Menu
On this page
- Which should a new SOC 2 buyer evaluate?
- What does OneTrust’s migration carry over, and what would Vanta rebuild?
- How long do you have, and what happens to a Type 2 period in progress?
- Will your CPA keep access in TRC or Vanta?
- Which is cheaper, Vanta or OneTrust?
- Which should a remaining Certification Automation customer choose?
For a OneTrust Certification Automation customer, the choice between OneTrust's Tech Risk & Compliance (TRC) and Vanta turns on what you need kept. OneTrust's migration carries over controls, policies and evidence tasks but drops logs, evidence-task comments and integration credentials. Vanta's migration steps have you reconnect integrations and upload your history by hand. Your access end date and your CPA's view of a mid-period switch set the timing.
OneTrust has retired Certification Automation (the former Tugboat Logic product). The OneTrust review has the retirement dates and the record-by-record test to run before you sign. OneTrust’s July 1, 2026 migration guide names TRC as the destination. Neither OneTrust nor Vanta signs your SOC 2 report; your independent CPA does. Product profiles: OneTrust and Vanta.
Which should a new SOC 2 buyer evaluate?
Certification Automation is not sold to new customers, so a new buyer is choosing between Vanta and OneTrust’s Tech Risk & Compliance (TRC). Vanta fits a team that wants a standalone SOC 2 platform with published small-company prices. TRC fits a company already running OneTrust privacy or GRC products that wants SOC 2 work in the same suite; OneTrust prices it by usage meters, so ask for the package and meters in writing. Start with the Vanta review or the OneTrust pricing guide. The rest of this page is for teams already on Certification Automation.
What does OneTrust’s migration carry over, and what would Vanta rebuild?
OneTrust’s migration keeps your records and drops much of the trail around them. Vanta’s guide describes no automatic import from a previous tool.
| Area | OneTrust migration to TRC | Move to Vanta |
|---|---|---|
| Users and roles | Users land as Project Viewers and set new passwords. Roles, SAML, enforced MFA and built-in Auditor roles do not move. | Invite administrators, then match people to accounts. |
| Controls and policies | Both move, with policy comments. Framework codes, tags, logs, review dates and permissions do not. | Vanta’s tests replace controls; re-upload current policies and relink them. |
| Evidence tasks | Tasks move without audit or policy links, integrations, tags, logs or comments. Unsupported file types are flagged in the migration report. | Upload historical evidence as documents. Vanta’s guide has no step that keeps task structure or comments. |
| Audit requests and findings | No place for legacy audit requests. Findings are exported and imported as issues. | Not covered in Vanta’s guide. Keep your own export. |
| Integrations | Not migrated. Recreate credentials. | Connect each system, then review failing tests for gaps. |
Sources: OneTrust's Certification Automation Migration Guide (July 1, 2026) and Vanta's "Best Practices: Migrating Your Security Program to Vanta" (June 16, 2026), both as of October 20, 2026. Vanta's guide covers a move from any previous tool, not OneTrust specifically.
The difference is the trail. TRC drops the logs and evidence-task comments that show who did what and when, and after a move to Vanta the original OneTrust exports are the only record. Ask OneTrust which logs and comments you can export before access ends.
How long do you have, and what happens to a Type 2 period in progress?
Renewals have ended, so any parallel run has to fit inside the term you have left. Get your end date and extraction window in writing; the OneTrust review lists the dates and the test migration to run.
A Type 2 period in progress is the hard case on both paths. The CPA tests operating effectiveness across the whole period, so evidence will sit in two places: exports from before cutover and the new platform after it. Whether that split is acceptable is your CPA’s call. Ask which pre-cutover artifacts it needs (timestamps, owners, exception comments) and keep those originals outside both tools. A cutover at the start or end of a period splits the least evidence. The consultancy Workstreet advises against migrating within 90 days of a planned audit; that is a rule of thumb, not a vendor requirement.
Will your CPA keep access in TRC or Vanta?
OneTrust’s migration does not move users with the built-in Auditor or Auditor (Evidence Collection) roles; auditors on a custom role do move. In Vanta, the CPA is added as an auditor and works through in-product evidence requests and the Auditor API. Information request lists and controlled auditor views may need an upgrade or add-on, so confirm in the quote that your CPA gets the access it needs.
40 attestation-capable CPA firms in our directory list Vanta among the platforms they work with (Vanta auditor list), and 2 list OneTrust (auditor directory). Ask your current CPA directly.
Which is cheaper, Vanta or OneTrust?
The public prices cannot be compared. OneTrust prices Tech Risk & Compliance inside a solution package by usage meters, publishes no dollar amount, and sends existing customers a custom proposal; the OneTrust pricing guide has the quote questions. The retired module’s UK G-Cloud 14 listing showed £36,180 per licence per year on September 29, 2026; it is not a TRC price (OneTrust review).
Vanta lists Essentials, its one-framework package, on AWS Marketplace from $14,000 for a 12-month contract covering 1 to 20 employees (as of October 20, 2026). A larger company needs a quote. Vendr’s reported median across observed Vanta contracts is $20,000 a year (as of October 15, 2026); the Vanta pricing guide carries the range and scopes. Ask both vendors to price migration or onboarding work, support and renewal terms. Your CPA’s fee is separate.
Which should a remaining Certification Automation customer choose?
The choice comes down to what the test migration drops, how much time your subscription leaves and whether your CPA keeps access.
| Deciding condition | Migrate to TRC | Rebuild in Vanta |
|---|---|---|
| Migration gaps | The test copy keeps your controls, policies and evidence tasks in a form your CPA accepts, and you can export the missing logs, comments and legacy audit requests before access ends. | You accept uploading history as files and reconnecting every integration by hand, with the OneTrust exports kept as the record. |
| Dates | Your remaining term leaves room for a test migration and your CPA’s review of it. | Cutover can fall at a period start or end, and integrations are live before access ends. |
| CPA access | Your CPA is on a custom role, which migrates, or OneTrust confirms in writing how your CPA gets access in TRC. | Your Vanta quote confirms the auditor access your CPA needs. |
If the test migration fails your CPA’s review and a manual rebuild does not suit you either, compare the wider field on Vanta alternatives or in the software directory.
Vanta buyer guides
Start with the product record, then compare the review, pricing, alternatives, pair guides, and auditor listings before you shortlist.
More in Compliance Tools