illud_tempus

> The Drata agent does exactly what you are talking about

Does it also name and shame? ;)

How does the agent know what user it is monitoring?

What other kinds of personal information does it process or collect, locally or in it's server endpoint?

An external IP address is personal information. A UUID identifying a block device is personal information. A hostname is personal information. Anything in "/usr/home" is personal information.

> The agent is read-only and has no capability to wipe a device, it is a read-only agent that we have security validated with a third party.

And you can change that over night, without notice to anyone not actively monitoring your platform for such messages.

Why is that your policy.

You expect a high level of trust. And still you engage in dark anti-patterns that nukes any kind of trust for anyone who know how to read.

> OP made a claim that Drata collects private employee info and resells it. That’s a large claim.

What I know is:

1) They collect mandatory private information. They already know my name and my email, and they used that information to ask me to complete some tasks on their website. I don't know what those tasks are, because I first have to accept their TOS, which contains clauses that is referred to, but not disclosed. I declined.

2) Their "webpage" is part of their service. This is where I supply personal information (presumably more than they already have). So unless they have another TOS, after I accept the publicly available one, that's the rules: I have to give them personal data, because my employer (well, in my case it's my customer, not my employer - Drata have no agreement with my employer) signed a contract with them.

3) They give themselves the right, in the websites TOS, to sell my data.

So: 1 + 2 + 3 = Drata collects private employee info and resells it.

> Why do you think it covers the data collected by the agent?

The agent is not the only concern. Before you even get to install the agent, you have to provide personal information to their website (I believe - I don't now, because I rejected the TOS and don't have access to the non-public part of their website).

The thing is - Drata collects mandatory information from their customers employees and contractors trough their website. The TOS for the website is explicit about how they plan to use that information.

> This is correct. The privacy policy listed here is for the website.

Is that the 100% honest answer?

From my understanding, your website is where you collect my mandatory personal information, if I agree with your TOS. It's not just a glossy brochure for your product - it is your product.

I cannot choose what I share with you. But you can choose with whom you share what information I provide. And from your websites TOS, you seem very eager to share it.

> You are 100% correct. > Source: I am the Drata CISO

May be you should go over your user agreement documents and:

1) Make sure that all relevant information is available, so a user can make an informed decision.

2) Distinguish between the user roles, and have different agreements for the different roles. One role is your customer. A second role is the employee of your customer. A third role is the contractor for your customer. A potential fourth role is the person(s) working for the customer that is responsible for dealing with personal and confidential information related to you, employees and contractors.

As of today, your user agreement is a mess, appearing as something you have copied and pasted together without much thought, except for how to cover your own asses. Including the ridiculed clause Microsoft is infamous for, warning that your software is unfit and unusable for any purpose.

Very informative. Thanks.

> We are happy to share our security validation report of the agent as well as the configuration with any prospects/customer.

I am the OP. I am not your customer. My customer is your customer. My customer wants me to install your agent.

When I contacted Drata on email with some concerns before I accepted your terms and conditions (which I will never accept in its current form) and got any real information about your agent, your secretary responded: "Feel free to reach out to your Drata administrator internally with concerns. Do note, that when your company contracted with Drata, any edits or redlines they provided will prevail for all employees of your company."

That is not very reassuring for a company (Drata) that want me to accept undisclosed terms and conditions, wants to sell my personal data to targeted marketing, reserves the right to change the user agreement over night, and who exploits a loophole in GDPR so you can move my personal data out of EU and do things with it that would be a crime in EU.

I interperate that reply, from your secretary, as: "We already sold our thing to your company, so we don't care. Not about you. Not about your company. Bend over and take it like a good bitch!"

As others have suggested here; if you want people to trust your agent, you should open source it, have it audited, and publish the audit reports.

> there is a lot of misinformation here around what the agent does

May be. May be not. I have not decompiled their client, so I don't know what it does. However, Dratas Terms Of Service states: "Drata will notify you of updates via an email or a notification on the platform. Unless the notice states otherwise, the updated terms of this Agreement will become effective and binding on the next business day after it is posted." I assume this is US business days. So I could be on Easter vacation in Romania, while they changed their contract.

Drata gives themselves the right to change what they call "the Agreement" virtually without notice. Unless I have a hook in my email client, and a bot looking for notifications on their "platform", and are ready to get up in the middle of the night to print out and read their new "Agreement" - they could fuck me any way they like. Including updating their client with one that does something entirely different than the one thy have today.

For a company with a mandatory service, they are surely engaging in a lot of dark anti-patterns. I don't believe for a second that they act in good faith. I don't trust them.