Listopedia

Drata

Compliance automation with compliance-as-code and the SafeBase trust centre

Overview

Drata was launched in 2020 by Adam Markowitz (chief executive), Daniel Marashlian (chief technology officer) and Troy Markowitz (chief operating officer), and lists offices in San Francisco, New York, San Diego, London and Sydney[5]. Its about page cites more than 8,000 customers[5]. In February 2025 Drata signed a definitive agreement to acquire SafeBase, a trust-centre company founded in 2020 whose product handles inbound security reviews; Drata said SafeBase would keep its standalone product while bringing its functions into the Drata platform[6]. The current price list reflects that merger: Drata sells separate Compliance plans and Trust plans, plus a third-party risk module[4]. On the compliance side the Foundation tier is limited to organisations of up to 50 full-time employees and one pre-mapped framework drawn from SOC 2, ISO 27001, Cyber Essentials, HIPAA and GDPR; Advanced unlocks any available framework, custom connections and custom tests; Enterprise adds Compliance as Code Pro, Risk Management Pro and user access reviews[4]. Compliance as code, which lets engineering teams check infrastructure definitions against controls before deployment, is the feature that most distinguishes Drata from its closest rivals. The main limitations are packaging rather than capability: user access review and extra frameworks are add-ons below Enterprise, and no prices are published[4].

Drata features

  • Compliance as code for infrastructure definitions
  • Pre-mapped frameworks with custom framework add-on
  • Risk management and custom controls
  • SafeBase-based Trust Center with clickwrap NDA
  • AI questionnaire assistance
  • Open API access on all compliance tiers
  • Agentic third-party risk assessment add-on
  • Automated evidence collection and monitoring

Drata pricing

Compliance plans: Foundation (up to 50 FTEs, one framework), Advanced and Enterprise. Trust plans: Foundation (up to 100 approved domains and 100 questionnaires), Advanced (up to 300 domains) and Enterprise (unlimited domains). Third-party risk management is sold separately. No prices are published; all plans route to a demo request.

Drata strengths and limitations

Strengths

  • Compliance-as-code tooling for engineering teams
  • Trust centre product from the SafeBase acquisition
  • Open API on every compliance tier
  • Large stated customer base
  • Large framework catalogue on upper tiers
  • Integrated trust centre

Limitations

  • Entry tier capped at 50 employees and one framework
  • User access review is an add-on below Enterprise
  • Separate compliance and trust plans add contract complexity
  • No published prices
  • Foundation limited to one framework and 50 FTEs
  • Many capabilities sold as add-ons

Appears in

Drata alternatives and competitors

Alternatives to Drata: companies ranked in the same lists.

Is this your company?

Update the description, logo, image and link through the submission form. Editors review every change.

Update this listing

Is your company missing from a list?

Send your logo, description and link. Editors review every submission, and approved listings are clearly labelled.

Add your company