# Drata

- **Type:** Software product
- **Website:** https://drata.com
- **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd)

US compliance software that you subscribe to and run yourselves, with an ISO 42001 module for AI governance. It is a product, not advice.

## Drata scores

Scored 1 to 5 on six criteria. There is no overall score.

### Help when things go wrong: 4/5

Drata documents continuous, automated evidence collection across 300+ integrations that keeps 'a dependable audit trail' current for audits (drata.com/products/compliance), though it does not explicitly frame this around ICO or AI Act enforcement scenarios.

### Qualifications of the people who do the work: 4/5

Drata holds verifiable SOC 2 Type II, ISO 27001 and ISO 42001 certifications listed on trust.drata.com, and has publicly named a VP Security/CISO (Matt Hilary) via press coverage, though its own trust page does not name a security contact individually.

### What it publishes about fees: 1/5

drata.com/plans and drata.com/pricing show only tier names and 'Contact Sales'/'Get Started' calls to action with no dollar figures anywhere on the site.

### Knowledge of your sector: 4/5

Drata publishes named framework-specific modules covering DORA (financial services), FedRAMP/CMMC (US government/defense) and HIPAA (healthcare) alongside its core SOC 2/ISO 27001 automation.

### Independence from what it sells: 4/5

Drata's SOC 2 Type II and ISO 27001/27017/27018 certifications are standard independently audited attestations listed on trust.drata.com, but its ISO 42001 announcement does not name the certification body, making that specific claim less independently verifiable.

### Who carries the risk if the advice is wrong: 5/5

Drata's public Subscription Agreement (drata.com/terms) states a 99.9% service-availability SLA and caps liability at fees paid in the prior 12 months, with named indemnification carve-outs.

## Sources for Drata

Every line carries the page it was read on and the date it was checked.

- Corporate entity/jurisdiction
  - Source: https://drata.com/terms
  - Checked: 2026-07-17
- AI governance product scope
  - Source: https://drata.com/product/iso-42001
  - Checked: 2026-07-17
- Pricing disclosure
  - Source: https://drata.com/plans
  - Checked: 2026-07-17
- UK presence/government availability
  - Source: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/177288100436153
  - Checked: 2026-07-17
- Own certifications
  - Source: https://trust.drata.com
  - Checked: 2026-07-17

## What this provider publishes

Not published means we did not find it on the firm's own pages.

- Price: Not published
- Indemnity cover: Published
- Credentials: Published
- Independent accreditation: Published
- Client results: Published
- How it uses AI: Published

## Strengths

- Holds its own ISO/IEC 42001:2023 certification, announced within roughly two years of the standard's publication, alongside SOC 2 Type II, SOC 3, ISO 27001/27017/27018 and FedRAMP Class B
- Dedicated ISO 42001 product module links AI-specific risks directly to controls, ownership and evidence rather than treating AI governance as a generic add-on
- Publishes a numeric SLA (99.9% availability commitment) and a defined liability cap in its public Subscription Agreement
- Named customer case studies with quantified outcomes (e.g. Instacart '375 hours saved', EAB '$20M Trust Center influenced revenue')

## Things to check

Each one carries the factual basis it rests on.

- Drata does not publish the certification body or exact scope/date of its ISO/IEC 42001:2023 certification beyond a blog post stating it came 'less than two years' after the standard's publication, making independent verification harder than for vendors who name their auditor.
  - Basis: drata.com/blog/announcing-iso-42001-certification does not name the certification body or exact certification date/scope in the published content.
- Its plans page gives no prices. You need to contact sales for a quote.
  - Basis: drata.com/plans shows six tiers (three per product line) with no dollar amounts, only demo/contact-sales calls to action.

## Where this firm appears

- [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking)
- [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed)
- [How do you change your data protection provider?](https://theassurancedesk.com/best/switching-provider)
- [Compare providers](https://theassurancedesk.com/compare)

---

**Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in.

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.

**Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.