Tier and headcount
Foundation is capped at 50 full-time employees, so crossing that line moves you to Advanced regardless of how many frameworks you run.
Pricing guide
Drata pricing: what it actually costs
Drata does not publish a price list. This guide sets out what Drata does publish, what moves a Drata quote, the figures on the public record, and the costs that sit outside any licence.
Drata does not publish prices. Its plans page names three compliance tiers — Foundation, Advanced and Enterprise — and lists additional frameworks as an add-on on all three. The procurement platform Vendr reports a median of $24,934 a year across Drata purchases it has data on. The audit is a separate cost: Drata runs a directory of audit partners, and its own SOC 2 cost guide prices the auditor's fee separately from the platform.
Last checked against Drata's public pages on .
What Drata publishes
Drata's plans page lists three compliance tiers without figures and routes buyers to sales. The only size limit it states is on Foundation, which is described as covering up to 50 full-time employees.
Trust Center and AI questionnaire assistance are tiered on the same names, and third-party risk management is sold as a separate offering. Additional frameworks, user access review, Risk Management Pro and custom frameworks appear as add-ons depending on tier.
| Tier | How Drata describes it |
|---|---|
| Foundation | Up to 50 full-time employees and one pre-mapped framework, chosen from SOC 2, ISO 27001, Cyber Essentials, HIPAA or GDPR. AI questionnaire assistance covers 10 questionnaires. |
| Advanced | Any available framework, plus custom connections, tests and fields. Unlimited AI questionnaire uploads. |
| Enterprise | Adds Risk Management Pro, Compliance as Code Pro and user access review. |
The figures on the record
Every figure on this page, with who published it and the date we read it. Third-party procurement figures describe other buyers' contracts, not a quote for yours; audit estimates are the audit firm's fee, not the platform's.
$24,934 a year (median)
Vendr's median annual contract value for Drata, based on data from 236 purchases, with a reported range of $9,415 to $68,250. Vendr's page states it was last updated in February 2026.
Source: Vendr, observed
$7,500 to $15,000 for a SOC 2 Type 1 audit
Drata's own estimate of the auditor's fee for a small or midsize company's Type 1 report. Drata puts a Type 2 for the same companies at $12,000 to $20,000. These are audit-firm fees, not Drata's.
Source: Drata, observed
What moves the bill
The variables a Drata quote is built from, as Drata describes them.
Number of frameworks
Foundation includes one pre-mapped framework from a short list. Drata lists additional frameworks as an add-on on every tier, so each standard you add is a line to price.
Trust Center and questionnaires
Trust Center tiers are limited by approved domains, and AI questionnaire assistance is capped at 10 questionnaires on Foundation. Extra domains and questionnaires are listed as add-ons.
Separate offerings
Third-party risk management is sold separately from the compliance tiers, and an agentic TPRM assessment is listed as an Enterprise add-on. Risk Management Pro and user access review are add-ons below Enterprise.
Costs outside the licence
The platform fee is rarely the whole cost of a compliance programme. Budget for these whichever platform you choose.
The audit itself
Drata runs an Audit Alliance directory of pre-vetted audit firms and includes an Audit Hub for working with your auditor, but does not state on its own pages that audit fees are included. Drata's SOC 2 cost guide prices the auditor's fee separately from the platform.
Penetration testing
Most SOC 2 and ISO 27001 programmes commission at least one external penetration test a year, and enterprise buyers increasingly ask for the summary. It is a separate engagement unless a quote explicitly bundles it.
Your team's time
Someone owns the programme: writing and approving policies, closing control gaps, answering the auditor and keeping evidence current between audits. Automation shrinks that work but does not remove it, and it is usually the largest cost that never appears on an invoice.
Switching later
Evidence collected from your own systems can be re-collected by another platform; policies, risk registers and audit history need exporting. Ask how exports work before you sign, because the cost of leaving is part of the cost of joining.
Questions to put in the quote request
Which frameworks are included at the price quoted, and what does each additional framework cost?
What headcount, entity or connected-system limits does the quote assume, and what happens when we cross them?
Which line items are add-ons — questionnaire automation, trust center, vendor risk, access reviews, AI features?
Is the audit included? If so, which firm, which report types, and how many audit cycles?
What is the renewal cap, and is it in the order form?
Where is our data hosted by default, and is an EU region included or extra?
Can we export policies, evidence and audit history in a usable format if we leave?
How Noru is priced
Noru does not publish a price list either, and there is no self-serve sign-up. Every deployment includes the platform — one control library mapped across 30+ frameworks, continuous evidence from 20+ integrations, Cortex AI grounded in your programme, EU data residency, role-based access control, a DPA and an SLA — and you license the capability packages your obligations require on top.
Each package is priced per deployment by the scope it governs: Compliance & Audit by the frameworks in scope and the size of your workforce, Privacy Automation by the systems connected and the processing activities in scope, AI Governance by the AI systems under governance, and Third-Party & Supply Chain Risk by the vendors under management. You get a written quote after a demo that itemises each one.
Noru is not an audit firm. Your auditor's fee is a separate contract whichever platform you pick; Noru's job is to have the evidence collected and mapped before the auditor asks for it.
How much does Drata cost?
Drata does not publish prices; its plans page routes buyers to sales. The nearest public reference is Vendr, which reports a median of $24,934 a year across 236 Drata purchases with a range of $9,415 to $68,250 — other buyers' contracts, not a quote for yours.
Does Drata charge per framework?
Drata's Foundation tier includes one pre-mapped framework, and its plans page lists additional frameworks as an add-on on Foundation, Advanced and Enterprise. Ask for each framework to be itemised in the quote.
Does Drata's price include the audit?
Drata does not say so on its own pages. It runs a directory of audit partners and an Audit Hub for working with them, and its SOC 2 cost guide treats the auditor's fee as a separate cost — $7,500 to $15,000 for a smaller company's Type 1 report, by Drata's estimate.
Is Noru cheaper than Drata?
Neither publishes a price list, so there is no honest headline answer. Noru licenses the platform plus the capability packages your obligations require, priced per deployment by the scope you run. Book a demo for a written quote and compare it line by line with Drata's.
Primary sources
Every claim about Drata on this page comes from the public pages below, last checked on . Competitor products and prices change — if something here is out of date, tell us and we will correct it.
Get a written quote to compare
We walk the platform against your obligations, agree the packages and scope, and send a written quote — or tell you Noru isn't the right fit.