Drata
Compliance automation and GRC platform with 30+ pre-built frameworks, including ISO 42001, the NIST AI RMF and AIUC-1
Last checked October 15, 2026Quick facts: Drata is an AI compliance vendor founded in 2020 and headquartered in United States. The vendor publicly documents coverage for ISO/IEC 42001, NIST AI RMF, EU AI Act, and SOC 2. Pricing is tiered. Profile last checked October 15, 2026; sources are cited at the bottom of this page.
About Drata
Drata is a compliance automation and governance, risk and compliance (GRC) platform founded in 2020. Its about page lists offices in San Francisco, New York, San Diego, London and Sydney. It says more than 8,500 organizations use it, and it reported about $100 million in annual recurring revenue in February 2025. Its last disclosed round was a $200 million Series C co-led by ICONIQ Growth and GGV Capital in December 2022 at a $2 billion valuation, which took total funding past $328 million. It bought Harmonize.io and oak9 in 2024 and the trust center company SafeBase for $250 million in February 2025. The platform offers more than 30 pre-built frameworks with continuous control monitoring, automated evidence collection, policies, risk management, third-party risk management with agent-based assessments, and a Trust Center built on SafeBase. Its AI features include questionnaire assistance, mapping policies to controls, explanations of failed tests and an MCP server. More than 175 audit firms are in its Audit Alliance. **AI compliance coverage** Drata has framework pages for ISO/IEC 42001, which maps the standard's requirements to its control library and links AI-specific risks to controls, and for the NIST AI RMF, supported since December 2023. It also lists AIUC-1. The EU AI Act is not in its framework list; the Act is mentioned only for AI Agent Governance, a limited-availability product announced in August 2026 that enforces policy on AI agents and maps to ISO 42001, the EU AI Act and AIUC-1. **Who it's for** Growth-stage and enterprise companies running SOC 2, ISO 27001 and similar programs that want ISO 42001 or the NIST AI RMF on the same platform. It is not a model testing or LLM content filtering tool.
Verified certifications
Compliance certifications independently verified against the vendor's own public trust page. Each badge links to the source we verified against.
Last verified Aug 22, 2026. Certification links are checked when a vendor profile is reviewed. See our methodology.
Featured in
Drata is ranked in the following independent collection.
Frameworks supported
Regulations, voluntary standards and compliance programs Drata documents support for on their own materials. Chip shading reflects the strength of the claim, not an independent audit.
Voluntary standard · Global · voluntary
Voluntary standard · US · voluntary
Regulation · EU · Phased — in force; high-risk rules deferred
Compliance program it supports (not its own certification) · United States (AICPA)
Compliance program it supports (not its own certification) · International (ISO)
Regulation · United States · active
Compliance program it supports (not its own certification) · International (PCI SSC)
Regulation · EU · in force
Drata features
Capabilities Drata markets publicly. Inclusion means the feature is documented on the vendor's site — not that it's best-in-class. Last checked October 15, 2026.
Audit Evidence Collection
Automated collection, hashing, and retention of evidence (model cards, test results, approvals) for audit.
Policy Management
Authoring, versioning, and distribution of AI usage policies mapped to regulations.
Risk Assessment Workflow
Guided workflows for completing AI impact assessments, risk scoring, and approval routing.
Third-Party AI Vendor Risk
Intake and assessment of AI features in third-party SaaS used by the organization.
Third-Party AI Risk Management
Due diligence and ongoing monitoring of AI vendors, subprocessors, and foundation model providers against compliance and security criteria.
Integrations
Documented by Drata in public product materials.
- Okta
- GitHub
- Slack
- Microsoft Entra ID
- Rippling
- Cloudflare
- CircleCI
- Anthropic API
- AWS GovCloud
- AWS Marketplace
Drata pricing
GRC plans (Foundation, Advanced, Enterprise) and Assurance plans (Trust Center and questionnaires) are quoted; drata.com shows no prices. Its AWS Marketplace listing charges a $25,000 platform fee for a 100-FTE organization plus $7,500 per framework, for a 12-month contract.
Third-party reviews
Publicly cited ratings from independent review platforms. We don't collect reviews ourselves and we don't weight these in our rankings. Low review counts (≤2) are noted so you can decide how much signal to take from them.
G2
1397 reviews
We publish the cited numbers as-is and do not combine them into an aggregate rating, on this page or in search-result markup.
Vendor changelog
Durable events we've independently sourced — acquisitions, certification milestones, product launches. Each entry cites a primary or trusted secondary source.
- product launch
Announced AI Agent Governance
A limited-availability product that enforces policy on AI agent actions and maps to ISO 42001, the EU AI Act and AIUC-1.
Business Wire - acquisition
Acquired SafeBase for $250M
SafeBase's trust center became the basis of Drata's Trust Center.
TechCrunch - funding
Raised $200M Series C at a $2B valuation
Co-led by ICONIQ Growth and GGV Capital.
Drata
Pros and cons of Drata
Pros
- ISO 42001, the NIST AI RMF and AIUC-1 are pre-built frameworks alongside 30+ security and privacy frameworks.
- Third-party risk management with agent-based assessments, and a Trust Center built on SafeBase.
- Strong user ratings: 4.7 out of 5 from 1,397 G2 reviews (October 2026).
- Large audit network: more than 175 firms in its Audit Alliance.
Cons
- No prices on drata.com; the AWS Marketplace list price for one framework is $32,500 a year ($25,000 platform fee plus $7,500 per framework).
- No EU AI Act framework: the Act appears only in AI Agent Governance, which is in limited availability.
- Its ISO 42001 page describes control mapping and risk linking but publishes no control, test or template counts.
- Not a model testing tool: no model monitoring, bias testing or LLM content filtering, so teams building AI systems need one alongside it.
Alternatives to Drata
Frequently asked
What is Drata?+
Drata is a compliance automation and GRC platform founded in 2020. It automates evidence collection, control monitoring, policies, risk and third-party risk across 30+ pre-built frameworks, and says more than 8,500 organizations use it.
Does Drata support ISO 42001 and the EU AI Act?+
Drata supports ISO/IEC 42001 and the NIST AI RMF as pre-built frameworks, and lists AIUC-1. The EU AI Act is not in its framework list; Drata maps to it only in AI Agent Governance, a limited-availability product announced in August 2026.
How much does Drata cost?+
Drata doesn't publish prices on its website. Its AWS Marketplace listing charges a $25,000 platform fee for a 100-FTE organization plus $7,500 per framework for a 12-month contract, so one framework lists at $32,500 a year.
Did Drata acquire SafeBase?+
Yes. Drata bought SafeBase, a trust center company, for $250 million in February 2025, and its Trust Center is now built on SafeBase. It also bought Harmonize.io and oak9 in 2024.
Sources
- Drata: About (founded 2020, offices)
- Drata: Customers (8,500+)
- Drata: Series C announcement (December 2022)
- Crunchbase News: Drata doubles valuation to $2B after $200M Series C
- TechCrunch: Drata acquires SafeBase for $250M (February 2025)
- Drata: Crossing $100M in ARR (February 2025)
- Drata: Frameworks (30+ pre-built)
- Drata: ISO 42001
- Drata: NIST AI RMF
- Drata: NIST AI RMF framework support (December 2023)
- Drata: AI Agent Governance (limited availability)
- Business Wire: Drata extends its platform to govern AI agents (August 2026)
- Drata: AI features
- Drata: Plans
- AWS Marketplace: Drata (12-month prices)
- Drata: Audit Alliance (175+ audit firms)
- Drata: Integrations
- G2: Drata reviews
Keep reading
See an error or outdated detail?
Profiles carry a last-checked date. If something is out of date or wrong, send a correction and we will review it.
Work at Drata?
Claim this listing to propose edits to the tagline, description, pricing notes, and headquarters details. Every change is still reviewed by our editorial team.