Drata just released NIST 800-53 + 8 more frameworks. Learn more here

Authorized Sub-processors

Last Updated:
April 25, 2022


To support delivery of our Services, Drata may engage and use data processors with access to certain Customer Data (each, a “Subprocessor”). This page provides important information about the identity, location and role of each Subprocessor.

Drata currently uses third party Subprocessors to provide infrastructure services, and to help us provide customer support and email notifications. Prior to engaging any third party Subprocessor, Drata performs diligence to evaluate their privacy, security and confidentiality practices, and executes an agreement implementing its applicable obligations.

Infrastructure Sub-processors:

Drata may use the following Subprocessors to host Customer Data or provide other infrastructure that helps with delivery of our Services:

Sub-Processor Purpose Data Location
Amazon Web Services, Inc. Hosting & Infrastructure United States
Cloudflare, Inc. Content delivery network & WAF United States
CockroachDB Database hosting platform United States

Other Sub-processors:

Drata may use the following Subprocessors to perform other Service functions:

Sub-Processor Purpose Data Location
Amplitude, Inc. Product Analytics United States
CKSource sp. z o.o. sp.k. WYSIWYG United States
Courier Product Notifications United States
Datadog, Inc. Analytics on application and infrastructure logs for debugging, troubleshooting, auditing, and reporting United States
Fivetran ETL Solution United States
Functional Software, Inc. Client-side error tracking for debugging, troubleshooting, auditing, and reporting United States
Full Story, Inc. Session Recording United States
GetDBT Data Transformation and Modeling United States
Google, Inc. Cloud-based Email Service Provider United States
HubSpot, Inc. Marketing Platform United States
Intercom, Inc. Cloud-based Customer Support Services United States
Merge API Inc. HRIS Integration Connector United States
MessageBird B.V. Socket Communication Layer United States
Salesforce, Inc. Customer Relationship Management (CRM) System United States
Send Amply Inc. Cloud-based Email Delivery Services United States
Shiny Planes, Inc. (DBA LaunchNotes) Product Release Updates United States
Sigma Computing, Inc. Data Analytics & Visualization United States
Slack Technologies Cloud-based Team Chat Services United States
Snowflake, Inc. Data Warehouse United States
Traceable, Inc. Advanced API Security United States
Twilio, Inc. Segment: Cloud-based CDP tool United States
TYPEFORM SL Embedded Forms United States & Germany
Vitally, Inc. Customer journey analysis and user notifications United States
WorkOS, Inc. SSO Integration Connector United States
Zapier Inc. Automation Workflow United States


As our business grows and evolves, the Sub-processors we engage may also change. We will endeavor to provide the owner of Customer’s account with notice of any new Subprocessors to the extent required under the Agreement, along with posting such updates here. Please check back frequently for updates.

Case Study:

Learn how Iteratively used Drata to get their SOC 2 report faster than most thought possible, and now monitor their security & compliance posture…