Is Drata safe with your data?
Drata
Drata, Inc.
Partial disclosure · high confidence
Drata earns a C (63/100) because it discloses its data practices only in part.
#57
of 116 apps ranked
63
score · Security & compliance avg —
—
vs category average
Drata's controller-side privacy notice covers both CCPA and GDPR rights, with a named Data Privacy Framework certification, EU Standard Contractual Clauses, and a listed data protection officer address. It says nothing about AI training of user inputs because the notice expressly excludes Drata's products and customer data, and its retention language stays vague outside the California request windows. The score is at the upper end of C, held back by silent training-data indicators and an unquantified retention period.
What Drata's privacy policy says about your data
Full data subject rights
The notice grants access, deletion, correction, portability, objection, and restriction rights under both the CCPA and GDPR, exercisable through Drata's Privacy Center. The EEA section lists each right explicitly.
Named transfer safeguards
International transfers rely on EU Standard Contractual Clauses, the UK Addendum, and adequacy decisions. Drata states it has certified to the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks with the U.S. Department of Commerce.
Vague retention
Personal data is retained as long as necessary to fulfill the purposes for which it was collected. The notice gives no concrete day count or deletion timeline beyond the 30 and 45 day windows that apply only to California rights requests.
Opt-out of sale or sharing
Drata says it has not sold or shared data for money but treats advertising cookie exchanges as a potential sale or share under California law. It offers a Do Not Sell or Share link and honors opt-out preference signals at the browser level.
What the policy is silent or vague on
- Not stated: keeping user inputs out of model training
- Not stated: a way to opt out of training
- Not stated: whether training use differs by plan
- Not stated: your ownership of generated outputs
Drata privacy rating
Details
- Category
- Security & compliance
- Modalities
- text
- Processes biometrics
- No
- Policy last updated
- 2026-06-02
- Region scored
- Global / US-default
- Assessed
- 2026-06-20
Other security & compliance apps
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.