Drata
Modern GRC, Compliance & Trust Automation
Last verified April 24, 2026Quick facts: Drata is an AI compliance vendor founded in 2020 and headquartered in San Francisco, US. The vendor publicly documents coverage for ISO/IEC 42001, NIST AI RMF, GDPR Art. 22, and HIPAA. Pricing is available on request. Profile last verified April 24, 2026, with every claim traceable to a cited public source.
About Drata
Drata is a compliance automation platform that continuously monitors security controls, automates evidence collection, and supports multiple frameworks including SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, and ISO 42001 for AI management systems. It differentiates through AI-powered features like policy-to-control mapping, questionnaire automation, and risk workflows, targeting enterprises needing scalable GRC to accelerate audits, manage vendor risks, and demonstrate trust. Typical buyers are security and compliance teams in SaaS, tech, and regulated sectors; recent developments include opening a San Francisco HQ and SafeBase acquisition for enhanced trust centers.
Featured in
Drata is ranked in the following independent collections.
Frameworks supported
Regulations and voluntary standards Drata documents support for on their own materials. Chip shading reflects the strength of the claim, not an independent audit.
Voluntary standard · Global · voluntary
Voluntary standard · US · voluntary
Regulation · EU · in force
Regulation · United States · active
Attestations held
Third-party security attestations and certifications Drata documents on their own materials. These are point-in-time auditor opinions, not regulatory compliance. Always request the current report or certificate directly from the vendor before relying on it.
Attestation · United States (AICPA)
Drata features
Capabilities Drata markets publicly. Inclusion means the feature is documented on the vendor's site — not that it's best-in-class. Last verified April 24, 2026.
Policy Management
Authoring, versioning, and distribution of AI usage policies mapped to regulations.
Risk Assessment Workflow
Guided workflows for completing AI impact assessments, risk scoring, and approval routing.
Audit Evidence Collection
Automated collection, hashing, and retention of evidence (model cards, test results, approvals) for audit.
Third-Party AI Risk Management
Due diligence and ongoing monitoring of AI vendors, subprocessors, and foundation model providers against compliance and security criteria.
Model Monitoring
Production monitoring for performance, drift, data quality, and fairness regressions.
LLM Guardrails & Content Filtering
Runtime guardrails that block or redact unsafe prompts and responses in production LLM applications.
Integrations
Documented by Drata in public product materials.
- Okta
- Slack
- GitHub
- AWS SageMaker
- Google Vertex AI
- Microsoft Entra ID
- Rippling
Drata pricing
Contact for pricing
Pros and cons of Drata
Pros
- Supports 30+ pre-mapped compliance frameworks including AI-specific ISO 42001 and NIST AI RMF.
- AI-powered automation for control mapping, risk management, and assurance questionnaires.
- Extensive integrations with cloud, identity, and dev tools.
- High G2 rating (4.7/5 from 1100+ reviews) with strong customer support.
Cons
- No public pricing details; requires contact for quotes.
- Pricing scales with employee count, frameworks, and complexity, potentially high for enterprises.
- Originally San Diego-based with recent SF HQ opening.
- Focuses on security/compliance rather than pure AI/ML model governance.
Frequently asked
What compliance frameworks does Drata support?+
SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, ISO 42001, NIST CSF, NIST AI RMF, CMMC, and 20+ others.
Does Drata have AI features?+
Yes, including AI-powered policy-to-control mapping, questionnaire responses, risk workflows, and continuous monitoring.
How is pricing determined?+
Based on company size (employees), number of frameworks, and integrations; contact sales for quote.
What integrations does Drata offer?+
Integrates with GCP, Rippling, Microsoft 365, Okta, GitHub, AWS services, HRIS, and 100+ others.
Sources
Keep reading
See an error or outdated detail?
Profiles carry a last-verified date. If something is out of date or wrong, send a correction and we will review it.
Work at Drata?
Claim this listing to propose edits to the tagline, description, pricing notes, and headquarters details. Every change is still reviewed by our editorial team.