How Drata Turns Customer Evidence into AI-Powered Compliance Decisions with Reducto

How Drata Turns Customer Evidence into AI-Powered Compliance Decisions with Reducto

More than 8,500 organizations, including a third of the Cloud 100, rely on Drata to demonstrate trust and manage compliance. Now, Drata is building AI agents to take on evidence collection, control remediation, and audit preparation, moving toward a model where compliance work happens continuously. Reducto supplies the document understanding behind that work. In AIQA (AI Questionnaire Assistance), it automates question extraction from hundreds of documents each month, replacing manual preparation that could take up to 30 minutes per questionnaire.

For almost every AI recommendation we make, we reference information derived from a customer’s actual documents. Reducto extracts that information with citations so we can use it in embeddings and other AI workflows they can trust

- Lior Solomon, VP of Engineering, AI and Data at Drata

Compliance is central to how modern businesses operate, yet much of the work remains reactive. Winning enterprise customers, entering new markets, and handling sensitive data all depend on demonstrating that security practices hold up. But that proof is scattered across policies, screenshots, and audit records, leaving teams to piece it together whenever a new request arrives. The demands keep coming, while the time to anticipate and address risk gets squeezed.

For Drata’s customers, compliance and customer assurance are closely connected. Brex uses Drata and Trust Center across both, while GitLab and Instacart use Trust Center to reduce the work behind security reviews. Drata’s move toward continuous compliance aims to reduce the repeated effort of gathering evidence and preparing responses, giving teams more time to address the risks those processes reveal.

Turning customer evidence into action

Lior leads four teams building Drata’s customer-facing AI agents and the systems behind them. Those agents need to work with the evidence customers actually provide: a policy describing a security practice, a screenshot showing a control, or a file submitted for an audit. Understanding those documents is part of understanding what a customer should do next.

Drata’s previous document-processing setup ran into limitations in extraction quality and scale.

We experimented with other tools, but found them expensive without getting the quality we were looking for.

His team now uses Reducto across Drata’s products, extracting information from customer documentation so it can be embedded, retrieved, and used in AI workflows. The practical difference is especially clear in SafeBase, the trust center and questionnaire automation company Drata acquired.

AI-assisted answers, without the manual intake

According to Julien Melissas, the Engineering Manager at Drata who leads AI Questionnaire Assistance, PDF and Word files account for roughly 10–15% of questionnaires. A typical file runs five to ten pages; some reach 40. Manually preparing one questionnaire could take up to 30 minutes, with some outliers taking longer.

Reducto removed a bottleneck that sat right in front of our AI workflow. Before we could generate answers, someone had to manually extract the questions and that depended on their availability. Automating that step meant the product could handle work that previously needed a person to get it started.

Reducto’s Extract endpoint now identifies the questions, giving AIQA the inputs it needs to generate suggested answers from the customer’s security information. Customers work with colleagues to review and approve the responses before returning them to the requester.

Across the six months Julien measured, AIQA successfully extracted questions from hundreds of documents each month.

AIQA brings questionnaire ownership, progress, and deadlines into one workflow.

Edit turns answers into a completed document

Preparing answers was only part of the workflow; customers also needed to return a completed questionnaire.

Reducto Edit let us deliver more than suggested answers. We could put those answers back into the questionnaire the customer needed to return, a capability we hadn’t offered before. That brought a meaningful piece of work into AIQA instead of leaving customers to finish it manually.

Customers review and refine generated responses before completing a questionnaire.

Learning from the work, not just completing it

For Lior, the next step is to use what Drata has learned across thousands of audits to help customers identify risks earlier.

We have thousands of customers who have gone through thousands of different audits. That gives us exposure to what works, what doesn’t work, what kinds of risks organizations have taken, and how those situations have played out.

Drata’s Trust Graph initiative is built around that experience. The aim is to draw lessons from past compliance activity that can inform a customer’s next decision, rather than simply complete the next task. Lior sees evaluations and data governance as essential to turning that accumulated knowledge into dependable, preventive guidance.

It’s more than automation. We want to start extracting insights from the data, that’s what we believe can become our moat, as opposed to someone simply showing up and saying, I can build Drata myself.

In that future, AI takes on more of the familiar, repetitive work, while people assess new risks and exercise judgment where precedent falls short. AIQA already illustrates that division of responsibility in a focused workflow. Drata’s larger ambition is to make each audit and review useful beyond the moment it is completed, helping teams decide what deserves attention next.

Want to try Reducto on your own documents? Visit Studio to sign up for free, or request a demo.