Menu
Vanta
Vanta is a compliance automation and trust-management platform for SOC 2 and other frameworks. It connects cloud, identity, HR, and development systems to collect evidence, then adds risk, audit, vendor-risk, and access-review workflows by plan tier.
Best for: Cloud-native SaaS teams on mainstream stacks that value a broad integration catalogWatch for: Direct pricing is quote-only, and SCIM may require an add-on Read our Vanta review →
AI and MCP
MCP server: Official, public preview (its docs say beta). Access: Read, write and delete. Checked 12 Oct 2026.
What does Vanta do?
Vanta was founded in 2018. Vanta is led by Christina Cacioppo. Vanta says it serves 16,000 customers.
What does the Vanta device agent check?
On macOS, Windows, supported Linux distributions, the documented checks include disk encryption, antivirus, screen lock, password manager. Support varies by operating system.
Device identity and security settings, including installed applications used for antivirus and password-manager checks. Vanta says the monitor does not transmit passwords, messages, browsing history, environment variables, or SSH keys. Linux checks are more limited.
Read the vendor's device documentation · checked 2026-09-29
Evidence collection
Available · Vanta describes connected evidence collection, prebuilt and custom controls, policy tools and automated hourly tests.
Scope and limits
Vanta describes connected evidence collection, prebuilt and custom controls, policy tools and automated hourly tests. Public product copy does not establish collection completeness or one interval for every connector.
Auditor workspace
Available · Vanta documents in-product evidence requests, review, comments, information request lists with upload windows and due dates, and an Auditor API for syncing evidence and control statuses with auditor tools.
Scope and limits
Vanta documents in-product evidence requests, review, comments, information request lists with upload windows and due dates, and an Auditor API for syncing evidence and control statuses with auditor tools. Controlled Auditor Views and IRLs may require an upgrade or add-on; the IRL guide lists the feature as an upgrade or add-on. The IRL request-list export is customer-owned: auditors cannot export that list, and some underlying automated test data exports as summaries rather than raw files. The intended CPA must verify its access scope and export path.
Trust center
Available · Trust Center is named in current product packaging; separately scoped AWS Marketplace Trust Center add-ons are recorded in pricingCatalog.
Scope and limits
Trust Center is named in current product packaging; separately scoped AWS Marketplace Trust Center add-ons are recorded in pricingCatalog. Confirm the proposed bundle.
Security questionnaires
Available · Current packaging names Questionnaire Automation in Plus and Professional with different annual allowances; higher allowances and add-ons need scoped confirmation.
Enterprise administration
Available · Vanta documents SSO, role management, and SCIM account lifecycle provisioning.
Scope and limits
Vanta documents SSO, role management, and SCIM account lifecycle provisioning. SCIM may require an upgrade or add-on, so capability is confirmed while contract inclusion still requires verification.
SCIM provisioning
Available · Vanta's current SCIM experience provisions, deprovisions, reactivates, and updates Vanta user roles and teams through WorkOS for Azure, Google Workspace, JumpCloud, and Okta.
Scope and limits
Vanta's current SCIM experience provisions, deprovisions, reactivates, and updates Vanta user roles and teams through WorkOS for Azure, Google Workspace, JumpCloud, and Okta. SCIM may require an upgrade or add-on. For Okta, Vanta currently directs customers to a custom SCIM app until the OIN app supports SCIM.
Continuous control testing
Available · Vanta advertises hourly automated tests.
Scope and limits
Vanta advertises hourly automated tests. This cadence describes testing, not every source collection interval or an automatic resolution of failed controls.
Multi-framework support
Partial · Vanta documents cross-mapping overlapping controls across frameworks (for example, ISO 27001 to SOC 2) so the same evidence satisfies more than one framework, rather than fully independent native control sets per framework; Vanta does not publish which frameworks are natively authored versus mapped.
Funding history
Vanta has raised roughly $504M total across six rounds; the most recent is a $150M Series D led by Wellington Management, announced July 23, 2025, valuing the company at $4.15B (up from $2.45B a year earlier).
How much does Vanta cost?
Vanta's direct plans require quotes; a separate channel lists scoped prices. Vendr reports contracts of $7,500 to $57,207 a year. Your price depends on plan scope, headcount, services, and contract term. Read the Vanta pricing guide.
Price source: view reported prices · checked 2026-10-15
Reported Vanta contracts against similar platforms
- Vanta$7,500–$57,207 · median $20,000
- Hyperproof$22,215–$70,000 · median $41,400
- Drata$9,415–$68,250 · median $25,000
- Secureframe$7,733–$32,575 · median $20,000
Published prices (10)
| Listed item | Price | Scope |
|---|---|---|
| Essentials | From $14,000 / 12-month contract | One compliance framework, Vanta AI Agent, evidence collection, Auditor API and Trust Center; Questionnaire Automation (144 per year) is an optional add-on. AWS Marketplace price applies to a 12-month contract for 1-20 employees. · Source |
| Plus | From $21,500 / 12-month contract | Everything in Essentials plus automated policy onboarding, Access Management and Questionnaire Automation (25 questionnaires per year included, optional upgrade to 144). AWS Marketplace price applies to a 12-month contract for 1-20 employees. · Source |
| Professional | From $23,000 / 12-month contract | Everything in Plus plus Questionnaire Automation (144 per year), risk management, Advanced Trust Center, custom monitoring tests, automated access management, six customizable reports, advanced control management and agentic issue management. AWS Marketplace price applies to a 12-month contract for 1-20 employees. · Source |
| AWS FTR | $7,500 / 12-month contract | AWS Foundational Technical Review module. · Source |
| Trust Center | $6,000 / 12-month contract | Trust Center module for 1-20 employees. · Source |
| Third Party Risk Management | $13,600 / 12-month contract | Up to 50 vendors managed per year. · Source |
| Questionnaire Automation | $10,000 / 12-month contract | 144 questionnaires per year. · Source |
| Questionnaire Automation Advanced | $16,000 / 12-month contract | 288 questionnaires per year. · Source |
| Trust Center Advanced | $10,000 / 12-month contract | Trust Center Advanced module for 1-20 employees. · Source |
| Customer Trust Management | $22,250 / 12-month contract | Trust Center Advanced plus Questionnaire Automation Advanced. · Source |
Vanta's pricing page shows four plans (Essentials, Plus, Professional, and Enterprise) and no dollar amounts. AWS Marketplace prices only Essentials, Plus, and Professional for 1-20 employees, so neither list is a complete rate card. Plan source
Ask for the first-year total, renewal cap, implementation charge, required add-ons, and separate audit fee in writing.
How does Vanta compare with Secureframe, Sprinto, Drata?
| Attribute | VantaThis profile | Comp AI | Iru | Secureframe | Sprinto | Drata |
|---|---|---|---|---|---|---|
| Best for | Cloud-native SaaS teams on mainstream stacks that value a broad integration catalog | Engineering-led teams that value inspectable code or the option to self-host | Teams seeking SOC 2 automation and device management in one platform | Teams that want expert guidance on named Fundamentals, Complete, or Defense packages | Early- to growth-stage SaaS teams seeking guided first-audit preparation | Growth-stage SaaS teams on mainstream stacks that expect to add frameworks over time |
| Observed price | $7,500–$57,207 / year | Not published | Up to $15,000 / year for Compliance Automation | $7,733–$32,575 / year | Not published | $9,415–$68,250 / year |
| G2 rating | 4.6/5 (2,728 reviews) | 4.7/5 (73 reviews) | 4.7/5 (853 reviews) | 4.7/5 (826 reviews) | 4.7/5 (1,685 reviews) | 4.7/5 (1,397 reviews) |
| Integrations | 400+ published | 590+ published | Not published | 300+ published | 300+ published | 300+ published |
| Frameworks | 8 listed | 11 listed | 11 listed | 8 listed | 8 listed | 10 listed |
| Onboarding | guided | guided | guided | guided | bundled expert | guided |
| Auditors here | 36 | 4 | Not published | 12 | 39 | 45 |
| Trust center | Listed | Listed | Listed | Listed | Listed | Listed |
Will Vanta connect to your stack?
Vanta reports 400+ integrations. Check the exact fields, tests, permissions, and plan coverage for each tool you need.
Check 11 named tools
| Tool | Coverage | Scope |
|---|---|---|
| AWS | Listed integration | Vanta documents automated AWS evidence and tests. Source |
| Google Cloud | Listed integration | Vanta documents Google Cloud resource monitoring. Source |
| Microsoft Azure | Listed integration | Vanta documents Azure evidence and tests. Source |
| Okta | Listed integration | Vanta documents its Okta identity connection. Source |
| Google Workspace | Listed integration | Vanta documents a Google Workspace OAuth connection and directory sync. Source |
| Microsoft 365 | Listed integration | Vanta documents an Office 365 connection; Microsoft Entra licensing may be required. Source |
| GitHub | Listed integration | Vanta documents GitHub repository and pull-request evidence. Source |
| Jira | Listed integration | Vanta documents Jira ticket and project evidence. Source |
| Slack | Listed integration | Vanta documents Slack notifications; this is a communication connection, not evidence ingestion. Source |
| Rippling | Listed integration | Vanta documents Rippling HRIS, MDM and background-check sync; selected Rippling products must be active. Source |
| Kandji | Listed integration | Vanta documents a read-only Iru (formerly Kandji) device and user sync, with initial import and hourly refresh. Library read access supplies application metadata. Its public integration page describes Apple devices; Windows field coverage needs confirmation. Source |
Which frameworks does Vanta support?
- SOC 2Verified
- ISO 27001Vanta says
- HIPAAVanta says
- PCI DSSVanta says
- GDPRVanta says
- ISO 42001Vanta says
- EU AI ActVanta says
- NYDFS Part 500Vanta says
Some frameworks use mapped controls rather than native workflows. Confirm the tests and evidence required for each program.
Who does what in a SOC 2 with Vanta?
Vanta
Organizes the listed control, evidence, and audit workflows.
Your team
Owns policies, control decisions, exceptions, and approval of shared evidence.
The CPA firm
Sets audit scope, tests controls independently, and issues the SOC 2 report.
Vanta is not a CPA firm and does not issue the SOC 2 report itself. It collects and organizes evidence and gives an added auditor scoped read access to controls, tests, and documents inside the platform (including importing the auditor's own request list); an independent CPA firm performs the examination and signs the report. Vanta says its Seamless Audit package can include an independent auditor's fee in the platform transaction; confirm the named firm, examination scope, and fee in the proposal.
Which auditors work with Vanta?
36 licensed audit firms in our directory list Vanta experience. Listing experience is not an endorsement.
| Firm | Licence | Peer review |
|---|---|---|
| A-LIGN | Licensed CPA | Pass |
| Schellman | Licensed CPA | Pass |
| Sensiba LLP | Licensed CPA | Pass |
Questions to ask in a Vanta demo
- Which parts of native multi-framework support require another tool or service?
- What is the first-year total, including onboarding, add-ons, and the audit fee?
- What renewal increase and minimum contract term should we put in writing?
- Is the SOC 2 audit contracted with a separate CPA firm, and what does that firm charge?
Vanta FAQ
Where is Vanta based?
Vanta is headquartered in San Francisco, California, United States.
Who runs Vanta?
Christina Cacioppo is the CEO of Vanta.
Who founded Vanta?
Christina Cacioppo and Erik Goldman founded Vanta in 2018.
Does Vanta include the SOC 2 audit?
Vanta is not a CPA firm and does not issue the SOC 2 report itself. It collects and organizes evidence and gives an added auditor scoped read access to controls, tests, and documents inside the platform (including importing the auditor's own request list); an independent CPA firm performs the examination and signs the report. Vanta says its Seamless Audit package can include an independent auditor's fee in the platform transaction; confirm the named firm, examination scope, and fee in the proposal. A licensed CPA firm issues the SOC 2 report.
Is Vanta itself SOC 2 compliant?
Supporting a buyer's SOC 2 program does not establish that Vanta holds a current SOC 2 report. Ask for the vendor's current report during security review.
What does the Vanta device agent check?
The vendor documents checks for disk encryption, antivirus, screen lock, password manager. Supported checks vary by operating system; read its device documentation before installation.
Companies that announced SOC 2 work with Vanta
These companies described earlier work with the platform. Ask which workflows and terms apply to your project.
ASUENE
ASUENE said it used Vanta for security monitoring and evidence collection during the audit.
- Company / product context
- AI sustainability and supply-chain platforms
- Report system / scope
- ASUENE and ASUENE SUPPLY CHAIN
- Role
- Compliance software used during the audit · Vanta
- Report type
- SOC 2 Type 2
- Report period
- Jan 1, 2026–Apr 30, 2026
- Stated issue date
- Jul 22, 2026
The announcement did not name the auditor.
Company announcement · Published Aug 3, 2026 · Checked Sep 26, 2026 · Suggest a factual correction
These are historical company statements, not a current client or subscriber list, an endorsement, or a review of the underlying SOC 2 reports.
Similar platforms
Also listed as alternatives on G2: Scrut Automation, Secureframe, Hyperproof, Sprinto, Thoropass. Observed 2026-09-24; the source controls its own ordering.
Vanta on SOC2Auditors
Sources 63 records · last read 2026-10-15
These links show what we checked and when.
| Establishes | Source | Retrieved |
|---|---|---|
| Vanta says it was founded in 2018 and began with security monitoring for SOC 2, HIPAA and ISO 27001. Company page names Christina Cacioppo as CEO/founder and lists offices without naming a headquarters. | Vanta Vendor docs | 2026-09-30 |
| July 2025 company announcement confirms its $150M Series D and $4.15B valuation. | Vanta Press | 2026-09-29 |
| Vanta-sold 12-month starting costs for Essentials, Plus, and Professional at 1-20 employees, plus seven named module prices and their published scope limits. | AWS Marketplace Marketplace | 2026-08-19 |
| Personalized direct pricing; four plan cards (Essentials, Plus, Professional, Enterprise) and a feature matrix that also contains a separate Pro column. | Vanta Vendor docs | 2026-08-19 |
| Vanta says Seamless Audit can include an independent auditor's cost in one platform transaction; the CPA firm remains responsible for the examination and report. | Vanta Vendor docs | 2026-09-28 |
| Current WorkOS-based SCIM lifecycle for Vanta user accounts, roles, and teams; a separate IdP or HR integration maintains the People roster and employment data. Supported IdPs, add-on caveat, and temporary Okta custom-app requirement. | Vanta Vendor docs | 2026-09-30 |
| 4.6/5 rating; review count (2,665 shown on this page, with other G2 surfaces showing 2,453-2,667 depending on cache/category filter). | G2 Review platform | 2026-07-24 |
| Observed customer contract data: low $7,500, high $57,221, median $20,000/year, from 373 purchases. | Vendr Third-party estimate | 2026-09-10 |
| Observed customer contract data: low $7,500, high $57,207, median $20,000/year, from 374 purchases. | Vendr Third-party estimate | 2026-10-15 |
| Current integration count stated as 400+. | Vanta Vendor docs | 2026-07-24 |
| Customer count and ARR trajectory (16,000+ customers, ~$300M ARR by April 2026) and valuation history. | Sacra Third-party estimate | 2026-07-24 |
| $150M Series D at ~$4B valuation, July 2025, up from $2.45B a year prior. | CNBC Press | 2026-07-24 |
| Corroborates funding history and April 2026 scale figures (1,000 employees, 16,000+ customers, $300M ARR) with citations to Reuters/Bloomberg/CNBC/Forbes. | Wikipedia Editorial | 2026-07-24 |
| User feedback describing Vanta as expensive for what it delivers and not startup-friendly despite marketing. A startup with under 10 employees posted a 2/5 review: the integrations worked, but it was locked into a two-year contract and Vanta would not let it exit when its finances changed. A commenter called switching to Vanta for HITRUST, SOC 2, and HIPAA a roughly $14,000 mistake, said implementation help came through Workstreet and was limited to about 30 days, and said Vanta refused every mid-contract cancellation proposal. Another commenter at a small company brought in a vCISO team through a Vanta partnership. | Reddit r/soc2 Editorial | 2026-10-15 |
| A 2023 comment from an early Vanta customer who says the product was over-promised and under-delivered and who left for another platform. The commenter adds that this was a while back and some of it may be fixed by now. | Reddit r/cybersecurity Editorial | 2026-10-15 |
| Vanta's own comparison claims hourly test cadence versus Drata's daily cadence (vendor-authored, treat as a claim rather than independently verified). | Vanta Vendor docs | 2026-07-24 |
| Customer-questionnaire response workflow and usage evidence; product claims are not independent performance tests. | Vanta Vendor docs | 2026-08-30 |
| The Plus plan includes AI-powered Questionnaire Automation for 25 questionnaires per year; Professional includes 144 per year. These are direct-plan allowances, separate from Marketplace add-on price dimensions. | Vanta Vendor docs | 2026-08-31 |
| Vendor-claimed HIPAA workflow: automated evidence, scoped controls, policy templates, risk-assessment organization, training, and vendor BAA document collection. | Vanta Vendor docs | 2026-08-31 |
| Vanta's July 2026 release notes describe an in-product audit workflow with auditor-scoped views and customer-controlled evidence visibility. This establishes a workflow feature, not a CPA engagement or a report outcome. | Vanta Vendor docs | 2026-08-31 |
| Current direct plan page was read; retain the existing plan taxonomy evidence. | Vanta Vendor docs | 2026-08-31 |
| The 12-month Marketplace dimensions list Essentials at $14,000, Plus at $21,500, and Professional at $23,000 for 1-20 employees, plus separately scoped modules. | AWS Marketplace Marketplace | 2026-08-31 |
| The 12-month Marketplace dimensions list Essentials at $14,000, Plus at $21,500, and Professional at $23,000 for 1-20 employees, plus separately scoped modules. | AWS Marketplace Marketplace | 2026-10-15 |
| Vanta's pricing page shows four plans (Essentials, Plus, Professional, and Enterprise) and no dollar amounts. AWS Marketplace prices only Essentials, Plus, and Professional for 1-20 employees, so neither list is a complete rate card. | Vanta Vendor docs | 2026-10-15 |
| Vanta's informational Terms FAQ prohibits PHI uploads and says Vanta does not sign customer BAAs. The FAQ is not part of the MSA; confirm signed terms and actual data flow. | Vanta Vendor docs | 2026-08-31 |
| Current public integration directory names featured and catalog connectors by product category. | Vanta Vendor docs | 2026-09-24 |
| Current help collection names setup guides for HR, identity, source-control, and other Vanta integrations. | Vanta Vendor docs | 2026-09-24 |
| Current legal terms identify Vanta Inc. and its San Francisco business address. | Vanta Vendor docs | 2026-09-24 |
| Current company article states that Vanta serves more than 15,000 customers worldwide. | Vanta Vendor docs | 2026-09-24 |
| Current Vanta alternatives page names Scrut Automation, Secureframe, Hyperproof, Sprinto and Thoropass among peer products. | G2 Review platform | 2026-09-24 |
| Vanta documents automated AWS evidence and tests. | Vanta Vendor docs | 2026-09-29 |
| Vanta documents Google Cloud resource monitoring. | Vanta Vendor docs | 2026-09-29 |
| Vanta documents Azure evidence and tests. | Vanta Vendor docs | 2026-09-29 |
| Vanta documents its Okta identity connection. | Vanta Vendor docs | 2026-09-29 |
| Vanta documents a Google Workspace OAuth connection and directory sync. | Vanta Vendor docs | 2026-09-29 |
| Vanta documents an Office 365 connection; Microsoft Entra licensing may be required. | Vanta Vendor docs | 2026-09-29 |
| Vanta documents GitHub repository and pull-request evidence. | Vanta Vendor docs | 2026-09-29 |
| Vanta documents Jira ticket and project evidence. | Vanta Vendor docs | 2026-09-29 |
| Vanta documents Slack notifications; this is a communication connection, not evidence ingestion. | Vanta Vendor docs | 2026-09-29 |
| Vanta documents Rippling HRIS, MDM and background-check sync; selected Rippling products must be active. | Vanta Vendor docs | 2026-09-29 |
| G2 seller listing shows 4.6/5 from 2,728 reviews; snapshot retrieved 2026-09-29. | G2 Review platform | 2026-09-29 |
| Vanta documents the device monitor checks, data it reads, and supported operating systems. | Vanta Vendor docs | 2026-09-29 |
| Supported operating systems and monitoring setup for the employee device agent. | Vanta Vendor docs | 2026-09-29 |
| A Y Combinator company listing identifies Erik Goldman as a Vanta co-founder. | Y Combinator Company directory | 2026-09-29 |
| Sequoia describes Christina Cacioppo building Vanta with a co-founder. | Sequoia Capital Press | 2026-09-29 |
| CEO Christina Cacioppo described Vanta serving 16,000 customers in April 2026. | Vanta Vendor docs | 2026-09-29 |
| Vanta's 2021 release names San Francisco as headquarters, and its current privacy policy gives a San Francisco mailing address. | Vanta Press | 2026-09-29 |
| Observed annual Vanta contracts span $7,500-$57,221, with a $20,000 median across 373 purchases. These are unmatched procurement observations, not a public rate card or a same-scope comparison. | Vendr Third-party estimate | 2026-09-30 |
| G2's seller page lists one Vanta product profile, rated 4.6/5 across 2,728 reviews. The sample is not a controlled comparison with another platform. | G2 Review platform | 2026-09-30 |
| Direct-site Essentials, Plus, Professional and Enterprise require personalized pricing. Professional lists custom monitoring tests and automation, automated access management and advanced control management. A negotiated order must establish custom-source scope, limits and implementation work. | Vanta Vendor docs | 2026-09-30 |
| Auditors can review evidence, exchange requests and comments and use information request lists; Auditor API supports synchronization of evidence and control statuses with auditor tools. Listing does not establish that the intended CPA uses the integration. | Vanta Vendor docs | 2026-09-30 |
| Vanta documents read-only Devices and Users access to Iru, optional Library reads, initial import and hourly sync, manual resync, and no writes to the Iru environment. | Vanta Help Center Vendor docs | 2026-09-30 |
| Vanta uses the Iru EDR Library Item as an antivirus signal and the Applications list for supported antivirus and password-manager software. XProtect is not exposed as a detected application through Iru; Vanta says manual per-device evidence may be supplied subject to the auditor requirements. | Vanta Help Center Vendor docs | 2026-09-30 |
| The Iru integration catalog page describes Apple-device posture checks for encryption, screen lock, endpoint protection, inventory ownership, and password managers. It does not establish Windows field parity. | Vanta Vendor docs | 2026-09-30 |
| Controlled Auditor Views and information request lists scope the auditor population data; Vanta says these features may require an upgrade or add-on. | Vanta Vendor docs | 2026-09-30 |
| Information Request Lists are available as an upgrade or add-on. The customer can export the request list and attached evidence as a ZIP; auditors cannot export that list. Some underlying automated test data is represented as a summary rather than a raw file. Auditors can separately export controls and control activity. | Vanta Vendor docs | 2026-09-30 |
| Vanta describes a third-party risk workflow with vendor inventory, intake, evidence reviews and procurement decisions; availability and limits depend on the proposed package. | Vanta Vendor docs | 2026-09-30 |
| The Vendors page is included on all plans, while some Third Party Risk Management features, including custom assessment types, are available only as an add-on. | Vanta Help Center Vendor docs | 2026-09-30 |
| Current compliance page describes automated hourly tests, connected evidence, prebuilt/custom controls, AI test mapping, policy customization/acknowledgements and an in-app roadmap. Cadence and automation are vendor claims, not proof for every source or an audit outcome. | Vanta Vendor docs | 2026-09-30 |
| Risk Management describes an organizational risk register, inherent/residual scoring, treatment and control linkage. This is distinct from supplier assessments; exact plan entitlements need a quote. | Vanta Vendor docs | 2026-09-30 |
| The May 6, 2026 guide documents section-by-section exports, no single all-data export, no bulk historical automated-test export across all tests, and no evidence-upload timestamps in the controls CSV. It does not establish complete migration continuity or access after cancellation. | Vanta Help Center Vendor docs | 2026-10-02 |
| Audit-workflow scope, permissions, exports or explicitly unestablished entitlement; see the field-specific auditWorkflow notes. | Vanta Vendor docs | 2026-09-30 |
| Agent Guided Flows article dated July 29, 2026 describes account-dependent SOC 2 setup, remediation, policy/risk/vendor assistance and a rolling-out compliance-program import flow. Availability requires current-plan/AI access; new imported records do not update existing ones. | Vanta Vendor docs | 2026-09-30 |