I read their Privacy Policy. They are quite explicit about what they plan to do to you. I raised the issue with them in an email (among 5 other issues). Their reply is in the header. Another issue I raised is that they expect me to accept undisclosed terms and conditions.

That said. I have worked with computer security at an advanced level, including consulting, training, penetration testing, design/implementation of x-platform server agents for monitoring and alerting, design/implementation of firewall. Once I designed an implemented a system to deal with NATO secrets (not very sensitive secrets, but still secrets) for a military subcontractor in EU. My computer is relatively secure. I follow best practices - and more. A hostile agent would decrease the security on my network. That was my first thought when I got that awful email.

Also, I don't get it why that need such a thing on my PC. I don't have credentials to production systems or production data. I am a software developer. I work with code and documentation. That's it. Anything I produce is reviewed by other developers and then tested independently by QA.

I am careful to be a freelancer, and not an employee, for several reasons. It means that legally I'm my own boss. That feels good (I have a great boss!) It also make it unproblematic to work on open source projects, without getting into discussions about who owns the intellectual rights to that work.

OK, well, I've skimmed it and I can't see anything that suggests they are going to spy on our employees and sell the data to advertisers. I hate to drop it back on you but which passages make you think they do that?

These things do often sound terrifying because things like "I'm going to use Google Analytics to see which parts of the product people aren't using so we can email them reminders" get turned into passages like "We will upload all your activity to a third-party advertising company for marketing purposes".

> I have worked with computer security at an advanced level ... A hostile agent would decrease the security on my network. That was my first thought when I got that awful email.

I believe you! 100%!

But you are unusual, and without verification a control such as "All laptops should have screens that lock after 5 minutes" won't be followed by everyone. NOT EVEN CLOSE to everyone.

> Also, I don't get it why that need such a thing on my PC. I don't have credentials to production systems or production data. I am a software developer. I work with code and documentation. That's it.

Sure. Another commenter in the thread has said that because of that this isn't strictly required for SOC2. I'm sure they're right.. but I'm not sure I want anyone working on our codebase at all who doesn't have basic security settings set on on their laptop (Again, I know YOU do :) )

Back to the using your own computer thing again - this is why I think lots of companies say "You use our hardware for all company work but IF you really really want to do BYOD then you have to accept some of these agents". Not sure if that's the attitude at your firm, but that seems reasonable.

"We, our service providers and our third-party advertising partners may collect and use your personal information for marketing and advertising purposes: ... Interest-based advertising. ... We may also share information about our users with these companies to facilitate interest-based advertising ... We may create anonymous, aggregated or de-identified data from your personal information and other individuals whose personal information we collect ... and share it with third parties for our lawful business purposes"

Such "de-identified data" is often trivial to re-identify. There are research papers about that. It's well known in the security and privacy community.

Also, they use dark anti-patterns for opting out from them even using your personal data for their own advertising. "You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us at ..."

If Drata intended to be a nice, trustworthy security partner, use of any personal data for targeted marketing, or sale of any personal information would be opt in, not "out out if you can figure out how ...".

I have not read their terms of conditions or even their glossy information about the agent. I never got that far, as I declined to accept the terms and conditions for using their website. Already at that point, I saw red flags the size of Australia.

I don't believe for one second that Drata has any intention of showing any decency or that they act in good faith towards their customers or anyone else. If they did, they would have developed reasonable terms and conditions. What they have don't even distinguish clearly between the roles of a customer and an employee or contractor for their customers. Hell, they don't even define the term "Customer".

That would seem to only pertain to their website. Yes, they're going to want to market it to you, so that makes sense.

The actual privacy policy for the product the OP is using is likely found in the contract Drata signed with the client company.

Source: I am the Drata CISO

May be you should go over your user agreement documents and:

1) Make sure that all relevant information is available, so a user can make an informed decision.

2) Distinguish between the user roles, and have different agreements for the different roles. One role is your customer. A second role is the employee of your customer. A third role is the contractor for your customer. A potential fourth role is the person(s) working for the customer that is responsible for dealing with personal and confidential information related to you, employees and contractors.

As of today, your user agreement is a mess, appearing as something you have copied and pasted together without much thought, except for how to cover your own asses. Including the ridiculed clause Microsoft is infamous for, warning that your software is unfit and unusable for any purpose.

I think you have 4 options:

- If you use a company-provided computer, install it on their computer. It's their computer, not yours.

- If you use your own computer, set up a VM for this client and install the agent in the VM. Then do your day-to-day work inside of the VM.

- If you use your own computer, buy / expense a dedicated computer for the job

- Politely refuse to install it and accept the consequences. (IE, you might be out of a job.)

Remember that you are paid to do a job. If you don't like the conditions of the job, you can always walk away. As an earlier poster mentioned, this tool appears rather benign.

Regarding company hardware and tracking: Many companies set up things like automatic backups, snapshotting, ect. These aren't meant to track you, but if you're doing personal stuff on your computer, it's very easy to accidentally leak things into the company backup that you might not want there.

Maybe run it inside a VM?

> I read their Privacy Policy. They are quite explicit about what they plan to do to you.

That's not evidence, only your interpretation.

That is in their privacy policy (https://drata.com/privacy). They go into even more detail about the advertising they serve to you based on the information they collect. They suggest a drawn-out method to opt out of their advertising tracking. Honestly, this alone would rule out Drata for any similar project I was considering. How in the world is it acceptable for a security and compliance tool to gather and store personal data for the purposes of marketing?? With all due respect, how did you miss this???

The agent is not the only concern. Before you even get to install the agent, you have to provide personal information to their website (I believe - I don't now, because I rejected the TOS and don't have access to the non-public part of their website).

The thing is - Drata collects mandatory information from their customers employees and contractors trough their website. The TOS for the website is explicit about how they plan to use that information.

Source: I am the Drata CISO

Is that the 100% honest answer?

From my understanding, your website is where you collect my mandatory personal information, if I agree with your TOS. It's not just a glossy brochure for your product - it is your product.

I cannot choose what I share with you. But you can choose with whom you share what information I provide. And from your websites TOS, you seem very eager to share it.

In other words, Drata is a CYAaaS.

> The Drata agent is a pretty innocuous thing. It checks you have done things like turn on disk encryption, have updates enabled, and that the screen locks if you walk away.

Guessing it is privileged and self-updating.

And closed source, of course. Must be totally free of bugs too, like all software.

Source: I am the Drata CISO

You're a bit off on whether this would fail a SOC2 audit, thankfully. As the OP said, they don't have access to production systems, which basically means you can treat that employee however you want from a SOC2 (and ISO, and most other control framework perspectives). The company OP is working for can state "We do not require these controls on contractors without production access" and that is totally fine for SOC2. Pushing back on the agent requirement is totally reasonable!

But quite possibly you are right.

That said, it's also completely trivial (on the auditor side) for them to say "Oh, we're changing this policy to 'We monitor devices with production access'". Good luck pushing for that to happen as a contractor, though...

It would be grossly irresponsible for a contractor to rely on one client's assurances about what a third party told them its software did, and expose other clients' data to errors or abuse by that third party. Or their own personal data, for that matter.

Next client! This is potentially an indicator of a bad customer or management.

My hardware = my software (not yours) end of discussion. Don't like it? Have fun finding someone better that will put up with your nonsense.

Now if they provide a laptop with corp network access etc that is different.

I'm a professional similar to yourself. 15 years as a consultant and freelancer.

If they don't offer company hardware I don't think they can rightfully demand agents be installed. But if they do, and if you decline to use it then you have to accept agents on your own machine.

Not sure what OPs situation is - but I'd think it very reasonable to go back and say "if you want to install this you have to provide me a laptop"

If active monitoring is really required than the only solution I see is one device/customer and thus as a freelancer I'd have to request said device be provided by the customer.

What's evidence? I can't remember the exact details but imagine something like ... a screenshot of the security page of the Settings app on macOS, taken by every employee, on every laptop, once a week.

Or install the Drata Agent on all company laptops.

Perhaps a form would be enough evidence that you wouldn't have to repeatedly collect it... but I doubt it. Because otherwise couldn't ALL employees just sign a form and that would be that? Auditors know that people don't actually follow the rules carefully even if they claim they are going to.

Then there's the unintentional aspect. There is, of course, no guarantee their agent is bug-free. Data leaks and compromises happen all the time, by every facet of company (large, small, respected, hated, etc).

This is really a huge risk IMO. If anything, it's being downplayed and far from "nonsense".

True, the grey area is slightly odd situations like this where the protagonist is a freelancer rather than an employee and presumably also the company isn't willing to provide hardware to them in that case?? Because they're a freelancer?

Sounds like a case that isn't going to survive too long in any company that's getting serious about compliance and risks.

Unless their agent is Free Software, the reasonable end-user assumption is that they are doing malicious things. As we've seen time and time again, it's inevitable - either now, or in the future, they will come up with some bright idea for more features that involve being directly user-hostile. Your company may rely on their legal contract assurances, but I as an individual cannot.

My minimum policy for running sketchy binary blobs is in a VM on another machine. If you're adopting this type of software, it's incumbent upon you to make your corporate policy one of supplying computing equipment for everyone who is expected to run it. And also accept that employees will physically damage microphones and webcams to stop your supplied machines from acting as surveillance bugs of their personal dwellings.

But what the hell is your point? This is about as practical an argument as "the only reasonable software for your company to run is free software". Even if it were true, it's so far outside of industry norms that you might as well be asking them to ship all their products on BeOS.

My judgement is confined to what is reasonable for individuals to be asked to run in their own operating environments. Individuals lack recourse through the courts, barring some watershed law like a US GDPR with a provision for adequate liquidated damages.

I also pointed out a straightforward path if a company still wants their contractors/employees to run unaccountable proprietary crapware on the devices used to do work - purchase dedicated devices for contractors/employees to use for work, rather than expecting to get exclusive software installed on shared equipment. Coupled with an appropriate home network set up, this provides complete compartmentalization, assuming any sensors can be disabled.

(deliberate employee-hostile software, eg employee activity trackers, is out of the scope of this comment)

Can anyone even verify that? Is it open source?

Last time I allowed one of these "agents" into my computer, I discovered it was running in kernel mode and intercepting every single network connection.

It depends on the size of the company this person is working with. If it is large enough to be procuring Drata it means the people asking this dude to install the software is probably in a vastly different part of the company org structure as the teams our friend is working with. In addition, the "drata team" might not have yet considered their policy for contractors--in fact the "drata team" probably wouldn't even be the ones to draft a policy for that. It could be their legal teams who do that.

The solution really depends on how much of a fuss the poster wants to make of it. Personally I would be working with my clients inside that org to figure out a way to make their IT & legal department happy. If the poster has a good open relationship with their client, they'll find some solution. Perhaps the client loans the poster a dev workstation or something (which I'm sure can be structured in a way that doesn't fail the "contractor vs employee" tests).

I'm currently in the middle of our company's first evaluation window for SOC2 Type 2.

I'm not familiar with Drata, but at a surface-level, it sounds pretty similar to Vanta, who we use.

OP says "The motivation is that my client badly want a SOC 2 certification", which sounds about right. If anyone isn't familiar with SOC2, it's generally not something that you start out wanting or caring about, but eventually you get some big potential customers and they tell your sales people that they can't sign the contract unless you can show them your SOC2 attestation. Then you scramble to figure out what it is and what you have to do to get it. Depending on how your business works, it's the kind of thing that can very quickly go from "we don't know what that is" to "the future of our company depends on this". If you're a small team without experience in the area, it's a total mess and hard to understand exactly what's required. Signing up with someone like Vanta or Drata to walk you through the process and provides a bunch of tools to tick boxes and get you through an audit with a minimal amount of manual work and ambiguity (though there will still be a lot of that).

SOC2 tends to be very vague on actual technical controls and is more focused on the documentation of whatever controls you have set for yourself and gotten your auditor to agree are reasonable. You're going to have a very hard time getting most auditors to agree to something less strict than "devices that are used to access production systems or could otherwise touch sensitive data must have encrypted drives, be password protected, and kept up to date with security patches". If you have a traditional IT setup and provide hardware to all of your employees, you can probably generate some documentation showing how you enforce that policy. It's trickier in remote setups, BYOD environments, or with contractors/freelancers. Your two options are basically to have people install an agent like Dasta or Vanta's or to require them to upload screenshots of all the relevant settings on their devices somewhere on a regular basis (typically monthly), and then have an admin check them and sign off. That second approach isn't hard, but it tends to be very labour intensive and annoying as well as very easy for someone to forget and produce gaps/exceptions that then have to be explained to your auditor.

In our case, we're a fully remote company and fully BYOD (you get a hardware stipend but we don't really have an IT department so we're not in a good position to manage peoples' devices for them; we do strongly encourage people to use separate devices for work and personal). We completely understand the reticence towards installing a 3rd party agent on their own machines, so we give our employees the option of using Vanta's agent or doing the monthly screenshot thing. Boy is the screenshot thing a pain in my butt and don't I wish everyone would just use the agent. In the future, it might push us to change our BYOD policy and instead supply managed devices (but I'm not crazy about that approach either for other reasons).

One piece of feedback we've given Vanta at every opportunity (and I assume would apply to Dasta as well) is that we'd have a much easier time getting adoption of the agent among our developers if they'd make it open source so anyone with privacy concerns could audit it themselves. So far we haven't gotten any indications that they're moving in that direction. FWIW, reverse engineering and spying on the Vanta agent with eBPF and other tools to try to catch it doing something it shouldn't has become a bit of a side hobby of mine (it's mostly a wrapper around OSQuery and I've been able to log all the queries that it makes and not yet found anything nefarious, but absence of proof isn't proof of absence).

IMO, it's completely reasonable for the OP, as a freelance contractor, to refuse to install an agent on their personal machine and instead provide screenshots/etc as evidence. They say "Just for the record: I don't have credentials to production systems, and I don't work with production data.". If that's really true, then that should be fine. We have freelancers who do certain things for us (eg, market research), and if they don't have access to production systems/data, it's very straightforward for us to classify them that way and exclude them from the various secure development controls. Though they may not fully understand the scope of "production systems", which could include things like Github repos which contain code that gets deployed to production (SOC2 auditors want to see that the whole development lifecycle is secure so a compromised developer laptop couldn't be used to push out a backdoor without leaving a very obvious trail).

For what it's worth: a nit I like to pick with Vanta is that it sets a very ambitious bar for what a company should be doing with respect to IT security, where SOC2 does no such thing. I worry that things like Vanta lead teams into doing all sorts of stuff that might not be a fit, and certainly isn't required to pass a Big 4 SOC2 audit. What was your experience there?

(I ask because SOC2 is sort of looming over us, though obviously it's not something we're jumping to do preemptively).

Not really. We had no process before talking to the auditors. We told them that we didn't want to require employees to install the Vanta agent (for reasons mentioned) and asked them what they recommended. They said that screenshots would be fine. On a lot of these SOC2 things, I think people should just talk to their auditors early in the process and get a sense of what they are looking for and care about. There are some standards, but all of them are going to have a slightly different focus and the ones we've worked with have all been pretty reasonable about understanding the particulars of our company and what exceptions make sense for us.

> For what it's worth: a nit I like to pick with Vanta is that it sets a very ambitious bar for what a company should be doing with respect to IT security, where SOC2 does no such thing. I worry that things like Vanta lead teams into doing all sorts of stuff that might not be a fit, and certainly isn't required to pass a Big 4 SOC2 audit. What was your experience there?

I can't say it's really been a problem for us. Vanta and our auditors have both been pretty clear that it's not 100% necessary to have all tests passing in Vanta in order to get our SOC2 (again, it's helpful to just talk to your auditors). We run entirely on the Cloud (no physical offices or data centers) and honestly, some minimal GCP/AWS best practices and modern deployment approaches (protected branches, code reviews, standardized CI/CD) means that you're already passing about 90% of Vanta's tests on those things. We had to do a few silly things like change our resource labelling conventions to match Vanta's but otherwise nothing felt terribly burdensome or like security overkill.

I agree with your final paragraph 100%

And good luck with your evaluation!

I think the only service we had to pay was for security awareness training, and it was a site that provided security awareness videos..

But you are right. All those ceryification companies are a mafia.

> Do you have any evidence for this?? I've just been involved in selecting Drata as a vendor for SOC2 compliance planning for our company. If this is true it's a huge deal and totally against my understanding of their business model. It honestly sounds like bullshit to me! But if you have evidence that they do this, please let us know."

Do you have any evidence that they don't? If so, can you describe a few bits of your investigative process and how you reached the conclusion? For the sake of alleviating people's fears and to clear up the nonsense.

OP made a claim that Drata collects private employee info and resells it. That’s a large claim.

It’s on OP to justify that position, not on the parent to rebut the opposite.

What I know is:

1) They collect mandatory private information. They already know my name and my email, and they used that information to ask me to complete some tasks on their website. I don't know what those tasks are, because I first have to accept their TOS, which contains clauses that is referred to, but not disclosed. I declined.

2) Their "webpage" is part of their service. This is where I supply personal information (presumably more than they already have). So unless they have another TOS, after I accept the publicly available one, that's the rules: I have to give them personal data, because my employer (well, in my case it's my customer, not my employer - Drata have no agreement with my employer) signed a contract with them.

3) They give themselves the right, in the websites TOS, to sell my data.

So: 1 + 2 + 3 = Drata collects private employee info and resells it.

My impression is that HN conversations are less regulated. Someone can make a claim, and each reader can decide how much merit it deserves, and if/how to discuss it further.