Securiti

What it is

Securiti is a privacy and data-governance platform built on a data-discovery engine. It scans cloud data stores, SaaS apps and on-premises systems, classifies the personal and sensitive data it finds, and then runs privacy work on that inventory: data subject requests (DSRs), consent and cookie management, data mapping and records of processing (RoPA), privacy assessments and data security posture management (DSPM). Rehan Jalil, who previously ran Symantec’s cloud security business, founded it in San Jose in 2019. It won the RSA Conference Innovation Sandbox in 2020 and raised about $156 million, including a $75 million Series C in October 2022 led by Owl Rock.

Veeam, the backup company owned by Insight Partners, announced the purchase in October 2025 for $1.725 billion and closed it in December 2025. Securiti still sells under its own name, but the product line now sits inside Veeam’s portfolio:

• Agent Commander (February 24, 2026) inventories the AI agents in an environment, flags shadow AI, controls what data agents can reach, and can roll back changes an agent made, using Veeam’s recovery engine.
• DataAI Command Platform (launched at VeeamON, May 2026) is the new name for Securiti’s Data Command Center, combined with Veeam’s resilience products.
• Three privacy agents (June 3, 2026): a Consent Agent that builds, tests and monitors cookie banners and consent enforcement, shipped as generally available. A DSR Agent that generates request intake forms, and an Assessment Agent for routine compliance assessments, were announced for later in 2026. As of this check, Veeam had not published a dated general-availability notice for either.

G2 rates Securiti about 4.7/5 from roughly 85 to 100 reviews. Reviewers most often praise having DSRs, consent, mapping and AI governance in one console.

Why it shows up in Legal Ops stacks

• The data map is discovered, not surveyed. OneTrust and TrustArc build the inventory largely from questionnaires sent to system owners. Securiti builds it by scanning the systems. When the question is “where does this person’s data actually live”, that difference decides how complete a DSAR response is.
• Privacy and security share one budget line. The same scan feeds DSPM findings for the CISO and RoPA entries for the privacy office, so one contract can serve both.
• AI governance starts from the data. For EU AI Act inventories, Securiti ties each AI system to the sensitive data it touches, which is the evidence an assessment needs.

Pricing reality

Securiti publishes no prices; every deal is quoted, and the vendor site blocks automated checks. Vendr’s buyer data (checked November 7, 2026) puts the median contract between about $42,000 and $50,000 a year depending on the snapshot, with most deals between roughly $30,000 and $80,000. Expect privacy-only deals for a mid-market company to sit near the bottom of that band, and enterprise deals that add DSPM across several clouds to go well past it. It is also sold through AWS Marketplace, which lets buyers draw down an existing AWS commitment. Get the quote broken out by module, by data sources scanned and by professional-services hours.

Best for

Privacy officers and CISOs at companies with 1,000+ employees and personal data spread across several clouds, warehouses and SaaS apps, who want one discovery engine to drive both privacy operations and data security. It fits best when security co-owns the budget.

Do not buy it for a small company whose need is a cookie banner and a few DSRs a month; Ketch or DataGrail will be live faster for less.

Versus the alternatives

OneTrust is the market leader by a wide margin. At renewal, pick OneTrust when legal owns the program and you need third-party risk and the broadest module catalog. Pick Securiti when finding data across cloud stores matters more than the privacy-program workflow.

TrustArc wins when the program is assessment-, research- and certification-led.

Transcend wins when engineering owns privacy and wants deletion and consent enforced in code.

BigID is Securiti’s closest rival on discovery. Pick it when the job is data discovery and classification and the privacy workflow is secondary.

Cyera is the fastest-growing entrant, valued at $12 billion after a June 2026 round. Pick it when the buyer is the CISO and the job is pure DSPM with no privacy-operations module.

If none fit, the problem is usually that no one owns the data map. Fix that first.

Watch-outs

• Product direction now follows Veeam. Securiti’s roadmap now has to fit a backup company’s platform and sales channel. Guard: add a change-of-control and end-of-life clause with at least 12 months’ notice and full data export, and keep the term at 24 months or less.
• Announced agents are not shipped agents. Only the Consent Agent was announced as generally available. Guard: buy what ships today, and make any DSR Agent or Assessment Agent capability a contract exhibit with a delivery date.
• Scan scope drives cost. Price rises with data sources and volume scanned, and DSPM coverage of large unstructured estates adds up fast. Guard: list the data sources in scope before the demo, and model renewal at double that scope.
• Admin depth is real. The console covers privacy, security and AI governance, and set-up takes skilled time. Guard: name a platform owner before signing and budget implementation hours in year one.

For the legal basics behind DSRs, see GDPR for legal teams.