A security-first mindset that’s rooted in our core value of trust.
Report Security Issue
Drata was founded to help build trust across the internet by allowing companies to stand up and maintain their security posture. Security and compliance is at the core of what we provide, and it's also at the core of what we do. Drata works with independent experts to verify our own security, privacy, and compliance controls, and have achieved certification against stringent standards. Download our security whitepaper today to learn more.
Developed by the Assurance Services Executive Committee (ASEC) of the AICPA, the Trust Services Criteria is the set of control criteria to be used when evaluating the suitability of the design and operating effectiveness of controls relevant to the security, availability, or processing integrity of information and systems, or the confidentiality or privacy of the information processed by the systems at an entity, a division, or an operating unit of an entity.
Drata continuously monitors 100+ security controls across the organization using its own automation platform. Automated alerts and evidence collection allows Drata to confidently prove its security and compliance posture any day of the year, while fostering a security-first mindset and culture of compliance across the organization.
Drata completes annual 3rd party penetration tests by a qualified assessor as well as between major feature releases.
We've partnered with a leading security training company to cover 13 major topics for our employee training.
We simulate phishing exercises monthly with all staff using extremely realistics phishing emails.
We use least privilege when connecting to customers' environments, scoped to only what's needed to satisfy the control.
Being in the security and compliance automation business means holding our own internal programs to the highest of standards. The team at Drata is committed to achieving and maintaining the trust of our customers, partners, and employees through these efforts. If you have any compliance or privacy questions please contact us at [email protected].
At Drata, we are strong supporters of privacy and we adhere to GDPR and other privacy regulations in everything we do. We as a processor will enter into a data processing addendum (DPA) with our customers that will include standard contractual clauses (“SCC“) around data transfers and data protection.
For more information please visit our GDPR page, sub processors page, or to make a removal request please email [email protected].
Industry leading Web Application Firewall with automatic updates to block against the latest threats spotted around the world.
DNSSEC to block against dns hijacking attacks. We take your access to Drata seriously and go in-depth, enabling every security measure we can.
Application level DDoS protection from CDN provider and network level DDoS protection from cloud provider.
TLS 1.2 minimum for data in transit and encryption at rest for all instances and databases.
AWS handles physical and virtual aspects as part of the shared responsibility model. Deployments with AWS Fargate limit our footprint and ensure a better security posture.
Infrastructure as code with Terraform allows peer reviewed changes, template scanning for vulnerabilities, and quick recovery in case of outages.
Network spoofing protection is enabled in our cloud provider which prevents adversaries from spoofing traffic or arp addresses.
Drata uses a number of services for anomaly detection including GuardDuty as well as third party security services from trusted vendors.
Every code merge has a static code analysis check done that must be passed before code can be merged to main.
A leading third party security solution scans all of our libraries to ensure we don’t have vulnerable libraries in the code base.
We scan our codebase for credentials to ensure they aren’t accidentally merged into code.
All code is peer reviewed by a Senior Engineer before being merged to main.
All of our devices are centrally managed with policies around security, patching, and encryption enforced.
Drata uses the latest technology in endpoint security to identify potential threats. We go beyond anti-virus and use EDR to see malicious activating and the chain of events that lead up to it.
There are many threat actors that target specific companies, Drata combats this by using solution that have ATP protections and have 24/7 managed threat hunting capabilities.
We have implemented Advanced DNS Filtering on our endpoints to filter malicious requests that could harm our employees or infrastructure.
If you believe you have found a security vulnerability on our website or in our application / api, please follow our responsible disclosure policy. Drata will not accept general vulnerability or low effort reports. Please validate all reports. Drata has a private bounty program and will offer compensation for reported bugs that meet our qualifications.
Learn how Iteratively used Drata to get their SOC 2 report faster than most thought possible, and now monitor their security & compliance posture…