Vendor profile
Drata: where is customer data stored and processed?
Drata stores and runs customer data in several countries, mainly via AWS in Ireland, Germany, the USA and Australia, where the customer can choose region. For customers outside the EU/EEA, transfer to the USA and Australia applies under SCC. AI features are partly handled by Turbopuffer in Europe (country not stated) and OpenAI in the USA. Login is handled by Okta (Auth0), support by Intercom, notifications by Postmark and usage analytics by Amplitude, all with the USA as the stated location. The data processing agreement has been read but does not state where data is stored. The most important gap is the location of backup, identity, support and notifications in the material read.
Checked 13 October 2026 · based on the vendor's own public documents
See the map and sources
Where data is stored and processed
| Activity | In the EU/EEA | Outside the EU/EEA |
|---|
| Storage | Ireland, Germany, Europe (country not stated) | –
Only for customers in other regions: USA, Australia |
|---|
| Processing | Ireland, Germany | –
Only for customers in other regions: USA, Australia |
|---|
| Login and user account | – | USA |
|---|
| Logs and telemetry | – | USA |
|---|
| Analytics and metadata | – | USA |
|---|
| Notifications and email | – | USA |
|---|
| Support | – | USA |
|---|
| AI features | Europe (country not stated) | –
Only for customers in other regions: USA |
|---|
Only outside the EU/EEA, with no European alternative stated: Logs and telemetry, Support, Notifications and email, Login and user account, Analytics and metadata.
Ownership and agreements
| Data processing agreement | Found and read |
|---|
| Certifications | SOC 2, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 42001, SOC 3 |
|---|
Sub-processors (50)
| Name | Country | Purpose |
|---|
| Algolia | USA | Søkeplattform |
| Amazon Web Services (AWS) | USA, Irland, Tyskland, Australia | Sky, lagring og drift av kundedata |
| Amplitude | USA | Produktanalyse |
| Apideck | Germany | Filtilgang i skytjenester (opt-in) |
| Basedash | USA | Databasevisning for drift og støtte |
| Bird | USA | Meldinger og varsler |
| Birdie | USA | Kundeproblemer og tilbakemeldinger |
| Braintrust | USA, EU | AI-observasjon og evaluering (opt-in) |
| Browserbase, Inc | Europa, USA, APAC | Skyleser for AI-agenter (opt-in) |
| Census | USA | Synkronisering av data |
| Chameleon | USA | Produktveiledning og undersøkelser |
| Cloudflare | – | Innholdslevering, sikkerhet og DNS (logging i USA) |
| Courier | USA | Varselinfrastruktur (opt-in) |
| Datadog | USA | Overvåking og logger |
| dbt Labs | USA | Datatransformasjon |
Sources