Drata's 50 FTE cap and the one-framework rule: reading the most specific plan card
Short answer
Drata's Compliance Automation Foundation publishes two limits no other vendor matches in our census: up to 50 FTEs, and one pre-mapped framework chosen from SOC 2, ISO 27001, Cyber Essentials, HIPAA or GDPR. There is no price, but a buyer can tell from the card alone whether Foundation fits.
By The Cost Desk, Compliance Pricing · Published 2026-07-07 · Updated 2026-09-29 · 3 min read
VENDOR PRICINGPLANS AND LIMITS
Drata does not publish prices. Its plans page ends in a Get Personalized Pricing button. Yet it scores highest in our census on stated plan limits, because its entry card tells you precisely where the plan stops. This note reads that card.
What the Foundation card says
From Drata's plans page, read on 2026-09-29, Compliance Automation Foundation lists:
- Up to 50 FTEs
- 1 pre-mapped framework, limited to SOC 2, ISO 27001, Cyber Essentials, HIPAA or GDPR
- Pre-built integrations
- Trust Center Standard
- AI Questionnaire Assistance Standard
- Add-ons: additional frameworks, and user access reviews (UAR)
Above it, GRC Advanced lists any framework and custom connections and tests. GRC Enterprise lists Risk Management Pro, Compliance as Code Pro and Agentic TPRM Assessment. Drata also runs a separate Assurance platform with its own Trust Center tiers.
Limit 1: 50 FTEs
This is the one published headcount cap in our census. If you have more than 50 full-time equivalents, Foundation is not your plan, and the page points you to the GRC plans, which list no headcount limit in our read.
The cap matters most for companies close to it. A 45-person company hiring this year should ask what happens when it crosses 50 during the term: a mid-term change, a change at renewal, or a per-employee rate.
Limit 2: one framework from a list of five
Foundation includes one pre-mapped framework, and only from five: SOC 2, ISO 27001, Cyber Essentials, HIPAA and GDPR. Two consequences follow.
- A second framework is an add-on on Foundation. The page names the add-on but not its price.
- A framework outside the five, such as PCI DSS or ISO 42001, points to GRC Advanced, which lists "any framework".
Drata lists 30+ pre-built frameworks overall, so the five-framework rule is a Foundation rule, not a product limit.
What the card does not say
- No price for the plan or its add-ons.
- No annual questionnaire count: Foundation includes AI Questionnaire Assistance Standard without a number.
- No audit or pen test inside a plan. Drata lists auditors among its 1300+ partners, and vCISO partners for leadership.
- What separates Trust Center Standard from higher Trust Center tiers.
How it compares
Vanta publishes framework and questionnaire limits but no headcount cap. Secureframe and Scytale state one framework on their entry plans, and nothing on headcount. Sprinto publishes a questionnaire allowance and support hours. Scrut and Thoropass publish no plans. On our scoring, Drata's limits are its strongest row, while expert services in a plan and the audit path are its weakest, because services and auditors sit with partners.
Using the card before the call
If you are under 50 FTEs and need one of the five frameworks, you can walk into the call knowing Foundation is the plan to quote, and ask three things: the Foundation price, the price of each framework add-on, and the price of the UAR add-on. If you are over 50 or need another framework, ask for GRC Advanced.
The calculator applies both rules: choose a headcount band above 50, or a framework outside the five, and it switches Drata's result to the GRC plans with a limit note.
A note on add-on pricing
The two add-ons Drata names are the most likely surprises in a Foundation quote. Additional frameworks matter to anyone planning ISO 27001 after SOC 2, and user access reviews matter to anyone whose auditor looks closely at access reviews. Ask for both prices at the same time as the Foundation price, even if you do not need them this year, so the renewal conversation does not start from zero.
The takeaway
A published limit is not a price, but it is the next best thing. Drata's card lets you rule its entry plan in or out before anyone quotes, which is why its limits score 9 of 10 here.