OP made a claim that Drata collects private employee info and resells it. That’s a large claim.
It’s on OP to justify that position, not on the parent to rebut the opposite.
What I know is:
1) They collect mandatory private information. They already know my name and my email, and they used that information to ask me to complete some tasks on their website. I don't know what those tasks are, because I first have to accept their TOS, which contains clauses that is referred to, but not disclosed. I declined.
2) Their "webpage" is part of their service. This is where I supply personal information (presumably more than they already have). So unless they have another TOS, after I accept the publicly available one, that's the rules: I have to give them personal data, because my employer (well, in my case it's my customer, not my employer - Drata have no agreement with my employer) signed a contract with them.
3) They give themselves the right, in the websites TOS, to sell my data.
So: 1 + 2 + 3 = Drata collects private employee info and resells it.
My impression is that HN conversations are less regulated. Someone can make a claim, and each reader can decide how much merit it deserves, and if/how to discuss it further.
> Do you have any evidence for this?? I've just been involved in selecting Drata as a vendor for SOC2 compliance planning for our company. If this is true it's a huge deal and totally against my understanding of their business model. It honestly sounds like bullshit to me! But if you have evidence that they do this, please let us know."
Do you have any evidence that they don't? If so, can you describe a few bits of your investigative process and how you reached the conclusion? For the sake of alleviating people's fears and to clear up the nonsense.