspaces, and SCIM-fed group-to-role synchronization are documented.
Scope and limits
SSO, RBAC, Enterprise-Grade Workspaces, and SCIM-fed group-to-role synchronization are documented. The current public evidence still does not establish full SCIM account create/deactivate lifecycle behavior, so the enterprise-admin roll-up remains partial.
Continuous control testing
Available · Drata's marketing materials use the term continuous; its Help Center documents daily control tests at 19:00 PST, with manual re-runs available at any time.
Multi-framework support
Partial · Drata documents that multiple controls can map to a single framework requirement across its 30+ pre-built frameworks, which means shared, cross-mapped controls rather than confirmed fully independent native control sets per framework.
Funding history
Drata has raised roughly $328M total across four rounds. The most recent confirmed equity round is a $200M Series C co-led by ICONIQ Growth and GGV Capital, announced December 7, 2022, valuing the company at $2B. A later Forge secondary figure of $455M is not treated as a confirmed primary funding total. Separately, Drata acquired SafeBase in a ~$250M deal announced February 11, 2025 (TechCrunch; Drata). The acquisition is M&A, not additional venture capital.
How much does Drata cost?
Drata's direct plans require quotes; a separate channel lists scoped prices. Vendr reports contracts of $9,415 to $68,250 a year. Your price depends on plan scope, headcount, services, and contract term. Read the Drata pricing guide.
Price source: view reported prices · checked 2026-09-30
Reported Drata contracts against similar platforms
- Drata$9,415–$68,250 · median $25,000
- Hyperproof$22,215–$70,000 · median $41,400
- Vanta$7,500–$57,207 · median $20,000
- Secureframe$7,733–$32,575 · median $20,000
Published prices (17)
| Listed item | Price | Scope |
|---|---|---|
| AWS Marketplace Foundation Package | $15,000 / 12-month contract | Drata-sold AWS Marketplace package for companies with 1 to 50 FTE, sold as a single 12-month dimension. The listing does not itemize frameworks or modules. Its name and 50-FTE cap match the Foundation plan on drata.com/plans, which includes one pre-mapped framework (SOC 2, ISO 27001, Cyber Essentials, HIPAA, or GDPR); the listing itself does not confirm that mapping. · Source |
| AWS Marketplace Platform Fee | $25,000 / 12-month contract | Drata Security & Compliance Automation Platform (D) seller-listed SaaS base, capacity for an organization of up to 100 FTE; frameworks are separate dimensions. · Source |
| AWS Marketplace SOC 2 Framework | $7,500 / 12-month contract | SOC 2 2017 control set; separate from the base platform fee. · Source |
| AWS Marketplace ISO 27001 Framework | $7,500 / 12-month contract | ISO 27001 v2022 control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace HIPAA Framework | $7,500 / 12-month contract | HIPAA control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace GDPR Framework | $7,500 / 12-month contract | GDPR control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace PCI DSS Framework | $7,500 / 12-month contract | PCI DSS control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace CCPA Framework | $7,500 / 12-month contract | CCPA control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace CMMC Framework | $7,500 / 12-month contract | CMMC control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace Microsoft SSPA Framework | $7,500 / 12-month contract | Microsoft SSPA control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace NIST CSF Framework | $7,500 / 12-month contract | NIST CSF control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace NIST SP 800-53 Framework | $7,500 / 12-month contract | NIST SP 800-53 control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace ISO 27701 Framework | $7,500 / 12-month contract | ISO 27701 control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace FFIEC Framework | $7,500 / 12-month contract | FFIEC control set; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace DORA Framework | $7,500 / 12-month contract | DORA framework dimension; separate from the base platform fee and from every other framework dimension. · Source |
| AWS Marketplace Trust Center Module | $25,000 / 12-month contract | Trust Center module on the Platform (D) listing; separate from the base platform fee. · Source |
| AWS Marketplace Risk Management Module | $50,000 / 12-month contract | Risk Management module on the Platform (D) listing; separate from the base platform fee. · Source |
Drata publishes Foundation, Advanced, and Enterprise packaging without direct plan prices. It sells through two separately scoped AWS Marketplace listings, both on 12-month contracts that auto-renew and are non-cancellable and non-refundable: a Foundation Package for companies with 1 to 50 FTE at $15,000, and a Platform (D) listing that prices platform capacity for 100 FTE at $25,000 and charges each of 13 frameworks (SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, CCPA, CMMC, Microsoft SSPA, NIST CSF, NIST SP 800-53, ISO 27701, FFIEC and DORA) as its own $7,500 dimension. Trust Center ($25,000) and Risk Management ($50,000) modules are further separate lines. The Platform listing names no capacity above 100 FTE. Neither listing is a quote for a direct Foundation, Advanced, or Enterprise contract, and private offers may differ. Plan source
Ask for the first-year total, renewal cap, implementation charge, required add-ons, and separate audit fee in writing.
How does Drata compare with Sprinto, Secureframe, Vanta?
| Attribute | DrataThis profile | Comp AI | Iru | Sprinto | Secureframe | Vanta |
|---|---|---|---|---|---|---|
| Best for | Growth-stage SaaS teams on mainstream stacks that expect to add frameworks over time | Engineering-led teams that value inspectable code or the option to self-host | Teams seeking SOC 2 automation and device management in one platform | Early- to growth-stage SaaS teams seeking guided first-audit preparation | Teams that want expert guidance on named Fundamentals, Complete, or Defense packages | Cloud-native SaaS teams on mainstream stacks that value a broad integration catalog |
| Observed price | $9,415–$68,250 / year | Not published | Up to $15,000 / year for Compliance Automation | Not published | $7,733–$32,575 / year | $7,500–$57,207 / year |
| G2 rating | 4.7/5 (1,397 reviews) | 4.7/5 (73 reviews) | 4.7/5 (853 reviews) | 4.7/5 (1,685 reviews) | 4.7/5 (826 reviews) | 4.6/5 (2,728 reviews) |
| Integrations | 300+ published | 590+ published | Not published | 300+ published | 300+ published | 400+ published |
| Frameworks | 10 listed | 11 listed | 11 listed | 8 listed | 8 listed | 8 listed |
| Onboarding | guided | guided | guided | bundled expert | guided | guided |
| Auditors here | 45 | 4 | Not published | 39 | 12 | 36 |
| Trust center | Listed | Listed | Listed | Listed | Listed | Listed |
Will Drata connect to your stack?
Drata reports 300+ integrations. Check the exact fields, tests, permissions, and plan coverage for each tool you need.
Check 13 named tools
| Tool | Coverage | Scope |
|---|---|---|
| AWS | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| Microsoft Azure | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| Okta | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| Google Workspace | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| GitHub | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| GitLab | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| Jira | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| Linear | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| BambooHR | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| Cloudflare | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| 1Password | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| JumpCloud | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
| ServiceNow | Listed integration | Drata documents a direct connection and data sync for this tool; supported fields, tests and plan availability vary. Source |
Which frameworks does Drata support?
- SOC 2Verified
- ISO 27001Drata says
- ISO 42001Drata says
- HIPAADrata says
- PCI DSSDrata says
- GDPRDrata says
- CMMCDrata says
- NIS2Drata says
- DORADrata says
- NYDFS Part 500Drata says
Some frameworks use mapped controls rather than native workflows. Confirm the tests and evidence required for each program.
Who does what in a SOC 2 with Drata?
Drata
Organizes the listed control, evidence, and audit workflows.
Your team
Owns policies, control decisions, exceptions, and approval of shared evidence.
The CPA firm
Sets audit scope, tests controls independently, and issues the SOC 2 report.
Drata is not a CPA firm and does not issue the SOC 2 report itself. It automates evidence collection and continuous control monitoring and gives auditors a scoped Audit Portal view plus its own Audit Alliance directory of partner CPA firms; an independent, AICPA-accredited CPA firm performs the examination and signs the report.
Which auditors work with Drata?
45 licensed audit firms in our directory list Drata experience. Listing experience is not an endorsement.
| Firm | Licence | Peer review |
|---|---|---|
| A-LIGN | Licensed CPA | Pass |
| Schellman | Licensed CPA | Pass |
| Sensiba LLP | Licensed CPA | Pass |
Questions to ask in a Drata demo
- Which parts of enterprise administration require another tool or service?
- Can you demonstrate SCIM provisioning in the product?
- Which parts of native multi-framework support require another tool or service?
- Which plan includes SCIM, and is it a paid add-on?
- What is the first-year total, including onboarding, add-ons, and the audit fee?
- What renewal increase and minimum contract term should we put in writing?
- Is the SOC 2 audit contracted with a separate CPA firm, and what does that firm charge?
Drata FAQ
Where is Drata based?
Drata is headquartered in San Francisco, California, United States.
Who runs Drata?
Adam Markowitz is the CEO of Drata.
Who founded Drata?
Adam Markowitz and Daniel Marshilian and Troy Markowitz founded Drata in 2020.
Does Drata include the SOC 2 audit?
Drata is not a CPA firm and does not issue the SOC 2 report itself. It automates evidence collection and continuous control monitoring and gives auditors a scoped Audit Portal view plus its own Audit Alliance directory of partner CPA firms; an independent, AICPA-accredited CPA firm performs the examination and signs the report. A licensed CPA firm issues the SOC 2 report.
Is Drata itself SOC 2 compliant?
Supporting a buyer's SOC 2 program does not establish that Drata holds a current SOC 2 report. Ask for the vendor's current report during security review.
What does the Drata device agent check?
The vendor documents checks for disk encryption, screen lock, antivirus, password manager, automatic updates. Supported checks vary by operating system; read its device documentation before installation.
Companies that announced SOC 2 work with Drata
These companies described earlier work with the platform. Ask which workflows and terms apply to your project.
NobleAI
NobleAI said it implemented its compliance program through Drata.
- Company / product context
- AI tools for energy, chemistry, and manufacturing
- Report system / scope
- Exact report system not stated
- Role
- Compliance software used during the audit · Drata
- Report type
- SOC 2 Type 2
- Report period
- Not stated in announcement
The release discusses the NobleAI platform without defining the system examined.
Company announcement · Published Jun 18, 2026 · Checked Sep 26, 2026 · Suggest a factual correction
RentSpree
RentSpree said it used Drata during its SOC 2 work.
- Company / product context
- Rental applications, screening, and leasing software
- Report system / scope
- Exact report system not stated
- Role
- Compliance software used during the audit · Drata
- Report type
- SOC 2 Type 2
- Report period
- Not stated in announcement
The announcement describes RentSpree rental management software without defining the system examined.
Company announcement · Published Jan 9, 2024 · Checked Sep 26, 2026 · Suggest a factual correction
These are historical company statements, not a current client or subscriber list, an endorsement, or a review of the underlying SOC 2 reports.
Similar platforms
Also listed as alternatives on G2: Vanta, Sprinto, Scrut Automation, Secureframe, Scytale, Thoropass, Hyperproof, Optro. Observed 2026-09-24; the source controls its own ordering.
Drata on SOC2Auditors
More guides and comparisons (5)
Sources 49 records · last read 2026-10-20
These links show what we checked and when.
| Establishes | Source | Retrieved |
|---|---|---|
| The February 3, 2026 guide documents an audit-evidence ZIP, control-to-requirement CSV, audit metadata, and searchable HTML manifest. It does not establish complete historical coverage, cancellation access, or universal plan inclusion. | Drata Help Center Vendor docs | 2026-10-02 |
| Company story identifies the 2020 launch, Adam Markowitz as CEO, and three co-founders. | Drata Vendor docs | 2026-09-29 |
| February 2026 announcement identifies San Francisco as company headquarters. | Drata Press | 2026-09-29 |
| December 2022 announcement confirms the $200M Series C and co-leads. | Drata Press | 2026-09-29 |
| Current Foundation, Advanced, and Enterprise plan names and selected inclusion gates; Agentic TPRM Assessment is an Enterprise add-on; no public dollar amount is shown for any plan. | Drata Vendor docs | 2026-09-10 |
| Compliance Automation Foundation includes custom controls, Compliance as Code and Open API Access; Advanced adds custom connections and tests. Separate Assurance Foundation lists clickwrap NDA and automated access approvals, while Assurance Advanced adds configurable access expiration and Docusign/Ironclad NDA integration. Matching edition names do not establish shared entitlements; no direct plan dollar prices are published. | Drata Vendor docs | 2026-10-02 |
| SCIM-fed IdP groups can automatically add or revoke mapped Drata roles; manually assigned roles remain independent. Workspace-specific role behavior is documented, while full account lifecycle provisioning remains unestablished by this guide. | Drata Vendor docs | 2026-09-30 |
| 4.7/5 rating across 1,393 reviews on the public G2 product listing. | G2 Review platform | 2026-09-11 |
| The Drata Security & Compliance Automation Platform 12-month catalog lists one dimension: a Foundation Package for companies with 1 to 50 FTE at $15,000. It does not itemize frameworks or modules, excludes the independent CPA examination, and does not price a buyer-specific private offer. | AWS Marketplace, sold by Drata Marketplace | 2026-10-20 |
| The Drata Security & Compliance Automation Platform (D) 12-month catalog lists a $25,000 platform fee sized for 100 FTE, a separate $7,500 dimension for each of 13 frameworks including SOC 2, and Trust Center ($25,000) and Risk Management ($50,000) modules. The $32,500 platform-plus-SOC 2 subtotal excludes other frameworks, modules, private-offer changes, and the independent CPA examination; it is not a direct Foundation, Advanced, or Enterprise price. | AWS Marketplace, sold by Drata Marketplace | 2026-10-20 |
| Observed customer contract data: low $9,494, high $67,350, median $25,000/year across 233 purchases. | Vendr Third-party estimate | 2026-09-10 |
| Current integration count stated as 300+. | Drata Vendor docs | 2026-09-30 |
| 30+ pre-built compliance frameworks. | Drata Vendor docs | 2026-07-24 |
| Drata's April 1, 2025 ISO/IEC 42001 framework overview describes automated workflows, risk tracking, continuous monitoring, policies, and evidence. | Drata Vendor docs | 2026-08-12 |
| $200M Series C co-led by ICONIQ Growth and GGV Capital, December 2022, $2B valuation. | TechCrunch Press | 2026-07-24 |
| Total funding raised of approximately $328M. | PitchBook Third-party estimate | 2026-07-24 |
| Corroborates $328M total across 4 rounds, last round Series C, November 2022. | Tracxn Third-party estimate | 2026-07-24 |
| Drata acquired SafeBase (trust-center product), announced February 11, 2025. | Drata Vendor docs | 2026-07-24 |
| Notes complex setup and renewal price increases as common criticisms in its comparison of the two platforms. | Orbiq Editorial | 2026-07-24 |
| Vanta's own comparison claims Drata runs tests daily versus Vanta's hourly cadence (vendor-authored, a competitor's claim, not independently verified against Drata's own documentation). | Vanta Vendor docs | 2026-07-24 |
| Customer-questionnaire response workflow and usage evidence; product claims are not independent performance tests. | Drata Vendor docs | 2026-08-30 |
| Scoped onboarding recheck: welcome documentation describes self-serve training, technical support via in-app chat and Compliance Advisors. The prior passage about some customers receiving implementation management is no longer present. No dedicated implementation-management entitlement is established by this page. | Drata Help Center Vendor docs | 2026-09-10 |
| Vendor-claimed HIPAA workflow: Security Rule checklist, Audit Hub setup, and an invitation workflow for the chosen auditor. | Drata Vendor docs | 2026-08-31 |
| The customer creates an audit, selects its framework and period, and assigns auditors. Audit Portal provides request lists, audit resources and evidence packages, with access depending on configuration and the New or Classic Experience. Use for CPA/evidence handoff, not as evidence of auditor independence or outcome. | Drata Vendor docs | 2026-09-30 |
| Access Review data refreshes nightly, only one review period can be active, and the review shows access as of the day it is performed rather than a snapshot of the selected period. User Access Review is an add-on for Foundation and Advanced, included with Enterprise. | Drata Help Center Vendor docs | 2026-09-25 |
| Foundation includes one pre-mapped framework from a stated set that includes HIPAA; the page also describes Audit Hub as centralizing communication and documentation with an auditor. No dollar amount appears on the page. | Drata Vendor docs | 2026-08-31 |
| Not established. Drata's BAA article explains customers' obligations; it does not establish Drata's own PHI permission or customer BAA route. | SOC2Auditors.org Editorial | 2026-08-31 |
| Drata acquired SafeBase for $250 million, reported February 12, 2025 following Drata’s February 11 announcement. SafeBase continues as a standalone product while its trust-center capabilities come onto Drata’s platform. This is acquisition consideration, not additional primary venture capital. | TechCrunch Press | 2026-09-08 |
| Current public integration directory names available connectors and their workflow categories. | Drata Vendor docs | 2026-09-24 |
| Current setup guide names supported identity, cloud, source-control, and ticketing connections. | Drata Vendor docs | 2026-09-24 |
| Current homepage states that Drata serves more than 8,500 customers globally. | Drata Vendor docs | 2026-09-24 |
| Current Drata alternatives page names Vanta, Sprinto, Scrut Automation, Secureframe, Scytale, Thoropass, Hyperproof and Optro. | G2 Review platform | 2026-09-24 |
| Current AWS guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current Microsoft Azure guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current GitHub guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current GitLab guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current Jira guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current Linear guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current BambooHR guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current Cloudflare guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current 1Password guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current ServiceNow guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current Okta guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current Google Workspace guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Current JumpCloud guide documents a direct Drata connection and its compliance data or workflow scope. | Drata Help Center Vendor docs | 2026-09-24 |
| Drata documents the read-only agent, its device checks, collected app and extension lists, and supported operating systems. | Drata Vendor docs | 2026-09-29 |
| Supported operating systems and monitoring setup for the employee device agent. | Drata Vendor docs | 2026-09-29 |
| Observed annual Drata contracts span $9,415-$68,250, with a $25,000 median across 235 purchases. These are unmatched procurement observations, not a public rate card or a same-scope comparison. | Vendr Third-party estimate | 2026-09-30 |
| G2's seller page lists one Drata product profile, rated 4.7/5 across 1,397 reviews. The sample is not a controlled comparison with another platform. | G2 Review platform | 2026-09-30 |