Snapshot 244028
Normalized text
Scripts and page chrome removed; this is what change detection compares.
[PRODUCTS] Agentic Trust Management PlatformBuild and prove trust with an integrated platform built on AI. Enterprise GRCCentralize governance, controls, risk, and compliance. Compliance AutomationGet compliant quickly and easily across frameworks. Trust CenterShare your security posture faster with an always-on trust portal. AI Questionnaire AssistanceSave time answering security questionnaires. Third-Party Risk ManagementContinuously assess vendors to reduce third-party exposure. AI GovernanceDiscover, monitor, and govern all your AI agents. [CATEGORIES] Automated GovernanceStreamline security tasks to unify governance across teams. Integrated Risk ManagementManage internal and third-party risk in a singular platform. Continuous ComplianceAutomate evidence collection and monitor controls for audit readiness. Security AssuranceProve trust faster and in real time to shorten review cycles. Drata AITransform GRC from a defensive necessity into a business driver. [CAPABILITIES] AI Governance Controls and Evidence Monitoring and Tests Multi-Framework Support Audit Hub Internal Risk Management Agentic TPRM Assessment User Access Reviews Enterprise Workspaces Customer Trust Portal Trust Measurement [GO BEYOND] The Drata Difference Integrations Open API Drata MCP What’s New [BY SIZE] StartupLaunch trust fast and prove security early. GrowthAccelerate trust smoothly and scale as you grow. EnterpriseCommand trust at scale with unified governance, risk, compliance, and assurance. [BY FRAMEWORK] SOC 2 ISO 27001 HIPAA GDPR FedRAMP CMMC ISO 42001 PCI DSS HITRUST NIST AI RMF DORA Custom Frameworks [BY INDUSTRY] Financial Services Healthcare Insurance SaaS [CUSTOMER LOVE] Customer Stories Wall of Love Advocacy Program Example Trust Centers Customer Wins [SUPPORT] Customer Success Drata Academy Drata Help Center SafeBase Help Center [FEATURED CUSTOMERS STORIES] Brex Modernizes GRC and Assurance with Drata UiPath Scales Third-Party Risk Management with Drata Okta Transforms Security Assurance with Drata [CHANNEL PARTNERS] Overview Find a Channel Partner Become a Channel Partner [VC & PE Partners] Overview Join Our Investor Partner Program [TECH PARTNERS] Overview Find a Tech Partner Become a Tech Partner [AUDIT ALLIANCE] Overview Find an Auditor Join the Audit Alliance Auditor Code of Ethics [QUICK LINKS] The Trusted Blog When Trust Meets AI Podcast Women in Trust [RESOURCE CENTER] Reports Guides Webinars Data Sheets [LEARN] SOC 2 Collection ISO 27001 Collection HIPAA Collection Compliance Collection [FEATURED RESOURCES] The CISO Guide to Continuous Compliance Demo Days: See Drata in Action with Live Q&A [COMPANY] About Drata News & Press Security & Compliance Contact Us Events [CAREERS] Open Roles Life at Drata [FEATURED RESOURCES] Best Practices for Implementing Agentic AI in GRC Workflows Leveraging AI to Optimize GRC: From Reactive to Proactive Get Started Sign InContact Sales Security at Drata Trust is everything to us, but you can’t have trust without security. That’s why we use independent experts to verify our security, privacy, and compliance controls. No company is impenetrable, and we're always aiming to be better. If you find any security issues with Drata, please report them through our Vulnerability Disclosure Program. Report a Security Issue See Our Security Posture Drata was founded to help build trust across the internet by enabling companies to publish and share their security posture—and that includes us too. We’ve achieved certification and attestations against stringent standards. And you’re welcome to take a look under the hood. Explore Our Trust Center WHAT WE DO Security as a Core Value At Drata, we’re here to help companies earn and keep the trust of their users, customers, partners, and prospects. We believe the best way to earn trust is by first proving that you deserve it. Here’s how we walk the walk when it comes to our own security program: Application and Code Identifies and prevents security flaws during CI/CD with code security scanning tools. Prevents any chance of an accidental code merge with Credential Checking. Trains on secure code development (OWASP Top 10 Secure Coding Practices, etc.). Block the latest threats with our Web Application Firewall (WAF). Mitigate attacks with robust Content Security Policy headers. Peer review code changes before being merged to a protected main. Run-time monitoring and detection for application exploits. Infrastructure and Data DDoS mitigation at both the application layer (CDN provider) and the network layer (cloud service provider). Data is encrypted at rest and in transit using known strong protocols and ciphers. Access to data is reviewed and authorized. Authentication uses 2FA with phishing-resistant hardware. Hosted on reputable cloud services providers, Amazon Web Services (AWS) and Google Cloud Platform (GCP). Peer reviews of infrastructure changes, Infrastructure as Code vulnerability security scans, Compliance as Code compliance scans, and quick recovery for failover with Infrastructure as Code. Anomaly detection supported by GuardDuty, Google Security Center, as well as third-party security services from trusted vendors. Cloud Security Posture Management deployed and informs on vulnerabilities and misconfigurations. Vulnerability management process to mitigate vulnerabilities in a timely manner. DNSSEC to help prevent domain spoofing. Deployed security tooling to detect and protect. Endpoint Devices centrally managed with MDM with known hardened security configurations, such as firewalls, patching, and encryption. Endpoints protected with endpoint detection and response capabilities to monitor for malicious activity and associated chain of events. Filter malicious requests that could harm employees (or our company) with Advanced DNS Filtering on endpoints and endpoint network protections. HOW WE WORK Win with Trust We understand how important trust is to earning and keeping customers. That’s why we are committed to complying with the highest standards. Continuous Compliance We monitor 100+ security controls and work with auditors and security experts to ensure automated tests are accurate. Detection & Response We use best-in-class services and tools to provide 24/7 automated detection and response capabilities. DevSecOps Forward Security checks are baked into our software development lifecycle and secure baselines are automatically enforced. Zero Trust We've designed our networks and access controls with Zero Trust principles. Phishing Resistance MFA We use the Web Authentication API (WebAuthn) multi-factor standard to protect sensitive systems. Red Team Testing We conduct red team testing both internally and with third parties to best identify security gaps. Trusted Sub-Processors We’re only as strong as our weakest link. See which authorized third-party vendors Drata partners with, and view their security posture in the Sub-Processors page of our Trust Center. Learn More