Drata
Drata declares 50 subprocessors in its subprocessor list, which we last checked on Nov 11, 2026 (evidence). They include Amazon Web Services, OpenAI and Stripe. The list last changed on Nov 5, 2026: 1 added, 2 removed. 26 tracked vendors name Drata as a subprocessor, including Redis, Speechmatics and MacStadium.
Not loaded by any published homepage.
Subprocessors CSV of Drata's subprocessors · Atom feed of Drata's subprocessors DORA draft CSV of Drata's subprocessors as declared by Drata what's this? ·
50 third parties.
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Algolia | [SafeBase] Algolia is a hosted search and discovery platform designed to help add fast, relevant, and scalable search functionality to the user experience. | United States | |
| Amazon Web Services (AWS) | [Drata & SafeBase] Amazon Web Services is a cloud service provider that stores, transmits, and processes all customer data. Customer databases, uploaded objects, and application servers are hosted a customer-specified region where these services are offered. | United States, Ireland, Germany, Australia | |
| Amplitude | [Drata] Amplitude provides product usage analytics to help track user interactions, behavior, and engagement for the purpose of improving the user experience. | United States | |
| Anthropic AI | [AI Agent Governance] Provides large language model services used to power AI-assisted features specific to the AI Agent Governance product. | United States | |
| Apideck | [Drata] [Opt-in] If configured by a customer to integrate with a customer's cloud storage services, Apideck facilitates interactions with the configured cloud storage services to support operations such as retrieving storage files, shared drives, downloading files, converting file formats, and handling user sessions and connections to cloud services. | Germany | |
| Basedash | [SafeBase] BaseDash is a data management platform used to view, edit, and manage database records through a secure interface. It allows authorized team members to safely interact with production data for operational or support purposes without direct database access. | United States | |
| Bird | [Drata] Bird provides a cloud communications platform that enables the sending of messages and notifications within the platform, enabling features like live updates and instant notifications. | United States | |
| Birdie | [Drata] Birdie is used to capture and share customer issues and feedback as part of handling customer support requests and issues and is used to track and reproduce issues reported by customers. Birdie is used in association with the use of Intercom in customer interactions. | United States | |
| Braintrust | [Opt-in] If AI-powered features are enabled by the Customer in the platform, Braintrust (braintrust.dev) provides an AI observability and evaluation platform that enables Drata to log, monitor, and evaluate AI workflows (such as prompts, model outputs, and tool calls). Drata uses Braintrust to run experiments and evaluations on AI features, detect quality or regression issues, and improve the reliability, safety, and performance of AI functionality. | United States, European Union | |
| Browserbase, Inc | [Drata & SafeBase] [Opt-in] If AI-powered features are enabled by the Customer in the platform, Browserbase, Inc. provides cloud browser infrastructure that enables Drata's AI agents to perform browser-based tasks on behalf of the Customer, including automated evidence collection and navigation of web-based systems within the Customer's environment. | Europe, United States and APAC | |
| Census | [Drata and SafeBase] Census enables data synchronization by connecting business data sources to various other business tools for analysis, automation, and personalization. Census is used as a reverse ETL tool to sync data from data warehouses to various business applications. | United States | |
| Chameleon | [Drata and SafeBase] Chameleon provides in-product digital adoption, user engagement micro surveys, and product awareness and onboarding activities, enabling the creation of personalized experiences. | United States | |
| Cloudflare | [Drata and SafeBase] Cloudflare provides content distribution, security (WAF, etc), abuse prevention, and DNS services for web traffic transmitted to and from the Services. | ||
| Courier | [Drata and SafeBase] [Opt-in] If configured to integrate with a customer's notifications channels (such as email, Slack, Teams, etc.), Courier facilitates the notification infrastructure that enables the sending of multi-channel messages to users. | United States | |
| Datadog | [Drata and SafeBase] Datadog provides cloud monitoring and observability services, enabling the tracking and analyzing of application performance, infrastructure, and logs for debugging, troubleshooting, auditing, and reporting. | United States | |
| dbt Labs | [Drata and SafeBase] GetDBT provides a platform for data transformation, modeling, and analytics, allowing the build, test, and deploy of SQL-based data models within the data warehouse.Transformation and Modeling | United States | |
| Fivetran | [Drata and SafeBase] Fivetran offers real-time data streaming and processing solutions. Drata utilizes Fivetran as an ETL solution to synchronize data from Drata's business information systems to Drata's data warehouse. | United States | |
| Intercom | [Drata and SafeBase] Intercom offers a customer messaging platform that helps manage customer support, engagement, and communication across multiple channels. These elements are used to manage and analyze customer interactions, ensuring efficient support and communication. | United States | |
| Jam.dev | [Drata & SafeBase] [Opt-in] If used by a Customer to report an issue in the platform, Jam.dev allows customers to capture relevant UI and report feedback and issues in order to provide Drata's customer success and engineers with the necessary context for troubleshooting and resolution. | United States | |
| Knock | [Drata and SafeBase] [Opt-in] If configured to integrate with a customer's notifications channels (such as email, Slack, Teams, etc.), Knock facilitates the notification infrastructure that enables the sending of multi-channel messages to users. | United States | |
| LaunchDarkly | [Drata and SafeBase] LaunchDarkly is a feature flagging and experimentation platform that enables the control and test of features and adoption. | United States | |
| Leen | [Drata] [Opt-in] If configured to integrate with a customer's security SaaS integrations, Leen processes, stores, and transmits various data elements synced from these integrations with security SaaS providers. | United States | |
| Liveblocks | [SafeBase] [Opt-in] For customers who choose to use the chat-style collaboration in the platform, Liveblocks provides a real-time collaboration capability that enables features like multi-user editing, commenting, presence indicators, and notifications within our platform, and processes user interaction data to synchronize shared states across users, facilitating seamless collaborative experiences. | United States | |
| Matia | [Drata and SafeBase] Matia.io provides a unified DataOps platform, including data ingestion, observability, cataloging, and reverse ETL. Drata utilizes Matia.io as a sub-processor for both data management and reverse ETL, enabling the synchronization of processed platform and business data into operational systems for enhanced automation and decision-making. | United States | |
| Merge | [Drata] [Opt-in] If configured to integrate with a customer's HRIS SaaS integrations, Merge provides Drata with a unified API that allows the Drata Platform to integrate and sync data across multiple HR, finance, and productivity platforms. | United States | |
| Obvious | [Drata and SafeBase] [Opt-In] For customers who wish to bulk import data from CSV or Excel, Obvious is used to enable administrative users in both Drata and SafeBase platforms to import data such as accounts, account members, controls, risks, and other data into these platforms. | United States | |
| Okta | [Drata and SafeBase] Auth0 (by Okta) provides identity and access management services used to authenticate users and manage secure access to our applications. It enables features such as secure login, multi-factor authentication, user role management, and single sign-on (SSO), helping ensure secure and compliant user access. | United States | |
| Omni | [Drata & SafeBase] To create reporting and analytics views of data within the platform, including executive-level dashboards, self-service custom reporting, and anonymized industry benchmarking, for platform users. | United States | |
| OpenAI AI | [SafeBase] OpenAI provides language processing services used to generate text, analyze content, and support conversational and automation features within our platform. It processes user-provided input to deliver AI-powered responses and assistance for LLM capabilities and security questionnaire answering capabilities in AIQA. | United States | |
| Postmark | [Drata and SafeBase] Postmark provides transactional email delivery services used to send system-generated emails from the platform and helps ensure reliable and secure email delivery to users. | United States | |
| Productboard | [Drata and SafeBase] Productboard provides a product management platform that helps businesses collect customer feedback, prioritize features, and align product roadmaps. ProductBoard is integrated into the platform to enhance product management by allowing customers to submit product ideas, vote on existing ideas, and view the roadmap directly within the platform. | United States | |
| Reducto | [Drata & SafeBase] [Opt-in] Reducto is used to process user-uploaded documents (e.g., questionnaires, raw documents, policies, third party attestations, reports, etc. ) and return structured outputs to support AI features such as automation and document parsing. | United States | |
| Retool | [SafeBase] Retool is a platform used to build internal tools that interact with our databases and APIs. It allows authorized team members to securely view, manage, and update data through custom user interfaces for operational and administrative purposes. | United States | |
| Salesforce | [Drata and SafeBase] Salesforce Service Cloud provides customer support and case management services used to handle user inquiries, track support requests, and manage customer interactions. It helps deliver efficient and personalized support through centralized communication and case tracking. | United States | |
| Sigma Computing | [Drata and SafeBase] Sigma is a business intelligence and data analysis platform used to connect, analyze, and visualize data from various sources. It allows users to create interactive dashboards, generate reports, and collaborate on data insights for better decision-making. | United States | |
| Snowflake | [Drata and SafeBase] Snowflake provides a cloud-based data platform that stores, processes, and analyzes data securely, supporting scalable data warehousing, sharing, and analytics. Snowflake is used as the centralized data warehousing solution to store, manage, and analyze large datasets. | United States | |
| StackOne | [Drata] [Opt-in] If configured to integrate with a customer's SaaS integrations, StackOne provides a unified API that allows the integrations with and syncing data across multiple SaaS systems to pull users for user access reviews and security training systems for tracking completion of security awareness trainings. | United States | |
| Stripe | [SafeBase] [Opt-in] For customers who wish to use payment processing within the platform, Stripe provides payment processing services used to securely handle transactions, manage subscriptions, and store customer billing information. It enables the acceptance of online payments and ensures compliance with financial and data security standards. | ||
| SurveySparrow | [Drata and SafeBase] SurveySparrow provides an omnichannel survey platform that enables the collection, analyzing, and management of customer and employee feedback. SurveySparrow is used to collect and manage customer feedback, particularly through Net Promoter Score (NPS) surveys. The integration involves embedding SurveySparrow widgets within the platform to gather user feedback efficiently. | United States | |
| Svix | [SafeBase] Svix provides webhook infrastructure used to reliably send event notifications from our systems to external services. It ensures secure delivery, retries, and monitoring of webhook messages across integrated platforms. | United States | |
| Totango | [Drata] Totango (dba Catalyst Software) supports customer success management and analytics solutions, helping track user engagement, manage customer relationships, and optimize retention. | United States | |
| tray.ai | [SafeBase] [Opt-in] If configured to integrate with a customer's instance of HubSpot, Tray provides workflow automation services used to integrate and automate data flows between the platform and customer's instance of HubSpot. It helps streamline operations by enabling secure, no-code data synchronization and process automation. | United States | |
| Turbopuffer | [Drata & SafeBase] [Opt-in] If AI-powered features are enabled by the Customer in the platform, Turbopuffer, Inc. provides vector search and storage infrastructure that enables Drata to index, store, and retrieve document embeddings and content to power semantic and full-text search capabilities across Drata's AI-enabled features. | United States, European Union, Australia | |
| Twilio | [Drata and SafeBase] Twilio (dba Segment) provides a customer data platform (CDP) that enables the collection, cleansing, and routing of customer data to various tools for analytics and product usage. | United States | |
| Typeform | [Drata] Typeform provides an online form and survey platform that enables the creation, collection, and processing of responses to vendor risk management security questionnaires and employee responses to security training. | United States, Germany | |
| Vellum | [Drata and SafeBase] [Opt-in] Vellum is a platform for development and management of large language model (LLM) applications and tools for prompt engineering and performance monitoring. Drata uses Vellum to enhance its AI capabilities, particularly for automating and summarizing security questionnaires, SOC 2 reports, and for other AI capabilities within the Drata platform. Users must opt-in to use these features. | United States | |
| Vigo Engineering Inc. dba Prequel | [Drata and SafeBase] [Opt-In] For customers who wish to sync data between Drata and SafeBase platforms to their own data stores, Prequel is used to facilitate this data sync between customer data in Drata and SafeBase databases and customer databases. This feature is part of the Data Warehouse Sync feature, which allows customers to sync key data (e.g., Accounts, Access Requests, and event data like Status Page Viewed) to their customer data warehouses such as Snowflake, BigQuery, Redshift, S3, and others. Prequel's platform reads data from the source and writes it to the destination using an ephemeral server. No data remains on Prequel's platform. | United States | |
| Wiz | [Drata and SafeBase] Wiz DSPM (Data Security Posture Management) helps Drata secure data by continuously monitoring and assessing Drata's data security posture, identifying vulnerabilities, misconfigurations, and compliance risks across cloud environments that host data elements, and provides remediation suggestions. This capability continuously monitors for sensitive data and secrets exposure and proactively eliminate attack paths to help protect data in Drata's platform. | United States | |
| WorkOS | [Drata and SafeBase] [Opt-in] If configured to integrate with a customer's SSO provider(s), WorkOS facilitate Single Sign-On (SSO) for its customers' users. | United States | |
| Zapier | [SafeBase] Zapier provides workflow automation services used to connect and automate tasks between different applications. It enables secure data transfers and process automation across tools based on defined triggers and actions. This is used by SafeBase customer support to receive notifications when customers need assistance or perform certain activities. | United States |
Web TechnologiesCSV of Drata's web technologies · Atom feed of Drata's web technologies
Drata's homepage made 266 requests to 48 domains, 25 services controlled by another company, and 3 domains not identified.
25 third parties by category: Analytics 8Advertising 7Marketing automation 3Live chat 1CDN 1Other 5
Third parties 25 · 198 requests
Qualified.com, Inc. Qualified 34
6Sense Insights, Inc. 6sense 15
GetVector, Inc. Vector 11
Capterra Inc. Capterra 4
Reddit, Inc. Reddit Ads 3
Spotify AB Podsights Spotify Pixel 3
X Corp. Twitter Ads 3
ArtsAI arttrk.com 1
Unknown 3 · 3 requests
mutinycdn.comseamintent.aiusbrowserspeed.com
First party 1 · 65 requests
Drata ArtsAI Cloudflare GSAP HSTS HockeyStack Next.js 16.3.4 Next.js App Router Open Graph Priority Hints React Sentry Turbopack Vercel Vercel Analytics Vercel Speed Insights 2.0.0 Webpack core-js 3.49.0 65
15 tracked companies loaded by the homepage are not in Drata's subprocessor list. A website can use a service without it processing customer data.
Subprocessor of (26)CSV of the companies listing Drata · Atom feed of the companies listing Drata
15Five 15five.com
Bindplane bindplane.com Trust center operations and security documentation sharing
Delphina delphina.ai Security, monitoring, and analytics
Digicert digicert.com Host Trust Center security documentation
Exclusive Networks exclusive-networks.com GRC Platform & Trust Centre
Filevine filevine.com Security and compliance platform
FundApps fundapps.co
Graphwise graphwise.ai Compliance Automation
JDXpert jdxpert.com Compliance and compliance monitoring
Kedify kedify.io Compliance
MacStadium macstadium.com Hosting of MacStadium Security & Compliance Trust Center and email notification to customers of updates
MinIO min.io Compliance automation platform (SOC 2, ISO 27001); processes employee names, email addresses, system access logs, and security configuration evidence collected from connected infrastructure; Trust center platform; processes customer and partner names, email addresses, company names, and NDA acceptance records submitted through MinIO's security review portal
Neuron7.ai neuron7.ai Compliance automation and security monitoring
PCI Pal pcipal.com PCI Pal uses SafeBase (Advanced package) as a sub-processor to operate its Trust Centre and to automate responses to customer and prospect security questionnaires. The platform maintains a trust content library of approved question-and-answer pairs and matches incoming questionnaire questions against this library to generate draft responses for human review. SafeBase is a vendor-hosted, cloud-based platform — PCI Pal does not provision or maintain any underlying infrastructure — and integrates with Salesforce to verify account and NDA/commercial status as part of the Trust Centre access process. Further detail on SafeBase's compliance posture is available via the SafeBase Trust Centre.
Pyze pyze.com Security compliance automation (SOC 2 readiness, monitoring controls)
Redis redis.io Customer trust center platform for security and privacy support
Sawtooth Software sawtoothsoftware.com Providing compliance management and vendor risk and information management.; Trust Center hosting and access management.
Sendbird sendbird.com Compliance monitoring tool and Trust Center
Speechmatics speechmatics.com Vendor security and privacy assessment software
Tembo tembo.io Continuous security and compliance monitoring including automated evidence collection and control testing.
testRigor testrigor.com Automated Compliance Software
UltraDNS ultradns.com Host Trust Center security documentation
Vacation Tracker vacationtracker.io Administrative; Compliance with SOC2 and GDPR
WeTransfer wetransfer.com Trust center
Yunu yunu.io security and compliance automation platform
ZIWO ziwo.io
ComplianceCSV of Drata's compliance · Atom feed of Drata's compliance
- Certified
- Says it complies with
FedRAMP Marketplace
| Offering | Status | Impact | Agencies | Since |
|---|---|---|---|---|
| Drata Trust Management Platform | Authorized | 20x Low | 1 |
Certifications as Drata's trust center lists them; reports are usually shared on request (evidence) FedRAMP status from the FedRAMP Marketplace (evidence)
Service statusCSV of Drata's status page incidents · Atom feed of Drata's status page incidents
90 days agotoday
- 8 incidents in 90 days
- 7 major or critical
- 33 h 49 min typical time to resolve
- 4 days longest major
| Began | Incident | Impact | Lasted |
|---|---|---|---|
| Delayed scheduled compliance checks and ticket synchronization in the US region | major | 33 h 49 min | |
| Some Policy PDF Downloads Missing Appendix Page | major | ongoing | |
| Some Policy PDF Downloads Missing Appendix Page | major | 4 days | |
| Cron service degraded | major | 21 h 40 min | |
| MSSP / Multi-Instance Management Client List Unavailable | minor | 1 h 36 min | |
| Multiple products unavailable | critical | 4 h 14 min | |
| Public API in US region degraded | major | 2 days | |
| Brief SafeBase App Request Failures | critical | — |
Incidents per month
critical major minor no impact stated
Components affected
| Component | Incidents | Bar |
|---|---|---|
| AIQA | 1 | |
| Public API US | 1 | |
| Trust Center Admin Page | 1 | |
| Trust Center Pages | 1 |
As Drata's status page reports its own incidents (scheduled maintenance left out), read every few hours since (evidence)
Incidents reported by Drata's subprocessorsCSV of incidents reported by vendors Drata lists · Atom feed of incidents reported by vendors Drata lists
349 reported incidents in the last 30 days, by 27 of the vendors Drata lists as subprocessors.
A subprocessor list names a company, not the service an incident touched. This does not show that Drata was involved.
And 324 more. All of them: CSV · Who is around them.
ChangesCSV of Drata's changes · Atom feed of Drata's changes
See the list as we read it on any date: Time machine
- Removed certification: CSA STAR evidence: certification: CSA STAR
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Added certification: CSA STAR evidence: certification: CSA STAR
- Removed certification: CSA STAR evidence: certification: CSA STAR
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Removed subprocessor: Decodable evidence: subprocessor: Decodable list before and after: subprocessor: Decodable
- Removed subprocessor: Front evidence: subprocessor: Front list before and after: subprocessor: Front
- Added subprocessor: Amazon Web Services (AWS) evidence: subprocessor: Amazon Web Services (AWS) list before and after: subprocessor: Amazon Web Services (AWS)
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Added certification: CSA STAR evidence: certification: CSA STAR
- Removed subprocessor: Amazon Web Services (AWS) evidence: subprocessor: Amazon Web Services (AWS) list before and after: subprocessor: Amazon Web Services (AWS)
- Added subprocessor: Amazon Web Services (AWS) evidence: subprocessor: Amazon Web Services (AWS) list before and after: subprocessor: Amazon Web Services (AWS)
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Added certification: CSA STAR evidence: certification: CSA STAR
- Removed subprocessor: Amazon Web Services (AWS) evidence: subprocessor: Amazon Web Services (AWS) list before and after: subprocessor: Amazon Web Services (AWS)
- Removed certification: CSA STAR evidence: certification: CSA STAR
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Added subprocessor: Amazon Web Services (AWS) evidence: subprocessor: Amazon Web Services (AWS) list before and after: subprocessor: Amazon Web Services (AWS)
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Added certification: CSA STAR evidence: certification: CSA STAR
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Removed certification: CSA STAR evidence: certification: CSA STAR
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Added certification: CSA STAR evidence: certification: CSA STAR
- Removed certification: CSA STAR evidence: certification: CSA STAR
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Removed certification: CSA STAR evidence: certification: CSA STAR
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Changed certification: ISO/IEC 27018 evidence: certification: ISO/IEC 27018
- Added certification: CSA STAR evidence: certification: CSA STAR
- Added subprocessor: Amazon Web Services (AWS) evidence: subprocessor: Amazon Web Services (AWS) list before and after: subprocessor: Amazon Web Services (AWS)
- Removed certification: CSA STAR evidence: certification: CSA STAR
- Added certification: CSA STAR evidence: certification: CSA STAR
Rating badge for Drata's site
It updates with the rating.
<a href="https://thirdpartyindex.com/vendors/drata"><img src="https://thirdpartyindex.com/badge/drata.svg" alt="Drata transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/drata)