Snapshot 217656
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Overview Drata's platform helps companies build and maintain the trust of their users, customers, partners, and prospects. We believe the best way to earn trust is by being transparent and proving that we are doing what we're saying we're doing. That’s why we take a security-first approach to everything we do. From building our infrastructure as code to monitoring our environment with anomaly detection and automated remediation, security is a core value that drives our business forward. This Trust Center provides you with artifacts to help show how we walk-the-walk when it comes to our own security, compliance, and privacy programs. Please reach out to our compliance team with any questions not answered here. Compliance SOC 2 Type 2 ISO/IEC 27018:2025 SOC 3 ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 42001:2023 HIPAA CCPA GDPR CISA: Secure-by-Design Pledge VPAT AWS Qualified Software AWS Security Software Competency Partner Drata is reviewed and trusted by Capital One Vercel Tenable Okta Zscaler LinkedIn T-Mobile OpenAI Brex Xerox Wiz Documents Featured Documents REPORTSExternal Penetration Test Report COMPLIANCEISO/IEC 27001:2022 COMPLIANCESOC 2 Type 2 Risk Profile Data Access LevelRestricted Impact LevelModerate HostingMajor Cloud Provider View more Product Security Audit Logging Data Security Integrations View more Reports CAIQ Data Flow Diagram (DFD) External Penetration Test Report View more App Security Vulnerability Disclosure Application Penetration Testing Bot Mitigation View more AI AI Policy AI Data Management AI Resource Management Policy View more Legal Subprocessors Evidence of Insurance Data Processing Addendum View more Data Privacy Cookies Data Breach Notifications Data Privacy Officer View more Infrastructure Status Monitoring Amazon Web Services Anti-DDoS View more Policies Access Control Policy Asset Management Policy Change Management Policy View more Security Grades Qualys SSL Labs app.drata.com A+ Security Headers app.drata.com A Business Continuity / Disaster Recovery Disaster Recovery Test Business Continuity Plan (BCP) FedRAMP Certified - Class B What is FedRAMP 20x? Description of Services Offered Phase One Pilot Initial Submission View more Trust Center Updates Drata Response to the eMudhra certificate authority compromise Vulnerabilities On October 20, 2026, the private keys for eight intermediate certificate authorities (CAs) operated by eMudhra were weak enough to be recovered from their public certificates. Anyone with access to these keys could potentially issue fraudulent certificates for websites to potentially intercept or alter encrypted traffic from systems that still trust the affected CAs. eMudhra has since revoked these certificates, major browser and operating system vendors have blocked the use of these certificates, and related fixes to affected software are tracked as CVE-2026-111943. Drata does not use any eMudhra-issued certificates. To confirm any exposure, Drata’s Security and Engineering teams reviewed certificate trust across our environment and have removed any affected CAs from the trusted certificate bundles used by Drata. We have not identified evidence of exploitation affecting Drata or our customers. We are updating remaining lower-risk internal components as part of our standard vulnerability management process and continue to monitor our environment. Drata Response to Node.js vulnerabilities Vulnerabilities On October 21, 2026, details of several high-severity vulnerabilities in the Node.js runtime, including CVE-2026-111497 (known as “Node2Shell”), were made public. Drata’s Security team has assessed the impact of these vulnerabilities on Drata and, as of October 23, 2026, we have patched any impacted production services. We have not identified any evidence of exploitation affecting Drata or our customers. We are updating a few remaining components with lower-severity impacts (in accordance with our standard vulnerability management process) and will continue to monitor our environment. Drata Not Impacted by PHP2Shell Vulnerabilities Vulnerabilities On October 21, 2026, Drata became aware of the PHP2Shell security vulnerabilities. Reputable threat intelligence sources have reported that these vulnerabilities affect the core PHP language runtime and could allow unauthenticated remote code execution on web servers running vulnerable PHP versions (CVE-2026-109618, CVE-2026-109619). Recommended reading: PHP Security Advisory, The PHP Group We want our customers to know that Drata is not impacted by this vulnerability. Our investigation supports this assessment: PHP is not part of the Drata or SafeBase platforms. Our products are built mainly on TypeScript, Python and Go. No production service or customer-facing system runs PHP, and no subprocessors have disclosed being impacted at the time of this update. No internet-exposed vulnerable assets. Our cloud security platform found no vulnerable PHP on any internet-facing or production workload. Limited, non-exploitable presence in build tooling. PHP was present only as a preinstalled package on 1 internal ephemeral service. There it does not serve web requests and accepts no inbound network traffic. Even so, we have applied the patched packages. The confidentiality, integrity and availability of the Drata product and customer data remain unharmed. We will continue to monitor the situation and will update this post if additional information materially changes this assessment. If you have questions, please contact security@drata.com. May 2026 TanStack Mini Shai-Hulud Supply Chain Attack Assessment Incidents On May 11, 2026, Drata became aware of the TanStack Mini Shai-Hulud supply chain attack security incident. Reputable threat intelligence sources have reported that this incident compromised 84 packages in the @tanstack/* npm namespace, modifying affected versions to steal CI/CD credentials and exfiltrate data to attacker-controlled infrastructure. Recommended reading: TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack, Socket Research Team Recommended reading: TanStack npm Supply Chain Compromise Postmortem, TanStack We leverage TanStack packages within our product, but our pinned versions predate the affected range. We conducted a thorough investigation including cross-referencing our dependencies against the confirmed compromised package list, scanning our codebases and developer endpoint environments for malicious files associated with this campaign, and searching our endpoint and network telemetry for known attacker infrastructure. At this time, based on our analysis and investigation, we have not found indications of compromise. Drata Not Impacted by the May 2026 Braintrust Security Incident Incidents On May 6, 2026, Drata became aware of the Braintrust security incident, in which attackers obtained unauthorized access to one of Braintrust's AWS accounts on May 4, 2026. The affected environment stored organization-level AI provider API keys that customers had configured within the Braintrust platform. Reputable threat intelligence sources have reported that Braintrust identified at least one impacted customer but had not found evidence of broader exposure at the time of disclosure. Drata is not impacted by this incident based on the information currently available. Our investigation, conducted the same day the incident became public, supports this assessment: Drata currently uses Braintrust exclusively for internal, offline evaluation workflows. No customer data is processed on or streamed to Braintrust — it is not part of any customer-facing product workflow. Our code review confirmed the Braintrust SDK is scoped to an optional evaluation dependency group only and is not active in core production services. No indicators of compromise were observed in our environment. Precautionary steps we took, even though we had no evidence of customer data impact: Revoked and rotated all AI provider API keys stored within the Braintrust platform, as recommended by Braintrust. Rotated the Braintrust API key across all environments. Reviewed the scope of our Braintrust integration and confirmed it is limited to internal eval tooling with no connection to customer data. The confidentiality, integrity, and availability of the Drata product and customer data remain unharmed. We will continue to monitor the situation and will update this post if additional information from Braintrust, our threat-intelligence providers, or our own ongoing investigation materially changes this assessment. If you have questions about your Drata environment in connection with this incident, please contact security@drata.com. Knowledge Base (FAQ) What is Drata's tenancy model and how is customer data segregated? Will my data be transferred or shared with any third parties? Are there any web facing application protection mechanisms? Does Drata maintain a risk management program, perform risk assessments, and track the treatment of those risks? Do all users have unique ID's for access to production systems and data? View more If you need help using this Trust Center, please contact us. Contact support If you think you may have discovered a vulnerability, please send us a note. Report issue