Is Drata safe with your data?

No model training

The terms state that Drata does not use Customer Data to train or fine-tune artificial intelligence or machine learning models, and that third-party inference providers are not permitted to do so either. Data sent to AI features is described as processed on a transient basis and not retained by the inference provider after a response is generated.

AI is off until an admin turns it on

AI features are available only if a customer enables them through administrative settings in the service, and can be disabled again at any time. Free-trial data carries an explicit warning that it is permanently lost unless the customer buys a subscription or exports it before the trial ends.

Retention stated without a number

The privacy notice says personal data is generally retained as long as necessary for the purposes it was collected for, naming no retention period. Customer data stays exportable for thirty days after termination, after which deletion follows a separate policy kept in the Trust Center rather than in the published terms.

Security described in general terms

The notice commits to appropriate security procedures and technical and organizational measures without naming specific controls such as encryption standards or access models. Against that, a security incident triggers notice to the customer within forty-eight hours, and a data protection officer is named with a postal contact.