Drata Subprocessors List (September 2026): Changes and History

Drata names 52 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 26, 2026 Official source ↗

Drata subprocessors (September 2026)

# Subprocessor Purpose Location Data
1 Algolia Algolia is a hosted search and discovery platform designed to help add fast, relevant, and scalable search functionality to the user experience. United States Uploaded content to the platform, such as questionnaires, compliance reports, descriptions, and other elements in the platform.
2 Amazon Web Services (AWS) Amazon Web Services is a cloud service provider that stores, transmits, and processes all customer data. Customer databases, uploaded objects, and application servers are hosted a customer-specified region where these services are offered. United States, Ireland, Germany, Australia All Customer Data.
3 Amplitude Amplitude provides product usage analytics to help track user interactions, behavior, and engagement for the purpose of improving the user experience. United States User interaction data, such as event data (e.g., clicks, page views, and feature usage), device and browser information, IP addresses, user identifiers, location data (if enabled), and custom properties to analyze user behavior and engagement.
4 Apideck [Opt-in] If configured by a customer to integrate with a customer's cloud storage services, Apideck facilitates interactions with the configured cloud storage services to support operations such as retrieving storage files, shared drives, downloading files, converting file formats, and handling user sessions and connections to cloud services. Germany Details about files stored in cloud services, including file names, sizes, types, and metadata., Information about user sessions, including session creation and management., Details about connections to cloud storage providers, such as connection status and metadata., Information about shared drives, including drive names and metadata., Data related to file conversion operations, including source and target formats.
5 Basedash BaseDash is a data management platform used to view, edit, and manage database records through a secure interface. It allows authorized team members to safely interact with production data for operational or support purposes without direct database access. United States All Customer Data stored in databases.
6 Bird Bird provides a cloud communications platform that enables the sending of messages and notifications within the platform, enabling features like live updates and instant notifications. United States User data such as user identifiers (user name, email), message content (message text and multimedia), and contact information (contact_id, name, address)., Company data, including account information (account_id, company_name, company_domain), message metadata (message_id, timestamp, status, delivery_reports), and integration metadata (api_key, webhook_url, webhook_secret).
7 Birdie Birdie is used to capture and share customer issues and feedback as part of handling customer support requests and issues and is used to track and reproduce issues reported by customers. Birdie is used in association with the use of Intercom in customer interactions. United States Data included in customer feedback and reported issues, including screenshots or video recordings to provide visual context for reported problems., Authenticated user and supporting user session information.
8 Braintrust [Opt-in] If AI-powered features are enabled by the Customer in the platform, Braintrust (braintrust.dev) provides an AI observability and evaluation platform that enables Drata to log, monitor, and evaluate AI workflows (such as prompts, model outputs, and tool calls). Drata uses Braintrust to run experiments and evaluations on AI features, detect quality or regression issues, and improve the reliability, safety, and performance of AI functionality. United States, European Union AI trace and evaluation data from AI features, such as model inputs and outputs (prompts, responses, tool-call parameters) and related metadata (trace IDs, timestamps, model/provider identifiers, token counts, latency, cost, and error information)., Evaluation datasets, reference answers, scores, reviewer comments, and limited user and account context (internal user IDs, account IDs, environment identifiers)., Customer Data (including Personal Data) appearing in inputs, outputs, or evaluation datasets.
9 Browserbase, Inc [Opt-in] If AI-powered features are enabled by the Customer in the platform, Browserbase, Inc. provides cloud browser infrastructure that enables Drata's AI agents to perform browser-based tasks on behalf of the Customer, including automated evidence collection and navigation of web-based systems within the Customer's environment. Europe, United States, APAC Information accessed during browser sessions initiated by Drata's AI agents, which may include screenshots, extracted web content, and data encountered while navigating the Customer's connected systems.
10 Census Census enables data synchronization by connecting business data sources to various other business tools for analysis, automation, and personalization. Census is used as a reverse ETL tool to sync data from data warehouses to various business applications. United States All Customer Data in structured databases.
11 Chameleon Chameleon provides in-product digital adoption, user engagement micro surveys, and product awareness and onboarding activities, enabling the creation of personalized experiences. United States User identification (such as user ID and email), interaction data (such as clicks, hovers, and form submissions within the Chameleon surveys and UI elements), survey responses (such as answers to microsurveys embedded in the Drata application), page views (such as URLs and timestamps of pages where Chameleon elements are displayed), and session data (such as session duration, start and end times, and navigation paths.
12 Cloudflare Cloudflare provides content distribution, security (WAF, etc), abuse prevention, and DNS services for web traffic transmitted to and from the Services. Global - Nearest edge server to the end-user., Local (Cloudflare routes traffic to worldwide data centers closest to the user's location)., United States (Logging) End-user http logs, including request data (such as HTTP method, URL, headers, and query parameters), response data (such as status codes, response headers, and body size), timing Information (such as request and response timestamps, and latency), and client Information (such as IP address, user agent, and geolocation data).
13 Courier [Opt-in] If configured to integrate with a customer's notifications channels (such as email, Slack, Teams, etc.), Courier facilitates the notification infrastructure that enables the sending of multi-channel messages to users. United States Integration configuration data, recipient information (such as username, email address, Slack user ID, Microsoft Teams user ID), notification content (such as message body, subject line (for emails), notification templates, and attachments (if any)), metadata (such as timestamps (creation, sending, delivery), notification status (sent, delivered, failed), event triggers, delivery methods (email, Slack, Teams), and preferences (such as user notification preferences (channels, frequency), and opt-in/opt-out status).
14 Datadog Datadog provides cloud monitoring and observability services, enabling the tracking and analyzing of application performance, infrastructure, and logs for debugging, troubleshooting, auditing, and reporting. United States Timestamp, email address, user agent, username, account ID, user ID, name, IP address, application paths and parameters, session IDs, integration connections data, ticket data, agent data and other types of data from the use of the platform.
15 dbt Labs GetDBT provides a platform for data transformation, modeling, and analytics, allowing the build, test, and deploy of SQL-based data models within the data warehouse. Transformation and Modeling United States All Customer Data (such as source data from the data warehouse) and transformed data (such as processed data resulting from transformations, aggregations, and joins).
16 Decodable Decodable is a real-time data streaming and processing solution and is utilized as an ETL solution to synchronize structured data from platform databases to data warehouses. United States Tenant information (such as tenant_id, tenant_name, tenant_database), database changes (such as table_name, operation_type, changed_columns, timestamp), schema Information (such as schema_name, column_definitions) from tenant databases.
17 Fivetran Fivetran offers real-time data streaming and processing solutions. Drata utilizes Fivetran as an ETL solution to synchronize data from Drata's business information systems to Drata's data warehouse. United States Tenant information (such as tenant_id, tenant_name, tenant_database), database changes (such as table_name, operation_type, changed_columns, timestamp), schema Information (such as schema_name, column_definitions) from tenant databases.
18 Flatfile [Opt-In] For customers who wish to bulk import data from CSV or Excel, Flatfile is used to enable administrative users in both Drata and SafeBase platforms to import data such as accounts, account members, controls, risks, and other data into these platforms. United States All data intended to be uploaded by customers.
19 Front Front offers a collaborative inbox platform that helps customer success team members manage customer communications across multiple channels in a unified customer messaging platform. United States Email content, message metadata (e.g., sender, recipient, timestamps), customer profiles (e.g., name, contact details, communication history), and any attachments or files exchanged during customer interactions.
20 Google Cloud Google Cloud Platform is a cloud service provider that stores, transmits, and processes all customer data. Customer databases, uploaded objects, and application servers are hosted a customer-specified region where these services are offered. Cloud-based email provided by Google is also used for customer emails and correspondence with customers. United States All Customer Data.
21 Intercom Intercom offers a customer messaging platform that helps manage customer support, engagement, and communication across multiple channels. These elements are used to manage and analyze customer interactions, ensuring efficient support and communication. United States Data included as part of customer interactions, such as name, email, company, and user-reported issue context data.
22 Jam.dev [Opt-in] If used by a Customer to report an issue in the platform, Jam.dev allows customers to capture relevant UI and report feedback and issues in order to provide Drata's customer success and engineers with the necessary context for troubleshooting and resolution. United States Data included in customer feedback and reported issues may include screenshots, console logs, browser and session metadata, reproduction steps, and optionally short video recordings, all of which may include user context. Jam.dev does not capture credentials, authentication token, or other sensitive data elements.
23 Knock [Opt-in] If configured to integrate with a customer's notifications channels (such as email, Slack, Teams, etc.), Knock facilitates the notification infrastructure that enables the sending of multi-channel messages to users. United States Integration configuration data, recipient information (such as username, email address, Slack user ID, Microsoft Teams user ID), notification content (such as message body, subject line (for emails), notification templates, and attachments (if any)), metadata (such as timestamps (creation, sending, delivery), notification status (sent, delivered, failed), event triggers, delivery methods (email, Slack, Teams), and preferences (such as user notification preferences (channels, frequency), and opt-in/opt-out status).
24 LaunchDarkly LaunchDarkly is a feature flagging and experimentation platform that enables the control and test of features and adoption. United States User engagement and interaction data (such as username, email, and name), custom attributes (such as user-specific attributes like role, subscription_level, and other custom fields), IP address (for identifying user locations and managing targeting rules), and device information (such as details about the user's device, such as browser, OS, and device_type)., Company data including account information (such as company-specific identifiers like company name and domain), and usage metrics (such as data on feature flag usage).
25 Leen [Opt-in] If configured to integrate with a customer's security SaaS integrations, Leen processes, stores, and transmits various data elements synced from these integrations with security SaaS providers. United States User data such as user identifiers (user name, email, name), authentication data (OAuth tokens, API keys), custom attributes (user roles, permissions), account information (account_id, company_name, company_domain), security data (vulnerability findings, compliance status, risk assessments), integration metadata (provider_id, connection_status, last_sync_time), and configuration data (API endpoints, credentials, integration settings.).
26 Liveblocks [Opt-in] For customers who choose to use the chat-style collaboration in the platform, Liveblocks provides a real-time collaboration capability that enables features like multi-user editing, commenting, presence indicators, and notifications within our platform, and processes user interaction data to synchronize shared states across users, facilitating seamless collaborative experiences. United States Message content and reactions for collaboration features across our platform, including user IDs and emails.
27 Matia Matia.io provides a unified DataOps platform, including data ingestion, observability, cataloging, and reverse ETL. Drata utilizes Matia.io as a sub-processor for both data management and reverse ETL, enabling the synchronization of processed platform and business data into operational systems for enhanced automation and decision-making. United States All Customer Data.
28 Merge [Opt-in] If configured to integrate with a customer's HRIS SaaS integrations, Merge provides Drata with a unified API that allows the Drata Platform to integrate and sync data across multiple HR, finance, and productivity platforms. United States User data such as user identifiers (user name, email, name), employment details (employee_id, job_title, department, manager_id), contact information (phone_number, address), and custom attributes (custom fields defined by the user, such as personal_email, group_type)., Company data, including account information (account_id, company_name, company_domain), HR data (employee records, payroll information, benefits data), integration metadata (provider_id, connection_status, last_sync_time), and configuration data (API endpoints, credentials, integration settings).
29 Okta Auth0 (by Okta) provides identity and access management services used to authenticate users and manage secure access to our applications. It enables features such as secure login, multi-factor authentication, user role management, and single sign-on (SSO), helping ensure secure and compliant user access. United States Email address, user names, and names needed for identification and login.
30 Omni To create reporting and analytics views of data within the platform, including executive-level dashboards, self-service custom reporting, and anonymized industry benchmarking, for platform users. United States Data input to the platform to generate reports and dashboards configured by the customer.
31 OpenAI OpenAI provides language processing services used to generate text, analyze content, and support conversational and automation features within our platform. It processes user-provided input to deliver AI-powered responses and assistance for LLM capabilities and security questionnaire answering capabilities in AIQA. United States Data included in user inputs from the user-configured knowledge base and selected documents for questionnaire answers, such as text input (which may contain names, emails, or other identifiers), IP address, and browser/device info
32 Postmark Postmark provides transactional email delivery services used to send system-generated emails from the platform and helps ensure reliable and secure email delivery to users. United States Email addresses, recipient name(s), email content and metadata (e.g., subject, timestamps, email headers)
33 Productboard Productboard provides a product management platform that helps businesses collect customer feedback, prioritize features, and align product roadmaps. ProductBoard is integrated into the platform to enhance product management by allowing customers to submit product ideas, vote on existing ideas, and view the roadmap directly within the platform. United States User data such as user identifiers (username, email, name) and feedback data (comments, votes, and suggestions submitted by users), company data such as account information (account_id, company_name, company_domain), and product suggestion data (feature requests, product ideas, and roadmap items).
34 Reducto [Opt-in] Reducto is used to process user-uploaded documents (e.g., questionnaires, raw documents, policies, third party attestations, reports, etc. ) and return structured outputs to support AI features such as automation and document parsing. United States Uploaded documents (e.g., questionnaires, raw documents, policies, third party attestations, reports, etc.), request metadata including IP address, browser user agent, referrer, cookie data and link data.
35 Retool Retool is a platform used to build internal tools that interact with our databases and APIs. It allows authorized team members to securely view, manage, and update data through custom user interfaces for operational and administrative purposes. United States All Customer Data.
36 Salesforce Salesforce Service Cloud provides customer support and case management services used to handle user inquiries, track support requests, and manage customer interactions. It helps deliver efficient and personalized support through centralized communication and case tracking. United States Name, email address, phone number, support messages and attachments, case history and interaction logs, and data elements used for the integration with Trust Center.
37 Sigma Computing Sigma is a business intelligence and data analysis platform used to connect, analyze, and visualize data from various sources. It allows users to create interactive dashboards, generate reports, and collaborate on data insights for better decision-making. United States All Customer Data used to power dashboards and visualizations in the platform.
38 Snowflake Snowflake provides a cloud-based data platform that stores, processes, and analyzes data securely, supporting scalable data warehousing, sharing, and analytics. Snowflake is used as the centralized data warehousing solution to store, manage, and analyze large datasets. United States All Customer Data.
39 StackOne [Opt-in] If configured to integrate with a customer's SaaS integrations, StackOne provides a unified API that allows the integrations with and syncing data across multiple SaaS systems to pull users for user access reviews and security training systems for tracking completion of security awareness trainings. United States User data such as user identifiers (user_id, email, name), role data (system role(s)), and activity data (user actions, login timestamps, training completion date)., Company data such as account information (account_id, company_name, company_domain) and integration metadata (API keys, client IDs, configuration settings).
40 Stripe [Opt-in] For customers who wish to use payment processing within the platform, Stripe provides payment processing services used to securely handle transactions, manage subscriptions, and store customer billing information. It enables the acceptance of online payments and ensures compliance with financial and data security standards. — Name, email address, billing address, payment details, IP address, transaction history
41 SurveySparrow SurveySparrow provides an omnichannel survey platform that enables the collection, analyzing, and management of customer and employee feedback. SurveySparrow is used to collect and manage customer feedback, particularly through Net Promoter Score (NPS) surveys. The integration involves embedding SurveySparrow widgets within the platform to gather user feedback efficiently. United States User data such as identifiers (user IDs, email addresses, and names), and survey responses (answers to survey questions, including text, choices, ratings, and other input types)., Usage data, such as interaction data (information about how users interact with surveys, including timestamps and completion status) and device information (metadata like IP addresses, browser types, and operating systems).
42 Svix Svix provides webhook infrastructure used to reliably send event notifications from our systems to external services. It ensures secure delivery, retries, and monitoring of webhook messages across integrated platforms. United States Email, user ID (if included in payload), event-related data (dependent on webhook content), IP address, message metadata (e.g., timestamps, delivery status)
43 Totango Totango (dba Catalyst Software) supports customer success management and analytics solutions, helping track user engagement, manage customer relationships, and optimize retention. United States Customer Information, including names, contact details, and company information; data related to compliance frameworks such as SOC 2, NIST CSF, and HIPAA; logs of calls, customer interactions, advisory sessions, customer questions, and issues.
44 tray.ai [Opt-in] If configured to integrate with a customer's instance of HubSpot, Tray provides workflow automation services used to integrate and automate data flows between the platform and customer's instance of HubSpot. It helps streamline operations by enabling secure, no-code data synchronization and process automation. United States Data fields passed between the platform and HubSpot (which may include email address and user name), IP address, workflow metadata (e.g., execution logs, timestamps)
45 Turbopuffer, Inc. [Opt-in] If AI-powered features are enabled by the Customer in the platform, Turbopuffer, Inc. provides vector search and storage infrastructure that enables Drata to index, store, and retrieve document embeddings and content to power semantic and full-text search capabilities across Drata's AI-enabled features. United States, European Union, Australia Document chunk text and associated vector embeddings generated from customer content, along with metadata such as document identifiers, labels, and chunk references.
46 Twilio Twilio (dba Segment) provides a customer data platform (CDP) that enables the collection, cleansing, and routing of customer data to various tools for analytics and product usage. United States Identifiers include userId, a unique identifier for each user, and anonymousId, used when a user is not logged in., Behavioral data consists of events, which track actions performed by users such as clicks, page views, and form submissions, along with properties that provide additional context like button names or page titles., Device information includes the IP address, captured for geolocation and security purposes, and the user agent, which provides details about the user's browser and operating system.
47 Typeform Typeform provides an online form and survey platform that enables the creation, collection, and processing of responses to vendor risk management security questionnaires and employee responses to security training. United States, Germany User data includes identifiers such as userId (unique identifier for the user) and email (user's email address), along with responses to form questions, which may include text, multiple-choice selections, and file uploads., Metadata such as submission timestamps and user agent details are also captured., Company data includes identifiers like accountId (unique identifier for the company account) and companyName (name of the company), as well as company-specific responses, such as compliance status and security practices., Additionally, other fields like accountId, company, and trackingId are pre-filled to associate responses with specific accounts.
48 Vellum [Opt-in] Vellum is a platform for development and management of large language model (LLM) applications and tools for prompt engineering and performance monitoring. Drata uses Vellum to enhance its AI capabilities, particularly for automating and summarizing security questionnaires, SOC 2 reports, and for other AI capabilities within the Drata platform. Users must opt-in to use these features. United States Answers to security questionnaires; uploaded documents (e.g., SOC 2 reports); questions posed by users with access to query the knowledge base
49 Vigo Engineering Inc. dba Prequel [Opt-In] For customers who wish to sync data between Drata and SafeBase platforms to their own data stores, Prequel is used to facilitate this data sync between customer data in Drata and SafeBase databases and customer databases. This feature is part of the Data Warehouse Sync feature, which allows customers to sync key data (e.g., Accounts, Access Requests, and event data like Status Page Viewed) to their customer data warehouses such as Snowflake, BigQuery, Redshift, S3, and others. Prequel's platform reads data from the source and writes it to the destination using an ephemeral server. No data remains on Prequel's platform. United States All Customer Data configured by the customer to sync with customer data stores using this service.
50 Wiz Wiz DSPM (Data Security Posture Management) helps Drata secure data by continuously monitoring and assessing Drata's data security posture, identifying vulnerabilities, misconfigurations, and compliance risks across cloud environments that host data elements, and provides remediation suggestions. This capability continuously monitors for sensitive data and secrets exposure and proactively eliminate attack paths to help protect data in Drata's platform. United States All Customer Data.
51 WorkOS [Opt-in] If configured to integrate with a customer's SSO provider(s), WorkOS facilitate Single Sign-On (SSO) for its customers' users. United States User data includes identifiers such as userId (unique identifier for each user) and email (user's email address), along with authentication data like SSO tokens, session identifiers, and user roles and permissions., Metadata captured includes login timestamps, IP addresses, and user agent details., Company data includes identifiers like organizationId (unique identifier for each organization) and domain (company's domain name), along with SSO configuration data such as SAML and OAuth settings, connection status, and configuration details., Additionally, metadata includes organization creation and update timestamps, as well as webhook events for user provisioning and deprovisioning.
52 Zapier Zapier provides workflow automation services used to connect and automate tasks between different applications. It enables secure data transfers and process automation across tools based on defined triggers and actions. This is used by SafeBase customer support to receive notifications when customers need assistance or perform certain activities. United States Email address or user ID (if included in workflows), customer support request context included in the notification, and data fields included in the notification or transfer between applications.

Get an email when Drata changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Drata free

Documents we track for Drata

Subprocessor list
checked September 26, 2026 trust.drata.com ↗

Change history

Tracking since September 26, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Drata subprocessors FAQ

How many subprocessors does Drata use?
Drata lists 52 subprocessors on its published list, including Algolia, Amazon Web Services (AWS), Amplitude, Apideck, and Basedash and 47 more.
Where does Drata process customer data?
The subprocessors named by Drata are located in United States, Germany, Australia, European Union, APAC, and Europe and 4 other locations, as stated on its list.
When was Drata's subprocessor list last checked?
ClauseTrail last checked Drata's subprocessor list on September 26, 2026. Lists are re-checked daily.
How do I find out when Drata adds or removes a subprocessor?
ClauseTrail monitors Drata's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.