Stratus Add-ons prepared for SOC 2 with XFA instead of an MDM.
"I’m very happy with the product. It saved me a lot of time."
Aljoša KlišanićCEO, Stratus Add-onsRead the Stratus Add-ons story
Device checks at sign-in, sent to Drata.
Keep Drata. XFA checks each device when someone signs in and sends the results to Drata about twice an hour.
What Drata does
Drata runs your compliance program. It holds your frameworks, controls, and policies, and the evidence your auditor reviews. That stays as it is.
Adds to Drata
What XFA adds
- Checks each device at every sign-in
- Covers contractors and personal laptops too
- People fix problems themselves in the XFA app
- Can block sign-in until a problem is fixed
How XFA works with Drata
1. Connect XFA to Drata
Connect your identity provider to XFA. Then connect XFA to Drata with an API key and a connection ID.
2. People check their device at sign-in
On their first sign-in, XFA walks each person through installing the XFA app. When a check fails, they fix it from the app.
3. Results arrive in Drata
XFA sends each device’s results to Drata about twice an hour. Your audit stays in Drata.
Already using the Drata Agent?
The Drata Agent syncs once every 24 hours. XFA checks the same five settings each time someone signs in. If one is off, the person sees what to fix and fixes it in the XFA app.
Before you remove the Drata Agent, check in Drata which device tests XFA’s results count for.
Drata’s help centre, 5 October 2026: How does the Drata agent work? (opens in a new tab)
The five settings both check
- Antivirus
- Disk encryption
- Screen lock
- Password manager
- Automatic updates
Questions about XFA and Drata
Do I need a paid plan to send results to Drata?
Yes. Sending results to Drata is part of every paid plan. XFA is free to start, with no cap on people, four checks at every sign-in, and the Fix button.
See pricingDo people still need the Drata Agent?
That is up to you. XFA and the Drata Agent run separately. Before you remove the Drata Agent, check in your Drata account which device tests XFA’s results count for.
Which checks does XFA run?
XFA starts with four: the operating system version, disk encryption, screen lock, and antimalware. You can add more as you grow, such as automatic updates, browser version, password manager, firewall, and recent reboot, up to 34 checks in all.
Does XFA block a device that fails a check?
Only if you set it to. You decide per check whether a device that fails gets a warning or is blocked, and after how many days. Either way, the person sees what to fix.
What does XFA see on a contractor’s own laptop?
Only the security settings it checks, such as the operating system version, disk encryption, and screen lock. XFA does not collect browsing history, personal files, or location data. The app installs without admin rights.
How XFA worksDoes XFA check phones too?
Yes. XFA checks iPhones and Android phones when someone signs in from them.
How XFA worksDoes XFA work with Vanta too?
Yes. XFA also sends device results to Vanta, Thoropass, and TrustCloud.
All integrationsKeep Drata. Start checking devices.
Try it on your own laptop first, then bring in the team. Connect Drata when you are ready.
