{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"vanta","name":"Vanta","domain":"vanta.com","category":"Compliance and GRC","one_liner":"Vanta—the proven leader in automated compliance helping startups…","trust_center_url":"https://trust.vanta.com/","security_page_url":null,"url":"https://certreports.com/vendors/vanta/security","last_verified_at":"2026-09-17T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 17 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 2 Type II on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/vanta/soc-2","evidence":[{"source_type":"trust_center","source_name":"Vanta trust centre (Vanta)","url":"https://trust.vanta.com/","fetched_at":"2026-09-17 16:27:40.587068+00","content_hash":"b27a58f968e74f4ab4ee91e6553cfe533449371c968df2df6aa7a8dd4ba38905","wayback_url":null,"quote":"SOC 2 Type II","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/vanta/gdpr","evidence":[{"source_type":"trust_center","source_name":"Vanta trust centre (Vanta)","url":"https://trust.vanta.com/","fetched_at":"2026-09-17 16:27:40.587068+00","content_hash":"b27a58f968e74f4ab4ee91e6553cfe533449371c968df2df6aa7a8dd4ba38905","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"fedramp","framework_name":"FedRAMP","state":"verified_registry","state_label":"Verified","sentence":"Listed in the FedRAMP Marketplace as of 17 Sep 2026.","kind":"authorization","status_text":"FedRAMP Authorized","issued_at":"2026-04-24","expires_at":null,"period_start":null,"period_end":null,"auditor":"Schellman Compliance, LLC","impact_level":"20x Moderate","as_of":"2026-09-17","under_review":false,"source":"fedramp","url":"https://certreports.com/vendors/vanta/fedramp","evidence":[{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/FR2525556241XM","fetched_at":"2026-09-17 15:44:39.301965+00","content_hash":"395e7ad35dd25d1c547414140161c47ec22827b7ffae3bdbbd5256c38a3b940f","wayback_url":null,"quote":"Vanta - Vanta Government Cloud: FedRAMP Authorized","confidence":1}]},{"framework":"pci-dss","framework_name":"PCI DSS","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a PCI DSS attestation of compliance on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states PCI DSS 4.0.1 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/vanta/pci-dss","evidence":[{"source_type":"trust_center","source_name":"Vanta trust centre (Vanta)","url":"https://trust.vanta.com/","fetched_at":"2026-09-17 16:27:40.587068+00","content_hash":"b27a58f968e74f4ab4ee91e6553cfe533449371c968df2df6aa7a8dd4ba38905","wayback_url":null,"quote":"PCI DSS 4.0.1","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/vanta/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Vanta trust centre (Vanta)","url":"https://trust.vanta.com/","fetched_at":"2026-09-17 16:27:40.587068+00","content_hash":"b27a58f968e74f4ab4ee91e6553cfe533449371c968df2df6aa7a8dd4ba38905","wayback_url":null,"quote":"ISO 27001:2022","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"verified_registry","state_label":"Verified","sentence":"Listed in the CSA STAR registry as of 17 Sep 2026.","kind":"self_assessment","status_text":"STAR Level 1 self-assessment (CAIQ), Trusted Cloud Provider","issued_at":"2023-09-07","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/vanta/csa-star","evidence":[{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/vanta","fetched_at":"2026-09-17 15:44:42.254747+00","content_hash":"e7f124247f5399c92ba048620a83c0b6cca1f9a2f97419f32566e462a3b1bda7","wayback_url":null,"quote":"vanta: STAR Level 1 self-assessment (CAIQ), Trusted Cloud Provider","confidence":1}]},{"framework":"iso-27701","framework_name":"ISO/IEC 27701","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27701 certificate on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27701 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/vanta/iso-27701","evidence":[{"source_type":"trust_center","source_name":"Vanta trust centre (Vanta)","url":"https://trust.vanta.com/","fetched_at":"2026-09-17 16:27:40.587068+00","content_hash":"b27a58f968e74f4ab4ee91e6553cfe533449371c968df2df6aa7a8dd4ba38905","wayback_url":null,"quote":"ISO 27701","confidence":1}]},{"framework":"iso-42001","framework_name":"ISO/IEC 42001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 42001 certificate on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 42001:2023 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/vanta/iso-42001","evidence":[{"source_type":"trust_center","source_name":"Vanta trust centre (Vanta)","url":"https://trust.vanta.com/","fetched_at":"2026-09-17 16:27:40.587068+00","content_hash":"b27a58f968e74f4ab4ee91e6553cfe533449371c968df2df6aa7a8dd4ba38905","wayback_url":null,"quote":"ISO/IEC 42001:2023","confidence":1}]},{"framework":"iso-27017","framework_name":"ISO/IEC 27017","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27017 certificate on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27017 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/vanta/security","evidence":[{"source_type":"trust_center","source_name":"Vanta trust centre (Vanta)","url":"https://trust.vanta.com/","fetched_at":"2026-09-17 16:27:40.587068+00","content_hash":"b27a58f968e74f4ab4ee91e6553cfe533449371c968df2df6aa7a8dd4ba38905","wayback_url":null,"quote":"ISO 27017","confidence":1}]},{"framework":"iso-27018","framework_name":"ISO/IEC 27018","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27018 certificate on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27018 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/vanta/security","evidence":[{"source_type":"trust_center","source_name":"Vanta trust centre (Vanta)","url":"https://trust.vanta.com/","fetched_at":"2026-09-17 16:27:40.587068+00","content_hash":"b27a58f968e74f4ab4ee91e6553cfe533449371c968df2df6aa7a8dd4ba38905","wayback_url":null,"quote":"ISO 27018","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 17 Sep 2026.","kind":"listing","status_text":"Active: EU-US Certification, SW-US Certification, UK Extension Certification","issued_at":"2018-01-14","expires_at":"2027-03-24","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/vanta/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/7916","fetched_at":"2026-09-17 15:50:20.364227+00","content_hash":"0e8a8281f7d054e21108627592bead1e9494002f9a230e9003e45433ce715672","wayback_url":null,"quote":"Vanta: Active: EU-US Certification, SW-US Certification, UK Extension Certification","confidence":1}]},{"framework":"ccpa","framework_name":"CCPA / CPRA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an CCPA / CPRA privacy notice on its trust centre (Vanta) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states CCPA on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/vanta/security","evidence":[{"source_type":"trust_center","source_name":"Vanta trust centre (Vanta)","url":"https://trust.vanta.com/","fetched_at":"2026-09-17 16:27:40.587068+00","content_hash":"b27a58f968e74f4ab4ee91e6553cfe533449371c968df2df6aa7a8dd4ba38905","wayback_url":null,"quote":"CCPA","confidence":1}]}],"brief":{"summary":"As of 17 Sep 2026, Vanta states on its trust centre that it holds SOC 2 Type II reporting, GDPR alignment, PCI DSS 4.0.1, ISO 27001:2022, ISO 27701, ISO/IEC 42001:2023, ISO 27017, ISO 27018, and CCPA coverage, though these are vendor-asserted rather than independently verified in the supplied rows. As of 17 Sep 2026, Vanta is listed in the FedRAMP registry as FedRAMP Authorized, with an authorization issue date of 24 Apr 2026 and Schellman Compliance, LLC named as auditor. As of 17 Sep 2026, Vanta is listed in the CSA STAR registry at STAR Level 1 self-assessment (CAIQ) as a Trusted Cloud Provider, with an issue date of 7 Sep 2023. As of 17 Sep 2026, Vanta is listed in the EU-US Data Privacy Framework registry as active across EU-US, Swiss-US, and UK Extension certifications, issued 14 Jan 2018 and expiring 24 Mar 2027. No public evidence of a HIPAA BAA offering was found in the supplied rows as of 17 Sep 2026.","bullets":["FedRAMP: listed in FedRAMP registry as FedRAMP Authorized, issued 24 Apr 2026, auditor Schellman Compliance, LLC (as of 17 Sep 2026).","CSA STAR: listed in CSA STAR registry at Level 1 self-assessment (CAIQ), Trusted Cloud Provider, issued 7 Sep 2023 (as of 17 Sep 2026).","EU-US Data Privacy Framework: listed in DPF registry as active (EU-US, Swiss-US, UK Extension), issued 14 Jan 2018, expires 24 Mar 2027 (as of 17 Sep 2026)."],"model":"claude-sonnet-5","generated_at":"2026-09-17 18:33:57.074841+00"},"legal_docs":[{"kind":"subprocessors","url":"https://trust.vanta.com/","availability":"public","detail":"43 subprocessors listed on the trust centre","as_of":"2026-09-17"},{"kind":"privacy","url":"https://www.vanta.com/privacy","availability":"public","detail":null,"as_of":"2026-09-17"}],"subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Infrastructure Hosting","location":"US, EU or AUS","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Anthropic","domain":"anthropic.com","purpose":"Application AI Functionality","location":"US","vendor_url":null},{"name":"Browserbase","domain":"browserbase.com","purpose":"Application AI Functionality","location":"US","vendor_url":null},{"name":"Chameleon Intelligent Tech, Inc.","domain":"chameleon.io","purpose":"Application notifications","location":"US","vendor_url":"https://certreports.com/vendors/chameleon-intelligent-tech/security"},{"name":"Cloudflare","domain":"cloudflare.com","purpose":"Hosting and Content Delivery","location":"US, EU","vendor_url":"https://certreports.com/vendors/cloudflare/security"},{"name":"Coefficient.io","domain":"coefficient.io","purpose":"Analytics & Reporting","location":"US","vendor_url":null},{"name":"Cohere","domain":"cohere.com","purpose":"Monitoring and Evaluation of AI Product Features","location":"US","vendor_url":null},{"name":"Confluent","domain":"confluent.io","purpose":"Platform Data Streaming","location":"US","vendor_url":"https://certreports.com/vendors/confluent/security"},{"name":"Courier","domain":"courier.com","purpose":"Customer Notification Delivery","location":"US","vendor_url":"https://certreports.com/vendors/courier/security"},{"name":"Dagster Labs","domain":"dagster.io","purpose":"Data pipeline orchestration","location":"US","vendor_url":null},{"name":"Datadog","domain":"datadoghq.com","purpose":" Logging & Monitoring","location":"US","vendor_url":"https://certreports.com/vendors/datadog/security"},{"name":"e2b","domain":"e2b.dev","purpose":"Application AI Functionality","location":"US","vendor_url":null},{"name":"Finch","domain":"tryfinch.com","purpose":"HR Platform Integration Tool (customer optional)","location":"US","vendor_url":"https://certreports.com/vendors/finch/security"},{"name":"Fivetran","domain":null,"purpose":"Logging & Monitoring","location":"US","vendor_url":null},{"name":"Google","domain":"google.com","purpose":"Application AI Functionality","location":"US","vendor_url":null},{"name":"Hatchet.run","domain":"hatchet.run","purpose":"Workflow Orchestration","location":"US","vendor_url":"https://certreports.com/vendors/hatchet/security"},{"name":"Heap Inc.","domain":"heap.io","purpose":"Application Analytics","location":"US","vendor_url":"https://certreports.com/vendors/heap/security"},{"name":"Intercom","domain":"intercom.com","purpose":"Customer Support Tool","location":"US","vendor_url":"https://certreports.com/vendors/intercom/security"},{"name":"kernel.sh","domain":"kernel.sh","purpose":"Application AI Functionality","location":"US","vendor_url":"https://certreports.com/vendors/kernel/security"},{"name":"Lakera","domain":"lakera.ai","purpose":"AI Security","location":"US","vendor_url":null},{"name":"Langchain (using Langsmith product)","domain":"langchain.com","purpose":"Monitoring and Evaluation of AI product Features","location":"US","vendor_url":null},{"name":"Merge.dev","domain":"merge.dev","purpose":"Platform Integration Tool (customer optional)","location":"US","vendor_url":"https://certreports.com/vendors/merge-api-inc/security"},{"name":"Microsoft","domain":"microsoft.com","purpose":"Application AI Functionality","location":"US","vendor_url":"https://certreports.com/vendors/microsoft/security"},{"name":"Mongo DB Inc.","domain":"mongodb.com","purpose":"Database Hosting","location":"US, EU or AUS","vendor_url":"https://certreports.com/vendors/mongodb/security"},{"name":"OneSchema","domain":"oneschema.co","purpose":"CSV Importer (customer optional)","location":"US","vendor_url":"https://certreports.com/vendors/oneschema/security"},{"name":"OpenAI, LLC","domain":"openai.com","purpose":"Application AI Functionality","location":"US","vendor_url":"https://certreports.com/vendors/openai/security"},{"name":"Polytomic","domain":"polytomic.com","purpose":"Data Integration and Streaming","location":"US","vendor_url":"https://certreports.com/vendors/polytomic/security"},{"name":"Qlik","domain":"qlik.com","purpose":"Analytics support","location":"US","vendor_url":"https://certreports.com/vendors/qliktech/security"},{"name":"reducto.ai","domain":"reducto.ai","purpose":"Document Parsing Tool","location":"US","vendor_url":"https://certreports.com/vendors/reducto/security"},{"name":"Riskey Technologies Ltd.","domain":"riskey.io","purpose":"Region local Vanta entity","location":null,"vendor_url":null},{"name":"Salesforce","domain":"salesforce.com","purpose":"Subscription Management","location":"US","vendor_url":null},{"name":"Secoda.co","domain":"secoda.co","purpose":"Data Cataloging and Analysis","location":"US","vendor_url":"https://certreports.com/vendors/secoda/security"},{"name":"Sigma","domain":"sigmacomputing.com","purpose":"BI Analytics","location":"US","vendor_url":"https://certreports.com/vendors/sigma-computing/security"},{"name":"Snowflake Inc.","domain":"snowflake.com","purpose":"Data Warehouse","location":"US","vendor_url":"https://certreports.com/vendors/snowflake/security"},{"name":"Statsig","domain":"statsig.com","purpose":"Product Analytics","location":"US","vendor_url":null},{"name":"svix","domain":"svix.com","purpose":"Webhook Delivery","location":"US","vendor_url":"https://certreports.com/vendors/svix/security"},{"name":"Tableau","domain":"tableau.com","purpose":"Data Visualization Platform","location":"US","vendor_url":"https://certreports.com/vendors/tableau-software/security"},{"name":"Vanta Technology Australia Pty Limited","domain":"vanta.com","purpose":"Region local Vanta entity","location":null,"vendor_url":"https://certreports.com/vendors/vanta/security"},{"name":"Vanta Technology Canada Limited","domain":"vanta.com","purpose":"Region local Vanta entity","location":null,"vendor_url":"https://certreports.com/vendors/vanta/security"},{"name":"Vanta Technology Ireland I Limited","domain":"vanta.com","purpose":"Region local Vanta entity","location":null,"vendor_url":"https://certreports.com/vendors/vanta/security"},{"name":"Vanta Technology UK Limited","domain":"vanta.com","purpose":"Region local Vanta entity","location":null,"vendor_url":"https://certreports.com/vendors/vanta/security"},{"name":"WorkOS","domain":"workos.com","purpose":"SCIM integration (customer optional)","location":"US ","vendor_url":null},{"name":"Zapier","domain":null,"purpose":"Workflow Automation","location":"US","vendor_url":null}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-18T17:29:41.595Z"}