Viewing profile — illud_tempus

Hi Adam. I appreciate that this issue caught your attention. Question: If Drata is nice, why do you portrait yourself as evil in your TOS?

> The Drata agent does exactly what you are talking about Does it also name and shame? ;)

How does the agent know what user it is monitoring? What other kinds of personal information does it process or collect, locally or in it's server endpoint? An external IP address …

> The agent is read-only and has no capability to wipe a device, it is a read-only agent that we have security validated with a third party. And you can change that over night, wit…

> OP made a claim that Drata collects private employee info and resells it. That’s a large claim. What I know is: 1) They collect mandatory private information. They already know m…

> Why do you think it covers the data collected by the agent? The agent is not the only concern. Before you even get to install the agent, you have to provide personal information …

> This is correct. The privacy policy listed here is for the website. Is that the 100% honest answer? From my understanding, your website is where you collect my mandatory personal…

> You are 100% correct. > Source: I am the Drata CISO May be you should go over your user agreement documents and: 1) Make sure that all relevant information is available, so a use…

Very informative. Thanks.

> We are happy to share our security validation report of the agent as well as the configuration with any prospects/customer. I am the OP. I am not your customer. My customer is yo…

> there is a lot of misinformation here around what the agent does May be. May be not. I have not decompiled their client, so I don't know what it does. However, Dratas Terms Of Se…

I can easily engineer myself out of this crap. But that feels like a much worse solution than just dropping out. I have two qualities that makes customers willing to pay a premium.…

> Personally I would simply refuse and prepare for the possibility that this company will no longer be a client That is the easy solution. Problem is, I really like the projects I …

Not on my part. Not with the people in the company I usually deal with. When a new manager I don't know send me an email to install some "agent" from a company I have never heard a…

> OK, well, I've skimmed it and I can't see anything that suggests they are going to spy on our employees and sell the data to advertisers "We, our service providers and our third-…

> The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors pr…

I don't use my private accounts for anything related to this client.

> have someone really familiar with SOC 2 certification working for them? Not that I'm aware of. I don't know the details. My interpretation is that some manager hired some company…

> The Data Processing Addendum isn't a loophole to collect data that they don't have a legal basis to collect. No. But it looks like a loophole to export whatever they have a legal…

> Under EU law that would potentially make you an employee rather then a contractor, That is not going to happen. I'm a freelancer, and I am going to remain a freelancer. It that b…

> ... they found another solution for that. Because there always is one. Thank you! That is the kind of experience I want a taste of :)