Vanta
Compliance · vanta.com · last read 2026-10-12
Identity
| Legal entity | Vanta Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | vanta.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | help.vanta.com | 2026-10-08 |
EU: The document says Vanta offers regional hosting in the EU (app.eu.vanta.com), but an organization based in Europe may still use the US region unless it requested an EU tenant. It names no plan and no cost for EU hosting.
Subprocessor chain
38 third parties · 5 of the vendor's own group companies · 38 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services | US, EU, AU | Infrastructure Hosting |
| Anthropic | US | Application AI Functionality |
| Browserbase | US | Application AI Functionality |
| Chameleon Intelligent Tech, Inc. | US | Application notifications |
| Cloudflare | US, EU | Hosting and Content Delivery |
| Coefficient.io | US | Analytics & Reporting |
| Cohere | US | Monitoring and Evaluation of AI Product Features |
| Confluent | US | Platform Data Streaming |
| Courier | US | Customer Notification Delivery |
| Dagster Labs | US | Data pipeline orchestration |
| Datadog | US | Logging & Monitoring |
| e2b | US | Application AI Functionality |
| Finch | US | HR Platform Integration Tool (customer optional) |
| Fivetran | US | Logging & Monitoring |
| US | Application AI Functionality | |
| Hatchet.run | US | Workflow Orchestration |
| Heap Inc. | US | Application Analytics |
| Intercom | US | Customer Support Tool |
| kernel.sh | US | Application AI Functionality |
| Lakera | US | AI Security |
| Langchain (using Langsmith product) | US | Monitoring and Evaluation of AI product Features |
| Merge.dev | US | Platform Integration Tool (customer optional) |
| Microsoft | US | Application AI Functionality |
| Mongo DB Inc. | US, EU, AU | Database Hosting |
| OneSchema | US | CSV Importer (customer optional) |
| OpenAI, LLC | US | Application AI Functionality |
| Polytomic | US | Data Integration and Streaming |
| Qlik | US | Analytics support |
| reducto.ai | US | Document Parsing Tool |
| Salesforce | US | Subscription Management |
| Secoda.co | US | Data Cataloging and Analysis |
| Sigma | US | BI Analytics |
| Snowflake Inc. | US | Data Warehouse |
| Statsig | US | Product Analytics |
| svix | US | Webhook Delivery |
| Tableau | US | Data Visualization Platform |
| WorkOS | US | SCIM integration (customer optional) |
| Zapier | US | Workflow Automation |
Vanta's own group companies listed as subprocessors (5)
| Company | Country | Purpose |
|---|---|---|
| Riskey Technologies Ltd. | — | Region local Vanta entity |
| Vanta Technology Australia Pty Limited | — | Region local Vanta entity |
| Vanta Technology Canada Limited | — | Region local Vanta entity |
| Vanta Technology Ireland I Limited | — | Region local Vanta entity |
| Vanta Technology UK Limited | — | Region local Vanta entity |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · vanta.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 10 days before a new sub-processor processes Personal Data: added to the list at trust.vanta.com/subprocessors and notified to subscribers. Customers who do not subscribe waive prior notice. |
| If you object to one | Customer may object in writing within 10 days of receiving notice, on reasonable data-protection grounds. Without an objection in that time, the third party is deemed a sub-processor. |
| If you object to one | If Vanta cannot offer a commercially reasonable alternative within a reasonable time, Customer may stop using the affected Service by written notice. Fees owed are still due. |
| Breach notification | without undue delay |
| Transfer impact assessment | No TIA document is provided; for transfers out of the EEA, UK or Switzerland, the parties meet as needed to consider whether the importer country's laws give broadly equivalent protection, whether extra measures are needed, and whether the transfer is still appropriate |
| Audit | Certifications/reports via Vanta's Trust Center on written request; if insufficient, an audit or inspection on reasonable prior written notice, during business hours, no more than once per calendar year, limited to the customer's data, at the customer's cost (including reimbursing Vanta's time) |
| Audit | Right to review, audit and copy Vanta's compliance records at Vanta's offices during regular business hours, with reasonable notice |
| Audit | To the extent required by CCPA, customer may conduct inspections or audits per Sections 8.3 and 8.4 of the DPA |
| Audit | audits under Clause 8.9 of the EU SCCs are carried out in accordance with Section 8.4 of the DPA |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| ISO 27001 · ISO27001 | Available on request | — | vanta.com | 2026-10-08 |
| Privacy Shield | Claimed | — | vanta.com | 2026-10-08 |
| SOC 2 Type II · SOC2T2 | Available on request | — | vanta.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Vanta | Active | HR data, non-HR data | 2027-03-24 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Vanta | Active | HR data, non-HR data | 2027-03-24 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Vanta | Active | HR data, non-HR data | 2027-03-24 | 2026-10-09 |
| FedRAMP Marketplace (US) | Vanta Government Cloud · Vanta | FedRAMP Authorized | 20x Moderate | — | 2026-10-09 |
| FedRAMP Marketplace (US) | Vanta Trust Management Platform · Vanta | FedRAMP Authorized | 20x Low | — | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-09, no entry under Vanta; Vanta Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-09, no entry under Vanta; Vanta Inc.
- Data Privacy Framework List (US): checked 2026-10-09, 3 entries under Vanta; Vanta Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-09, no entry under Vanta; Vanta Inc.
- FedRAMP Marketplace (US): checked 2026-10-09, 2 entries under Vanta; Vanta Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-09, no entry under Vanta; Vanta Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2026-11-15; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | JavaScript only | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.