The enterprise security questionnaire is a peculiar document. It can contain hundreds of questions, arrive late in a sales process and demand the attention of people who were not invited to the sales call. Is data encrypted? Who can see it? Which controls have been audited? The answers matter. The method, for years, resembled correspondence with a very anxious pen pal.
Al Yang knew the ritual from the vendor's side. At a company that sold software to hospitals, buyers repeatedly asked how patient data was protected. His team invested in security and compliance, but proving that work was its own expensive project. Evidence lived in documents. Explanations traveled by email. A strong security program could still be difficult to see.
That irritation followed Yang to Harvard, where he met Adar Arnon. It also met a useful set of experiences already in his luggage: two earlier ventures that Yang says ended in acquisitions, five years in technology M&A investment banking, and enough enterprise selling to recognize the difference between an occasional nuisance and a recurring budget line.
The small annoyance with a large balance sheet
SafeBase began in 2020, with Yang as CEO and Arnon as CTO. The founding group initially worked on helping small businesses manage consumer data-deletion requests. Then came Y Combinator's Summer 2020 batch, conducted remotely during the pandemic, and a sharper lesson from the market. Startups trying to sell to large companies did not merely need sound security. They needed a credible, current and legible way to demonstrate it.
The team focused on a customer-facing security page, eventually called a Trust Center. Instead of making every prospective buyer begin at the same blank spreadsheet, a vendor could publish approved details about its controls, policies and certifications. Sensitive material could sit behind access rules. The security team could update a central knowledge base once. Salespeople could point buyers to a living answer rather than summon another attachment from the archive.
There is a neat product lesson in the pivot. The team's first idea concerned compliance work that companies had to do. The stronger idea concerned a moment when a buyer wanted to say yes but could not proceed. Obligation created demand; a stalled sale created urgency. SafeBase positioned security proof not only as defense, but as a way to keep revenue moving.
“The vision is to create a world where there is real-time risk assessment done with zero friction.”Al Yang
Making the invisible visible
Yang often explained the product with an everyday analogy. Professionals have LinkedIn profiles that summarize their work. Companies, he argued, should have a comparable place to show their security stance. The comparison made a technical category understandable without flattening its importance. A profile is public enough to orient a stranger and structured enough to invite a deeper conversation.
That framing also gave SafeBase a distribution advantage. A Trust Center is meant to be seen. Every buyer who visits one learns the category while using the product. By the end of 2023, Yang said SafeBase Trust Centers had received two million views during the year. The company later passed 1,000 customers, including LinkedIn, Palantir and CrowdStrike. Drata said that $15 billion in transactions had been tied to security teams using SafeBase Trust Centers over four years.
Growth did not make the argument less human. On the Cyber Inspiration podcast, Yang reduced an industry crowded with controls and acronyms to a plain observation: “Technology's taken over the world, but it's just still people, always people.” Security reviews create work between people who have different incentives. Buyers want evidence. Sellers want momentum. Security leaders want accuracy and control. A useful system cannot simply make one group faster by making another group reckless.
SafeBase's answer was controlled transparency. Public information could be viewed immediately. Sensitive evidence could require an NDA or approval. Activity could be logged. Repetitive questions could be answered with AI trained on a company's own security material, while unusual questions still reached an expert. The design respected the reason for caution while trying to remove the theater of caution.
A banker argues with a spreadsheet
Yang's M&A background appears most clearly when he talks about company building. During SafeBase's Series B process, conducted in a difficult funding market, he described a pitch that began with a large “why” and then submitted itself to arithmetic. The vision was an open platform for real-time, friction-free B2B security reviews. The evidence included annual recurring revenue growth, retention, customer references, acquisition efficiency and the share of prominent cloud companies already paying for the product.
The bars above are a visual map of his argument, not a financial model. His stated method was more valuable than any single metric: begin with the story, then validate it. In April 2024, SafeBase announced a $33 million Series B led by Touring Capital, with Zoom Ventures, NEA, Y Combinator, Comcast Ventures and others participating. It followed an $18 million Series A led by NEA in 2022.
The round also revealed Yang's operating temperament. He publicly discussed fundraising in parts, almost like opening the hood after the car had completed the trip. The posts emphasized honest customer references, promises a company could keep and business disruption a financing process should avoid. Transparency was not only SafeBase's product pitch. It became Yang's preferred way of explaining the company.
The outdoor tent and the eventual deal
In 2021, Yang met Drata co-founder and CEO Adam Markowitz at SaaStr. Both companies were less than a year old. Pandemic precautions placed their conversation in an outdoor tent, where they discussed culture, mission and customer focus. The setting was temporary; the relationship was not. They stayed in touch while Drata built compliance automation and SafeBase built the layer for communicating trust.
Harvard, a product pivot and Y Combinator's Summer batch.
An $18 million Series A after SafeBase passed 100 customers.
A $33 million Series B to extend Trust Centers and questionnaire automation.
Drata acquires SafeBase for a reported $250 million.
Drata announced the acquisition on February 11, 2025. TechCrunch reported a price of $250 million. SafeBase had raised $53.1 million in total venture capital, according to the report, and its co-founders retained their roles. The product remained available on its own while its capabilities began moving into Drata's broader platform for governance, risk and compliance.
The strategic fit is easy to draw. Drata helps a company maintain controls and prepare evidence. SafeBase helps that company show selected evidence to the next organization in the chain. One side works inside the walls; the other builds a well-governed window. Together, their stated ambition is a trust layer between companies.
There is a certain symmetry in the outcome. Yang spent years advising technology companies on acquisitions, then learned the founder's version from inside the room. SafeBase did not disappear into the transaction. Its name, leadership and product continued, while the addressable problem widened from the security review to the larger system of compliance, risk and assurance around it.
“Security is a business function. You need to show how it supports revenue - not just prevents loss.”Al Yang
Trust at software speed
After the deal, Yang continued to talk about security as a business enabler. In 2025, he argued that the relevant measurements should include deals accelerated and customers helped, not only incidents avoided. He also described AI as a baseline expectation for trust operations and continuous assurance as the direction of governance and compliance. In January 2026, he appeared on a panel devoted to that transition.
His aspiration has stayed remarkably consistent: a world where third-party risk can be assessed in real time with as little friction as possible. It is an audacious sentence attached to unglamorous work. Real-time trust still requires controls, evidence, access decisions and people willing to be accountable. The software does not abolish judgment. It clears away repeated errands so judgment can arrive where it matters.
Away from that mission, public biographies offer a few human details. Yang is a father of two, lives in the Bay Area and likes golf. At Harvard Business School he was co-president of the golf club. An investor, looking back after the acquisition, remembered conversations with him over orange wine and good food. These are modest facts, but they suit a founder whose product depends on relationships surviving scrutiny.
SafeBase's story began because security work was difficult to display. Its success came from turning that absence into an interface: current information, appropriate access and a clear next step. Yang saw the spreadsheet for what it was - not merely a document, but a queue of interrupted people. He built a company by shortening the queue. The paperwork remains important. It simply no longer has to be the protagonist.