Drata
Transparency
Breakdown
| Subprocessor list | 30 / 30 | |
| Processing locations | 8 / 8 | |
| Purposes | 7 / 7 | |
| Data processing addendum | 12 / 12 | |
| Trust center | 8 / 8 | |
| Privacy policy | 6 / 6 | |
| security.txt | not found | 0 / 6 |
| Security page | 5 / 5 | |
| Status page | 5 / 5 | |
| Vulnerability disclosure | not found | 0 / 5 |
| Pages still reachable | 8 / 8 | |
| Total | 89 / 100 |
Only documents we can retrieve count: a page behind a login or a broken link scores nothing.
Badge
For Drata's own site; it updates with the rating.
<a href="https://thirdpartyindex.com/vendors/drata"><img src="https://thirdpartyindex.com/badge/drata.svg" alt="Drata transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/drata)Documents
| Document | Verified | Changed | Evidence |
|---|---|---|---|
| Trust center safebase | snapshot | ||
| Subprocessor list safebase | snapshot | ||
| Data processing addendum | snapshot | ||
| Privacy policy | snapshot | ||
| Terms | snapshot | ||
| Security page | snapshot | ||
| Status page statuspage | snapshot |
Subprocessors
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Algolia | [SafeBase] Algolia is a hosted search and discovery platform designed to help add fast, relevant, and scalable search functionality to the user experience. | United States | |
| Amplitude | [Drata] Amplitude provides product usage analytics to help track user interactions, behavior, and engagement for the purpose of improving the user experience. | United States | |
| Apideck | [Drata] [Opt-in] If configured by a customer to integrate with a customer's cloud storage services, Apideck facilitates interactions with the configured cloud storage services to support operations such as retrieving storage files, shared drives, downloading files, converting file formats, and handling user sessions and connections to cloud services. | Germany | |
| Basedash | [SafeBase] BaseDash is a data management platform used to view, edit, and manage database records through a secure interface. It allows authorized team members to safely interact with production data for operational or support purposes without direct database access. | United States | |
| Bird | [Drata] Bird provides a cloud communications platform that enables the sending of messages and notifications within the platform, enabling features like live updates and instant notifications. | United States | |
| Birdie | [Drata] Birdie is used to capture and share customer issues and feedback as part of handling customer support requests and issues and is used to track and reproduce issues reported by customers. Birdie is used in association with the use of Intercom in customer interactions. | United States | |
| Braintrust | [Opt-in] If AI-powered features are enabled by the Customer in the platform, Braintrust (braintrust.dev) provides an AI observability and evaluation platform that enables Drata to log, monitor, and evaluate AI workflows (such as prompts, model outputs, and tool calls). Drata uses Braintrust to run experiments and evaluations on AI features, detect quality or regression issues, and improve the reliability, safety, and performance of AI functionality. | United States, European Union | |
| Browserbase, Inc | [Drata & SafeBase] [Opt-in] If AI-powered features are enabled by the Customer in the platform, Browserbase, Inc. provides cloud browser infrastructure that enables Drata's AI agents to perform browser-based tasks on behalf of the Customer, including automated evidence collection and navigation of web-based systems within the Customer's environment. | Europe, United States and APAC | |
| Census | [Drata and SafeBase] Census enables data synchronization by connecting business data sources to various other business tools for analysis, automation, and personalization. Census is used as a reverse ETL tool to sync data from data warehouses to various business applications. | United States | |
| Chameleon | [Drata and SafeBase] Chameleon provides in-product digital adoption, user engagement micro surveys, and product awareness and onboarding activities, enabling the creation of personalized experiences. | United States | |
| Cloudflare | [Drata and SafeBase] Cloudflare provides content distribution, security (WAF, etc), abuse prevention, and DNS services for web traffic transmitted to and from the Services. | ||
| Courier | [Drata and SafeBase] [Opt-in] If configured to integrate with a customer's notifications channels (such as email, Slack, Teams, etc.), Courier facilitates the notification infrastructure that enables the sending of multi-channel messages to users. | United States | |
| Datadog | [Drata and SafeBase] Datadog provides cloud monitoring and observability services, enabling the tracking and analyzing of application performance, infrastructure, and logs for debugging, troubleshooting, auditing, and reporting. | United States | |
| dbt Labs | [Drata and SafeBase] GetDBT provides a platform for data transformation, modeling, and analytics, allowing the build, test, and deploy of SQL-based data models within the data warehouse.Transformation and Modeling | United States | |
| Decodable | [Drata and SafeBase] Decodable is a real-time data streaming and processing solution and is utilized as an ETL solution to synchronize structured data from platform databases to data warehouses. | United States | |
| Fivetran | [Drata and SafeBase] Fivetran offers real-time data streaming and processing solutions. Drata utilizes Fivetran as an ETL solution to synchronize data from Drata's business information systems to Drata's data warehouse. | United States | |
| Flatfile | [Drata and SafeBase] [Opt-In] For customers who wish to bulk import data from CSV or Excel, Flatfile is used to enable administrative users in both Drata and SafeBase platforms to import data such as accounts, account members, controls, risks, and other data into these platforms. | United States | |
| Front | [Drata and SafeBase] Front offers a collaborative inbox platform that helps customer success team members manage customer communications across multiple channels in a unified customer messaging platform. | United States | |
| Intercom | [Drata and SafeBase] Intercom offers a customer messaging platform that helps manage customer support, engagement, and communication across multiple channels. These elements are used to manage and analyze customer interactions, ensuring efficient support and communication. | United States | |
| Jam.dev | [Drata & SafeBase] [Opt-in] If used by a Customer to report an issue in the platform, Jam.dev allows customers to capture relevant UI and report feedback and issues in order to provide Drata's customer success and engineers with the necessary context for troubleshooting and resolution. | United States | |
| Knock | [Drata and SafeBase] [Opt-in] If configured to integrate with a customer's notifications channels (such as email, Slack, Teams, etc.), Knock facilitates the notification infrastructure that enables the sending of multi-channel messages to users. | United States | |
| LaunchDarkly | [Drata and SafeBase] LaunchDarkly is a feature flagging and experimentation platform that enables the control and test of features and adoption. | United States | |
| Leen | [Drata] [Opt-in] If configured to integrate with a customer's security SaaS integrations, Leen processes, stores, and transmits various data elements synced from these integrations with security SaaS providers. | United States | |
| Liveblocks | [SafeBase] [Opt-in] For customers who choose to use the chat-style collaboration in the platform, Liveblocks provides a real-time collaboration capability that enables features like multi-user editing, commenting, presence indicators, and notifications within our platform, and processes user interaction data to synchronize shared states across users, facilitating seamless collaborative experiences. | United States | |
| Matia | [Drata and SafeBase] Matia.io provides a unified DataOps platform, including data ingestion, observability, cataloging, and reverse ETL. Drata utilizes Matia.io as a sub-processor for both data management and reverse ETL, enabling the synchronization of processed platform and business data into operational systems for enhanced automation and decision-making. | United States | |
| Merge | [Drata] [Opt-in] If configured to integrate with a customer's HRIS SaaS integrations, Merge provides Drata with a unified API that allows the Drata Platform to integrate and sync data across multiple HR, finance, and productivity platforms. | United States | |
| Okta | [Drata and SafeBase] Auth0 (by Okta) provides identity and access management services used to authenticate users and manage secure access to our applications. It enables features such as secure login, multi-factor authentication, user role management, and single sign-on (SSO), helping ensure secure and compliant user access. | United States | |
| Omni | [Drata & SafeBase] To create reporting and analytics views of data within the platform, including executive-level dashboards, self-service custom reporting, and anonymized industry benchmarking, for platform users. | United States | |
| OpenAI | [SafeBase] OpenAI provides language processing services used to generate text, analyze content, and support conversational and automation features within our platform. It processes user-provided input to deliver AI-powered responses and assistance for LLM capabilities and security questionnaire answering capabilities in AIQA. | United States | |
| Postmark | [Drata and SafeBase] Postmark provides transactional email delivery services used to send system-generated emails from the platform and helps ensure reliable and secure email delivery to users. | United States | |
| Productboard | [Drata and SafeBase] Productboard provides a product management platform that helps businesses collect customer feedback, prioritize features, and align product roadmaps. ProductBoard is integrated into the platform to enhance product management by allowing customers to submit product ideas, vote on existing ideas, and view the roadmap directly within the platform. | United States | |
| Reducto | [Drata & SafeBase] [Opt-in] Reducto is used to process user-uploaded documents (e.g., questionnaires, raw documents, policies, third party attestations, reports, etc. ) and return structured outputs to support AI features such as automation and document parsing. | United States | |
| Retool | [SafeBase] Retool is a platform used to build internal tools that interact with our databases and APIs. It allows authorized team members to securely view, manage, and update data through custom user interfaces for operational and administrative purposes. | United States | |
| Salesforce | [Drata and SafeBase] Salesforce Service Cloud provides customer support and case management services used to handle user inquiries, track support requests, and manage customer interactions. It helps deliver efficient and personalized support through centralized communication and case tracking. | United States | |
| Sigma Computing | [Drata and SafeBase] Sigma is a business intelligence and data analysis platform used to connect, analyze, and visualize data from various sources. It allows users to create interactive dashboards, generate reports, and collaborate on data insights for better decision-making. | United States | |
| Snowflake | [Drata and SafeBase] Snowflake provides a cloud-based data platform that stores, processes, and analyzes data securely, supporting scalable data warehousing, sharing, and analytics. Snowflake is used as the centralized data warehousing solution to store, manage, and analyze large datasets. | United States | |
| StackOne | [Drata] [Opt-in] If configured to integrate with a customer's SaaS integrations, StackOne provides a unified API that allows the integrations with and syncing data across multiple SaaS systems to pull users for user access reviews and security training systems for tracking completion of security awareness trainings. | United States | |
| Stripe | [SafeBase] [Opt-in] For customers who wish to use payment processing within the platform, Stripe provides payment processing services used to securely handle transactions, manage subscriptions, and store customer billing information. It enables the acceptance of online payments and ensures compliance with financial and data security standards. | ||
| SurveySparrow | [Drata and SafeBase] SurveySparrow provides an omnichannel survey platform that enables the collection, analyzing, and management of customer and employee feedback. SurveySparrow is used to collect and manage customer feedback, particularly through Net Promoter Score (NPS) surveys. The integration involves embedding SurveySparrow widgets within the platform to gather user feedback efficiently. | United States | |
| Svix | [SafeBase] Svix provides webhook infrastructure used to reliably send event notifications from our systems to external services. It ensures secure delivery, retries, and monitoring of webhook messages across integrated platforms. | United States | |
| Totango | [Drata] Totango (dba Catalyst Software) supports customer success management and analytics solutions, helping track user engagement, manage customer relationships, and optimize retention. | United States | |
| tray.ai | [SafeBase] [Opt-in] If configured to integrate with a customer's instance of HubSpot, Tray provides workflow automation services used to integrate and automate data flows between the platform and customer's instance of HubSpot. It helps streamline operations by enabling secure, no-code data synchronization and process automation. | United States | |
| Turbopuffer | [Drata & SafeBase] [Opt-in] If AI-powered features are enabled by the Customer in the platform, Turbopuffer, Inc. provides vector search and storage infrastructure that enables Drata to index, store, and retrieve document embeddings and content to power semantic and full-text search capabilities across Drata's AI-enabled features. | United States, European Union, Australia | |
| Twilio | [Drata and SafeBase] Twilio (dba Segment) provides a customer data platform (CDP) that enables the collection, cleansing, and routing of customer data to various tools for analytics and product usage. | United States | |
| Typeform | [Drata] Typeform provides an online form and survey platform that enables the creation, collection, and processing of responses to vendor risk management security questionnaires and employee responses to security training. | United States, Germany | |
| Vellum | [Drata and SafeBase] [Opt-in] Vellum is a platform for development and management of large language model (LLM) applications and tools for prompt engineering and performance monitoring. Drata uses Vellum to enhance its AI capabilities, particularly for automating and summarizing security questionnaires, SOC 2 reports, and for other AI capabilities within the Drata platform. Users must opt-in to use these features. | United States | |
| Vigo Engineering Inc. dba Prequel | [Drata and SafeBase] [Opt-In] For customers who wish to sync data between Drata and SafeBase platforms to their own data stores, Prequel is used to facilitate this data sync between customer data in Drata and SafeBase databases and customer databases. This feature is part of the Data Warehouse Sync feature, which allows customers to sync key data (e.g., Accounts, Access Requests, and event data like Status Page Viewed) to their customer data warehouses such as Snowflake, BigQuery, Redshift, S3, and others. Prequel's platform reads data from the source and writes it to the destination using an ephemeral server. No data remains on Prequel's platform. | United States | |
| Wiz | [Drata and SafeBase] Wiz DSPM (Data Security Posture Management) helps Drata secure data by continuously monitoring and assessing Drata's data security posture, identifying vulnerabilities, misconfigurations, and compliance risks across cloud environments that host data elements, and provides remediation suggestions. This capability continuously monitors for sensitive data and secrets exposure and proactively eliminate attack paths to help protect data in Drata's platform. | United States | |
| WorkOS | [Drata and SafeBase] [Opt-in] If configured to integrate with a customer's SSO provider(s), WorkOS facilitate Single Sign-On (SSO) for its customers' users. | United States | |
| Zapier | [SafeBase] Zapier provides workflow automation services used to connect and automate tasks between different applications. It enables secure data transfers and process automation across tools based on defined triggers and actions. This is used by SafeBase customer support to receive notifications when customers need assistance or perform certain activities. | United States |
Listed as a subprocessor by (4)
Purposes as each company states them.
Kedify kedify.io Compliance
MinIO min.io Compliance automation platform (SOC 2, ISO 27001); processes employee names, email addresses, system access logs, and security configuration evidence collected from connected infrastructure
Sendbird sendbird.com Compliance monitoring tool and Trust Center
WeTransfer wetransfer.com Trust center
Changes
None since tracking began.