Snapshot 98636
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Overview SafeBase helps B2B SaaS companies close enterprise deals faster by streamlining the security assessment process. We take security seriously and have a dedicated internal security team. Our security team's controls and policies are detailed in this Trust Center. If you have any additional questions or concerns, please email us at security@drata.com. Compliance SOC 2 Type 2 CCPA CSA STAR GDPR HIPAA ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 42001:2023 SOC 3 Drata is reviewed and trusted by OpenAI LinkedIn Abnormal Security Asana Wiz Instacart ClickUp Zoom Ramp Crossbeam GitLab T-Mobile Jamf Palantir Documents REPORTSHIPAA Report REPORTSISO Statement of Applicability COMPLIANCEHIPAA COMPLIANCEISO/IEC 27001:2022 COMPLIANCEISO/IEC 27017:2015 COMPLIANCEISO/IEC 27018:2019 COMPLIANCEISO/IEC 42001:2023 COMPLIANCESOC 2 Type 2 COMPLIANCESOC 3 PRODUCT SECURITYSafeBase Technical Overview LEGALEvidence of Insurance AIAI Governance Policy Risk Profile Data Access LevelInternal Impact LevelModerate Recovery Time Objective24 hours View more Product Security Audit Logging Integrations Multi-Factor Authentication View more Reports ISO Statement of Applicability HIPAA Report Network/Data Flow Diagram View more Data Security Access Monitoring Data Backups Data Erasure View more App Security Vulnerability Disclosure Credential Management Secure Development Training View more AI Artificial Intelligence (AI) System Development and Evaluation Policy AI Governance Policy AI Training Data and Bias View more Legal Subprocessors Evidence of Insurance Data Processing Agreement View more Data Privacy Cookies Data Breach Notifications Data Into System View more Access Control Data Access Logging Password Security Infrastructure Status Monitoring DDoS Protections Business Continuity & Disaster Recovery View more Endpoint Security Disk Encryption Endpoint Detection & Response Mobile Device Management Network Security DNSSEC Firewall IDS View more Corporate Security Employee Training HR Security Incident Response View more Policies AI Governance Policy Vulnerability Management Policy System Access Control Policy (Access Control Policy) View more Knowledge Base (FAQ) What is Drata's tenancy model and how is customer data segregated? Will my data be transferred or shared with any third parties? Are there any web facing application protection mechanisms? Does Drata maintain a risk management program, perform risk assessments, and track the treatment of those risks? Do all users have unique ID's for access to production systems and data? View more Trust Center Updates May 2026 TanStack Mini Shai-Hulud Supply Chain Attack Assessment Incidents On May 11, 2026, Drata became aware of the TanStack Mini Shai-Hulud supply chain attack security incident. Reputable threat intelligence sources have reported that this incident compromised 84 packages in the @tanstack/* npm namespace, modifying affected versions to steal CI/CD credentials and exfiltrate data to attacker-controlled infrastructure. Recommended reading: TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack, Socket Research Team Recommended reading: TanStack npm Supply Chain Compromise Postmortem, TanStack We leverage TanStack packages within our product, but our pinned versions predate the affected range. We conducted a thorough investigation including cross-referencing our dependencies against the confirmed compromised package list, scanning our codebases and developer endpoint environments for malicious files associated with this campaign, and searching our endpoint and network telemetry for known attacker infrastructure. At this time, based on our analysis and investigation, we have not found indications of compromise. Drata Not Impacted by the May 2026 Braintrust Security Incident Incidents On May 6, 2026, Drata became aware of the Braintrust security incident, in which attackers obtained unauthorized access to one of Braintrust's AWS accounts on May 4, 2026. The affected environment stored organization-level AI provider API keys that customers had configured within the Braintrust platform. Reputable threat intelligence sources have reported that Braintrust identified at least one impacted customer but had not found evidence of broader exposure at the time of disclosure. Drata is not impacted by this incident based on the information currently available. Our investigation, conducted the same day the incident became public, supports this assessment: Drata currently uses Braintrust exclusively for internal, offline evaluation workflows. No customer data is processed on or streamed to Braintrust — it is not part of any customer-facing product workflow. Our code review confirmed the Braintrust SDK is scoped to an optional evaluation dependency group only and is not active in core production services. No indicators of compromise were observed in our environment. Precautionary steps we took, even though we had no evidence of customer data impact: Revoked and rotated all AI provider API keys stored within the Braintrust platform, as recommended by Braintrust. Rotated the Braintrust API key across all environments. Reviewed the scope of our Braintrust integration and confirmed it is limited to internal eval tooling with no connection to customer data. The confidentiality, integrity, and availability of the Drata product and customer data remain unharmed. We will continue to monitor the situation and will update this post if additional information from Braintrust, our threat-intelligence providers, or our own ongoing investigation materially changes this assessment. If you have questions about your Drata environment in connection with this incident, please contact security@drata.com. Drata Not Impacted by the April 2026 Vercel Security Incident Incidents On April 19, 2026, Drata became aware of the Vercel April 2026 security incident, in which attackers obtained unauthorized access to certain Vercel internal systems via a compromised third-party OAuth application (Context.ai). Reputable threat intelligence sources have reported that a limited subset of Vercel customers had credentials exposed in connection with this incident. Drata is not impacted by this incident based on the information currently available. Our investigation, conducted the same day the incident became public, supports this assessment: Drata did not receive a notification from Vercel indicating that our credentials were part of the affected subset. No customer data is processed on Vercel. Vercel is used exclusively to host our public marketing website (drata.com) and its preview/staging environments. No customer data, no audit evidence, and no workloads that process customer information are hosted on Vercel. No indicators of compromise observed in our environment. We searched our environments for the indicator of compromise Vercel published — the compromised third-party OAuth application ID — and confirmed it does not appear in our logging sources. Precautionary steps we took, even though we had no evidence of impact: Rotated API keys held in our marketing site's Vercel environment for supporting marketing-stack services (content, forms, recruiting integrations), and removed unused environment variables and unused projects. Reviewed downstream permissions on all rotated keys to confirm they remain appropriately scoped to the functions our marketing site actually requires. Marked newly created secrets with the most restrictive handling available in Vercel. The confidentiality, integrity, and availability of the Drata product and customer data remain unharmed. We will continue to monitor the situation and will update this post if additional information from Vercel, our threat-intelligence providers, or our own ongoing investigation materially changes this assessment. If you have questions about your Drata environment in connection with this incident, please contact security@drata.com. Drata Not Impacted by Axios npm Supply Chain Attack Incidents On March 30, 2026, Drata became aware of the Axios npm supply chain attack security incident. Threat intelligence sources have reported that this incident introduced a malicious dependency into specific npm releases of the widely used HTTP client Axios, specifically axios@1.14.1 and axios@0.30.4. -Recommended: Supply Chain Attack on Axios Pulls Malicious Dependency from npm, Socket Research Team -Recommended: Hidden Blast Radius of the Axios Compromise, Socket Research Team We want our customers to know that Drata is not impacted by this threat. We do not leverage the affected versions of this software (axios@1.14.1 or axios@0.30.4) within our product and therefore the confidentiality, integrity, and availability of our systems remain unharmed. If you need help using this Trust Center, please contact us. Contact support If you think you may have discovered a vulnerability, please send us a note. Report issue