Menu
SafeBase by Drata SOC 2 compliance software
SafeBase operated as an independent trust-center vendor from its 2020 founding until Drata acquired it for $250M in February 2025.
Drata acquired SafeBase for $250M in a deal announced February 11, 2025 and expected to close later that month (TechCrunch, PRNewswire, SecurityWeek). SafeBase's trust-center and AI-questionnaire products are now marketed under Drata's own product names (Trust Center, AI Questionnaire Assistance); the safebase.io marketing site now 301-redirects to drata.com, though existing customers still sign in at app.safebase.io.
By Peter Korpak, Lead Editor · independently researched · Methodology
- Pricing
- Quote-based
- Source-checked frameworks
- 1
- Integrations
- Not published
The safebase.io marketing site now 301-redirects to drata.com, and the product is sold under Drata's own naming ('Trust Center', 'AI Questionnaire Assistance'), while some customer-facing trust pages (e.g. Okta's, Novata's) still display the footer line 'SafeBase by Drata' and existing customers sign in at app.safebase.io. A genuine limitation: published self-serve pricing disappeared after the acquisition (Drata funnels prospects to a demo/contact-sales flow), and we could not independently verify current G2 review volume because g2.com blocked automated access and the g2.com/sellers/safebase page (visible via search snippet) shows 0 reviews while the separate g2.com/products/safebase/reviews pros-and-cons page implies existing reviews -- a discrepancy a human should resolve directly on G2.
SafeBase raised a total of $53.1M from investors (most recently a Series B led by Touring Capital in April 2024) before Drata acquired it for $250M in February 2025 (TechCrunch, Feb 12, 2025; Touring Capital exit post). It has not raised independent funding since the acquisition.
What SafeBase by Drata does.
Seven capabilities, graded the same way for every platform in the directory. "Not established" means we looked and could not confirm it, not that the feature is missing.
| Capability | Status | Evidence |
|---|---|---|
| Automated evidence collection | No | Trust Center shares existing documentation; automated evidence collection from connected systems is Drata's separate Compliance Automation product, not this one. Source |
| Auditor workspace | No | Built as a prospect/customer-facing self-serve portal, not an auditor evidence-request workspace. Source |
| Trust center | Yes | Source |
| Security questionnaire answering | Yes | Sold as 'AI Questionnaire Assistance': drafts responses to inbound security questionnaires from approved trust content. Source |
| Enterprise admin (SSO, SCIM, RBAC) | Not established | SSO/SCIM/RBAC for the Trust Center module specifically is not established from primary sources; we do not infer it from claims about Drata's core compliance product. |
| SCIM 2.0 provisioning | Not established | |
| Continuous control testing | No | Trust Center is a document/status-sharing portal, not a recurring automated control-test engine; that function lives in Drata's Compliance Automation product. Source |
| Native multi-framework support | Not established | Not directly applicable in the compliance-automation sense; Trust Center surfaces reports across frameworks rather than running native vs. crosswalk-mapped control tests. |
SafeBase by Drata uses quote-based pricing.
Getting a direct number requires a sales conversation. Anything below comes from reported quotes or marketplace listings, and is labeled as such.
- Disclosure model
- Quote-based
- Sourced annual price
- None found
- Basis
- Estimate, 2026-07-24
Software pricing alone does not establish the audit fee. A licensed CPA firm issues the SOC 2 report. A commercial offer may package coordination or the fee, so get the legal provider, deliverable, and amount in writing. See the SOC 2 audit cost guide for scope and budget context.
Who actually issues the report.
SafeBase/Trust Center does not perform or issue SOC 2 examinations. It is a distribution and questionnaire-response layer that publishes a company's own auditor-issued SOC 2 report and other security documentation to prospects and customers; the underlying audit is still performed by an independent CPA firm, separate from this product.
Software prepares you for the audit; a licensed CPA firm performs it and issues the report. If you have not picked a firm yet, we list independent SOC 2 auditors separately, and we are not one of them.
1 frameworks checked individually, and how well each is established.
A framework on a marketing page is a vendor claim, not a confirmed capability. We grade the difference rather than repeating the list.
| Framework | Evidence | Note |
|---|---|---|
| SOC 2 | Vendor-claimed | Trust Center is described as a self-serve destination for security/compliance reports (SOC 2 among them); it distributes an existing report rather than producing one. Source |
Who SafeBase by Drata is for, and who it is not.
Good fit
A company already running (or planning to run) Drata for SOC 2/ISO evidence collection that wants its trust center and questionnaire response bundled with the same vendor relationship.
Poor fit
A company that wants an independent trust-center vendor with no ties to a single compliance-automation platform, or one that needs current published self-serve pricing rather than a quote-only enterprise sales motion.
Typical buyer: B2B SaaS companies, especially enterprise-selling ones, that need a public or gated self-serve security page to speed up buyer security reviews..
Compare SafeBase by Drata with three alternatives.
- Comp AI Sponsored
An engineering-led company that values an inspectable, self-hostable compliance platform and wants one vendor scope that can include guided implementation, a trust center, penetration testing, and audit coordination when quoted.
-
A company with an existing SOC 2 report that is spending significant sales-engineering or security-team time re-answering the same questionnaire content on every deal.
-
Teams running a formal, recurring third-party risk program (20+ questionnaires a month or enterprise governance pressure) who also want a trust center to share their own SOC 2 report and answer inbound customer questionnaires from the same platform.
Where every figure on this page came from.
6 sources, each with what it establishes and when we read it. If a claim here is out of date, this is the list that tells you which one to re-check.
- Drata acquired SafeBase for $250 million; SafeBase co-founders Al Yang (CEO) and Adar Arnon (CTO) retain their roles and SafeBase continues as a stand-alone product line while its core solutions come to Drata's platform. https://techcrunch.com/2025/02/12/security-compliance-firm-drata-acquires-safebase-for-250m
- Official announcement dated Feb 11, 2025 that Drata entered a definitive agreement to acquire SafeBase, expected to close later that month. https://www.prnewswire.com/news-releases/drata-to-acquire-safebase-accelerating-trust-management-within-enterprise-governance-risk-and-compliance-302373262.html
- Drata CEO's account of the acquisition rationale; states SafeBase has driven $15B in transactions tied to security teams using its Trust Centers over four years, with customers including OpenAI, Twilio, CrowdStrike, LinkedIn, SentinelOne. https://drata.com/blog/acquiring-safebase
- Corroborates the $250M deal, SafeBase's 2020 founding, 1,000+ customers, and $53.1M raised before acquisition. https://www.scworld.com/brief/drata-acquires-safebase-for-250m
- Current page describing SafeBase's Trust Center and AI Questionnaire Assistance as part of Drata's product suite; footer links to a separate 'SafeBase Help Center' and 'SafeBase System Status'. https://drata.com/safebase
- Confirmed via direct crawl that safebase.io issues a 301 redirect to drata.com, i.e. no independent marketing site remains. https://safebase.io/
4 facts on this page we could not establish.
Everything above renders with its evidence state, so a gap is visible rather than quietly filled in. If you work at SafeBase by Drata, send us the sources and we will fill them.
Verification is free and always will be. It does not change where SafeBase by Drata appears in any list on this site, what our reviews conclude, or which platform we recommend to a buyer. We only accept a correction that comes with a source we can check ourselves, and the source is published in the ledger above alongside the date.