Drata, a security compliance automation platform that helps companies adhere to frameworks such as SOC 2 and GDPR, has acquired software security review startup SafeBase for $250 million.
SafeBase co-founders Al Yang (CEO) and Adar Arnon (CTO) will retain their roles, and SafeBase will continue to offer a standalone product while bringing its core solutions to Drata’s platform.
“This partnership isn’t just about combining complementary products,” Yang wrote in a post on SafeBase’s official blog Tuesday. “It’s a union of two customer-obsessed companies with aligned missions and cultures, focused on delivering the tools enterprises need to succeed.”
Yang and Arnon founded SafeBase in 2020 after meeting at Harvard Business School. Incubated by Y Combinator, the company helps customers fill out security questionnaires — the reviews that organizations normally kick off before purchasing a new piece of software.
SafeBase employs AI models specifically trained on security documentation use cases to read, interpret security information and questions, and then automatically respond to security questionnaires. Beyond the custom models, SafeBase provides an engine that allows a company to assign rules-based behavior for customer access, as well as dashboards that show insights and analytics on the company’s security posture.
SafeBase, which is headquartered in San Francisco, managed to raise $53.1 million in venture capital from investors including Zoom Ventures, NEA, and Comcast Ventures prior to its exit. According to Yang, SafeBase has over 1,000 customers today, including LinkedIn, Palantir, and CrowdStrike.
As Drata co-founder and CEO Adam Markowitz noted in a post on Tuesday, Drata’s acquisition of SafeBase comes as the demand for so-called trust management solutions rises. Cloud apps and AI have increased organizations’ reliance on third parties that have access to sensitive data. At the same time, new regulations like the Digital Operational Resilience Act in the EU are imposing new security requirements on vendors.
With SafeBase, Markowitz aims to create a “seamless ecosystem” of trust, governance, risk, and compliance offerings.
“Together with SafeBase, we’re more committed than ever to empowering our customers to build and scale trust, unlock growth, and achieve success,” Markowitz said in the blog. “Just in time for Drata’s fourth anniversary, this milestone marks the start of an exciting new chapter.”
Founded in 2020, Drata has grown rapidly over the years, securing well over $300 million in funding and acquiring over 7,000 customers including Notion and Tenable. It counts Iconiq Growth and Salesforce Ventures among its backers, in addition to Microsoft CEO Satya Nadella and former LinkedIn CEO Jeff Weiner.
Last year, Drata’s revenue grew 100% year-over-year, and the San Diego-based company said that it was adding 650 new customers each quarter. Drata also made its first acquisitions, snapping up governance and automation firm Harmonize.io in April and cloud security platform Oak9 in May.
A PR rep for Drata told TechCrunch via email that Drata is nearing $100 million in annual recurring revenue.
But the aggressive growth strategy hasn’t consistently paid off. Last September, Drata laid off around 40 people, or 9% of its workforce. At the time, the company alluded to “sustainable growth”; Drata’s headcount grew a whopping 52% from 2023 to last year.
