Tool profile
Dastra: cost, fit and limits
Dastra is an AI and privacy governance platform made by Dastra of Saint-Mande, France, that covers records of processing, data subject requests, data breaches, impact assessments, cookie consent and risk management. It is sold in three tiers to privacy teams, mostly in Europe, and is hosted on Microsoft Azure in France.
What to know first
Dastra pairs a long module list with a small amount of AI, mainly a wizard that drafts processing activities and assets and an AI agent in the Starter tier. Its strongest public details are the certifications and the hosting notice, not prices: none of the three plans shows a figure. The comparison table shows identical entity and user limits across the tiers, which makes the differences about features.
Dastra at a glance
| Maker | Dastra, France |
|---|---|
| Free plan | Free trial only |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI Data Privacy Management Software in 2026, rank 4 of 10 |
| Website | dastra.eu |
Who Dastra is best for
French and Benelux privacy teams
The legal notice places the company in Saint-Mande, France, with servers in France on Microsoft Azure, which suits buyers who prefer a French provider and hosting.
Teams that must show vendor certifications
The home page lists ISO 27001, ISO 27701 and a CyberVadis 2025 badge, which are the documents many procurement questionnaires request.
Organizations running a trust center
Pro adds a trust center and contract and policy analytics with AI, which suits companies that need to show customers what they have documented.
Enterprises needing identity controls
The platform lists SSO via SAML and OpenID, SCIM provisioning and IP filtering, so access can follow the corporate identity provider.
Dastra plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Starter | Demo request, no price shown | Enhanced processing record, privacy by design questionnaires, asset records, data mapping, third-party audit, academy access, dedicated support and an AI agent. |
| Pro | Demo request, no price shown | Starter plus rights request management, data breach management, contract and policy analytics with AI, and a trust center. Marked most popular. |
| Enterprise | Quote | Pro plus compliance management under GDPR, Europrivacy, UK GDPR and ISO 27001, evidence automation, risk management, SSO, advanced security and custom reporting. |
Checked November 2026.
What Dastra does
- AI wizard
- An integrated AI wizard generates processing activities or assets, and the interface offers a short summary of an activity. The page does not say which model provider processes the text.
- Record of processing and mapping
- The Starter tier covers the processing record, privacy by design questionnaires, asset and stakeholder records and data mapping, with a glossary. These records form the base for later modules.
- Rights requests and breaches
- Pro adds rights exercise request management and data breach management, so deadlines and notifications are tracked in the same workspace as the register. Check coverage for your jurisdictions.
- Cookie consent and watch
- The module list includes cookie consent, questionnaire management for audits, risk management and an advanced regulatory watch, though the plan in which each one is bundled is not always clear.
- Open APIs and exports
- The home page lists open and documented APIs, exports and imports in all formats and native connectors, which helps a team that wants to move records to or from another system.
How Dastra handles your data
The legal notice names Dastra as a company at 14 Avenue du General de Gaulle, Saint-Mande, France, and states that hosting is on Microsoft's Azure platform with servers in France. The home page lists ISO 27001, ISO 27701 and a CyberVadis badge, and says the platform is designed and developed in Europe. Retention periods, the sub-processor list and whether customer data trains AI models were not stated on the pages read, so the vendor's policy was not checked for this. Ask which provider runs the AI wizard.
Where Dastra falls short in practice
- No prices published. Starter and Pro lead to a demo request and Enterprise to a quote. A buyer cannot compare Dastra's cost with PrivacyEngine or heyData without a sales call.
- Comparison table is partly unclear. Several rows, including some SSO, support and integration entries, are marked optional or are hard to align with a column. Get the final scope in the quote.
- Limits are workspace-based. All tiers cap entities at 50 and users at 150, and custom fields at 5, 25 and 100. Large groups with many subsidiaries should check whether these caps fit.
Works with
Alternatives to Dastra
Dastra: common questions
Where does Dastra host its data?
The legal notice states that hosting is on Microsoft's Azure platform with servers in France. It names the Microsoft entity in Issy-les-Moulineaux. It does not list sub-processors or backup locations, so request those in the data processing agreement. Confirm region for backups.
Which certifications does Dastra list?
The home page shows ISO 27001, ISO 27701, a CyberVadis 2025 badge, an IAPP bronze membership and a Vaadata badge. Memberships and badges differ from certificates, so ask for the ISO documents and their scope. Request the current certificates and scope.
What does the Dastra AI wizard do?
The home page says an integrated AI wizard can generate your data processing activities or assets, and the interface offers a summary of an activity. It names no models and no accuracy. Test it on a live activity and have a privacy lawyer check the output.
How is Dastra priced?
The pricing page shows no figures. Starter and Pro link to a demo request and Enterprise to a quote request, and the site says Dastra is free to try. Ask the quote to state users, entities, modules and support. Ask for a written comparison.
What limits apply to Dastra plans?
The comparison table lists 50 legal entities and 150 users on all three plans, with 5, 25 and 100 custom fields per workspace on Starter, Pro and Enterprise. Some rows are marked optional, so confirm limits in the contract. Ask for sizing.