Many vendors publish their security posture on a Trust Center. Some documents are public; others are confidential and sit behind an access request that someone at the vendor has to approve. Rather than making you visit the site, request access, wait, download files, and upload them into Drata by hand, the agent does that work as part of the security review.

This matters because access requests are the slowest part of a vendor review. Waiting on a vendor administrator can take days, and a review that can't start until then is a review that sits. Collecting public documents first means you get a first-pass assessment in minutes and only revisit it when the fuller picture arrives.

Ensure the vendor's Trust Center URL is populated in their vendor profile.

If the vendor has multiple products on SafeBase, include the product-specific URL to target just that product.

Note: If a vendor offers multiple products and you need to evaluate them separately, set up each product as a separate vendor in Drata.

You can also add vendors from the Prospective vendors search, which automatically separates each SafeBase product into its own vendor entry with the correct Trust Center link.

A common mistake is entering a security marketing page rather than the Trust Center itself. Marketing pages describe a vendor's security program but don't contain the compliance documents the agent needs.

If the page you're about to paste doesn't list downloadable documents and certifications, it's probably not the Trust Center.

When a vendor has a Trust Center URL, the security review includes a Get access to Trust Center step. The review checklist shows:

What the Agent does at each step depends on the TPRM Agent autonomy settings.

The Agent collects all available documents from the SafeBase Trust Center, processes them, and continues into the assessment.

The Agent can begin collecting publicly available documents and tells you so in the Drata AI panel: I'm collecting publicly available documents from the vendor's SafeBase Trust Center. No access is required for this step.

Alongside that message, you may see a Request access & re-run full assessment button. You can let the public-document assessment run, request access in parallel, or do both.

Note: Depending on the TPRM Agent settings, the Agent may proceed automatically or wait for your approval:

You can request access from the chat panel without leaving Drata.

The fields you're asked for depend on how the vendor has configured their Trust Center, so you may see more or fewer than those above.

After you submit, the agent confirms exactly what it sent — the name, company, and work email address used — and notes that you may be required to sign an NDA.

You'll also see two options:

The request is submitted on your behalf using your email address, so the vendor's approval email arrives in your inbox rather than a shared mailbox.

Expected outcome: The vendor's Trust Center tab in Drata shows a status banner reading Status: Access requested, confirming the request and naming the email address where you'll receive next steps. The Drata AI panel records the details submitted.

Access is granted by the vendor, not by Drata, so the next steps happen outside Drata. Here's the whole path.

When the vendor approves your request, you receive an email from their Trust Center, branded with the vendor's logo and footed with "[Vendor]'s Trust Center is powered by SafeBase."

The email:

Select that button to continue.

Note: If the link has expired, request access again from Drata to trigger a fresh email.

Use the same work email address the agent submitted with your request. A different address won't be matched to the approved request.

On first arrival you'll see a short welcome dialog — Welcome to [Vendor]'s Trust Center. By proceeding, you agree to the platform's Terms of Use. Select Let's Go to continue.

If your access is covered by an NDA, the Trust Center displays a reminder that you're viewing it under NDA. Your access status is also visible in the Trust Center's account menu, which shows what you've been granted — for example, Gained access to Trust Center and NDA signed outside of SafeBase.

Because the agent started this review, the Trust Center recognizes it and offers to send you back. You'll see a banner at the top of the page:

Pick up your review in Drata VRM — It looks like you started your review in Drata VRM. Go back to VRM to continue.

Select Go to Drata VRM to return to the vendor's profile in Drata with your new access applied. ("Drata VRM" is Drata's vendor risk management area — the same place you started.)

Expected outcome: The vendor's Trust Center tab in Drata shows that access has been granted, along with how long it lasts — the duration is set by the vendor, so check the tab rather than assuming a fixed period. The tab also invites you to add documents to your security review. The Get access to Trust Center step is checked in the agent's checklist.

Once access is granted, the agent picks the review back up on its own.

You'll see a message in the Drata AI panel explaining what changed and what it proposes to do: The vendor has approved your access request! The previous assessment ran using public documents only, so I'll collect the full set of documents now and re-run the assessment with everything available.

Select Run assessment.

The agent collects the complete document set, reports how many documents it found, and begins processing — for example, Collected 13 documents from the trust center. Processing documents for the assessment. This might take a few minutes.

Everything lands in the review's Reports and documents tab, where each file shows its state as the agent works through it: Analyzing document… while in progress, then Ready for review. Where the agent finds exceptions inside a report, the row says so — for example, Review 9 exceptions found — so you can go straight to the passages that matter.

Because the agent re-evaluates every criterion against the full set, criteria that were previously inconclusive for lack of evidence may resolve to met, partially met, or not met.

Expected outcome: The review's Reports and documents tab lists the full set of Trust Center documents with their processing status, and the assessment results reflect both public and confidential documents rather than public documents alone.

Some Trust Center documents sit behind an access request that a vendor administrator has to approve, which can take time or be declined. Rather than waiting, the agent collects whatever is public and lets you assess immediately.

Note: Gaps caused by missing confidential documents typically show up as Inconclusive rather than Not Met. This lets you tell the difference between the vendor hasn't disclosed this yet and the vendor doesn't meet this criterion.

Expected outcome: You have a completed first-pass assessment within minutes of starting the review, labeled Public docs only, with undisclosed criteria marked Inconclusive rather than Not Met.

The Trust Center integration is a convenience, not a requirement. You can always:

Expected outcome: The review can be completed and finalized whether or not Trust Center access was granted.

Which URL should I use for a vendor with several products? The product-specific URL, so the agent targets the right product — for example, https://trust.drata.com/?product=safebase. Without one, the agent collects from the vendor's default product. Single-product Trust Centers don't need a product parameter.

How do I know I've got the Trust Center URL and not a marketing page? The Trust Center lists downloadable documents and certifications. A page that only describes the vendor's security program is a marketing page and won't give the agent anything to assess.

Do I have to wait for access before assessing? No. The agent collects public documents and lets you assess immediately, then re-runs with the full set once access is granted.

Who does the access request come from? You. Drata submits it on your behalf using your email address, so the vendor's approval email arrives in your inbox.

The access link in my email didn't work. Those links are valid for a single login and expire after one day. Request access again from Drata to get a fresh link.

Which email address should I sign in to SafeBase with? The same work email the agent submitted with your request. A different address won't match the approved request.

Why did SafeBase send me back to "Drata VRM"? That's Drata — SafeBase recognizes that your review started in Drata's vendor risk management area and offers to return you there with your new access applied.

How long does Trust Center access last? The vendor sets the duration. Once access is granted, the length is shown on the vendor's Trust Center tab in Drata.

Why are some criteria Inconclusive rather than Not Met? Inconclusive means the documentation didn't contain enough information to determine the answer — common when only public documents were available. Not Met means the documentation shows the requirement isn't satisfied. Re-running with confidential documents usually resolves inconclusive results.

Can I choose which Trust Center documents get used? Yes. The vendor's Trust Center tab lists the published documents and lets you add specific ones to your review.