Which SOC 2 controls are not ready, and who has not done security training?
Drata tracks how close you are to frameworks such as SOC 2 and ISO 27001. Memtro reads framework readiness, controls with their evidence, tests and owners, failing monitoring tests, evidence due for renewal, personnel compliance checks, vendors and risk registers. Personnel email and dates are never returned. When asked and once an administrator has granted the action by name, it can add notes to controls and risks, create and update risks, tasks and vendors, edit controls or take them out of scope, and re-run a monitoring test. Owners and assignees may be notified. Deleting a risk is permanent.
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right Drata tool, reads what it needs, and answers with the source cited.
These tools change something in Drata. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.
Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Drata, choosing the same kinds; the tab shows Drata's own steps. Each event can start a job, with the event as its input. Drata sends a secret with every delivery, and one without it is refused.
Events and webhooksOnce Drata is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.
Drata + MemtroWhich SOC 2 controls are not ready?
How close are we to SOC 2?
Who still has not done security training?
What evidence expires this month?
Re-run the MFA monitoring test now that the fix is in.
Priya Sharma, head of security at Northwind, asked how close they were to SOC 2. Memtro read how many of the framework's requirements were ready and listed the controls not yet ready with their owners. It also named the failing monitoring tests behind them.
Dan Fletcher, CTO at Acme Ltd, asked Memtro to set Sarah Chen a task to finish laptop encryption by the end of the month, linked to the encryption control. Memtro created the task assigned to Sarah, and Drata may have notified her. Once she reported it done, Memtro re-ran the encryption monitoring test.
The teams that lean on Drata most, a question each of them asks, and what they connect beside it.
A record in Drata is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
UptimeRobot
Honeycomb
Cronitor
FireHydrant
StatusCake
GlitchTip
GLPI
Langfuse
LibreNMS
NetBox
Snipe-IT
Woodpecker CI
Zabbix
LangSmith
Helicone
GrowthBook
Intruder
GitGuardian
Secureframe
ilert
JumpCloud
ConfigCat
Split
Aikido Security
Astronomer
Comet Opik
CrowdStrike Falcon
Detectify
Domotz
LambdaTest
LangWatch
LlamaCloud
Logz.io
Lunary
NinjaOne
Northflank
Portkey
PromptLayer
PRTG Network Monitor
Raygun
Retell AI
Runpod
Shodan
Spike.sh
Squadcast
Tenable
UpGuard
Uptime.com
Vanta
Zenduty
Cortex
WorkOS
Kandji
Automox
Huntress
SimpleMDM
Healthchecks.io
Rapid7 InsightVM
ZenhubIn Drata, open Settings → API Keys → Create API Key and choose All read, or Custom scopes.
Add only the write scopes for what you will ask Memtro to do, such as create:control-note and create:risk-note for notes, or create:risk and update:risk for risks. Set an expiry and copy the key, which is shown once.
In Memtro, open Connections → Drata, paste it into API key, and set Region to eu or apac if your account is hosted there.
Ask: which SOC 2 controls are not ready?
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The Drata tools are the same everywhere.
Only when you ask, and only what it has been granted: add a note to a control; add a note to a risk; create a risk in a risk register, or update its score, treatment, status or details; delete a risk from a risk register permanently; create a compliance task, edit it, or mark it complete or incomplete; re-run a monitoring test now; create a vendor, or update a vendor's status, risk, category or details; edit a control's name, description, question or activity; mark a control out of scope (archives it) or back in scope. Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.
A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.
API key. In Drata, open Settings → API Keys → Create API Key and choose All read, or Custom scopes.
Yes. Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Drata, choosing the same kinds; the tab shows Drata's own steps. A job set to start "When an event arrives" then runs once for each matching event, with the event as its input. The run treats the event as outside data, never as instructions, and anything the run remembers is kept as unverified.
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.
Sign in, add a provider key, create an API key and point your tools at Memtro. It takes about five minutes.
7-day free trial · card on file, nothing charged until it ends · cancel any time
