Q37
Do you have a current SOC 2 Type II report?
SOC 2 Type II: Vendor attested — trust page
Public evidencemedium confidence
Vanta Vendor Risk & Security Assessment
ThirdProof independently checks public intelligence sources to show what your team can verify about Vanta before Vanta sends a questionnaire or a security document.
Vanta's SOC 2 report is confidential. There is no public registry for SOC 2, so the report itself has to come from Vanta — ThirdProof does not hold or distribute it. What this page gives you is an independent assessment built from evidence anyone can check, and a record of which certifications are registry-verified versus claimed on Vanta's own trust page.
⚠ Vanta was not found in the FedRAMP Marketplace. Checked August 2026.
This matters if you place federal workloads with this vendor: agencies may only use cloud services holding a FedRAMP certification. It carries no weight for a purely commercial deployment.
Risk
Tier 4 — Low RiskEvidence confidence
100%27 of 27 sources returned data
Questionnaire
111 / 133 answered83% from public evidence
Last assessed
Aug 27, 2026Evidence confidence measures how much of the evidence ThirdProof set out to gather it was able to gather and corroborate. It is not a statement that every fact about this vendor is known.
🟡IP Reputation: Abuse score: 37%, 11 reports🟡SSL/TLS: TLSv1.3🟢Domain Age: 24 years🟢Infrastructure: 13 open ports, 0 CVEs
- FedRAMP Status
- Vanta is not listed on the FedRAMP Marketplace (checked August 2026).
- SOC 2 Status
- Vanta — SOC 2: Vendor attested — trust page. SOC 2 reports are confidential with no public registry, so compliance status is not publicly verifiable. Request the full Type II report and bridge letter directly from the vendor.
- Sanctions Screening
- Vanta returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
- Risk Tier
- ThirdProof assigned Vanta a Low Risk tier across 27 intelligence sources, 27 of which returned usable evidence (evidence confidence 100%).
27 sources queried, 27 returning usable evidence. The Vanta assessment ThirdProof has already run covers both a risk report and an auto-filled security questionnaire, with anything the evidence could not settle listed as an open question.
Get the Latest Vanta Vendor Assessment →Full risk assessment + 133-question security questionnaire|Free · Delivered by email
Certification & Compliance Status
Security questionnaire — auto-filled
111 questions answered before Vanta responds.
ThirdProof used public evidence to pre-fill 83% of a 133-question vendor security questionnaire — without waiting for Vanta. The remaining 22 are listed as open, so the follow-up you send is short and specific.
Q42
Are you GDPR compliant? Do you have a DPA available?
GDPR compliance / DPA claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q40
Are you HIPAA compliant? Do you sign BAAs?
HIPAA compliance / BAA claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q23
Is data encrypted at rest? What encryption standard is used (e.g., AES-256)?
Encryption at rest claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q38
Do you have ISO 27001 certification?
ISO 27001 claim found on trust page (Vendor attested)
Public evidencemedium confidence
+ 106 additional evidence-backed answers
Get the Complete Vanta Assessment →
See all 133 questions, evidence links, findings, and the vendor follow-ups still required.
What you can verify before Vanta sends anything
Independent evidence settles part of the review. The rest still needs the vendor.
Public evidence establishes
- No Sanctions Matches Found
- No SEC Enforcement Filings Found
- Vendor Commits to Not Training on Customer Data
- Clean domain reputation
- Clean Safe Browsing Status
Still requires vendor confirmation
- Current SOC 2 report and its audit scope
- Data Security — 4 of 14 questions need vendor input
- Access Control — 3 of 12 questions need vendor input
- Incident Response — 3 of 10 questions need vendor input
- Compliance & Certifications — 2 of 14 questions need vendor input
Reviewing Vanta for your company?
Get the complete ThirdProof assessment now, then use the same workflow to assess the rest of your vendor stack.
5 vendors free · No credit card
Need ongoing vendor reviews? ThirdProof includes up to 50 vendor assessments per month for $399. See pricing
Executive Summary
Narrative analysis for Vanta
Vanta is a SaaS-based compliance automation platform that has earned a Low Risk (Tier 4) rating based on comprehensive independent evidence assessment.
Area Requiring Attention
The vendor demonstrates strong security fundamentals across governance, access controls, data protection, and incident response — with a designated CISO (Jadee Hanson), annual risk assessments, multi-factor authentication enforcement, encryption at rest and in transit, daily/weekly backups with periodic testing, 24/7 monitoring, and a formal incident response plan with 72-hour breach notification commitment. Positive signals include a 23-year-old established domain, clean threat intelligence reputation (no malware blacklist listings), TLS 1.3 encryption, a 99% monthly uptime SLA, annual penetration testing by independent third parties, a vulnerability disclosure program with private bug bounty, and an explicit commitment to not train AI models on customer data.
The full risk rationale, every finding and the recommended vendor follow-ups are in the complete assessment below.
Independence Statement
All evidence was independently sourced from external data sources without vendor participation or influence.
Investigation Findings
4 findings identified for Vanta
4 low
low
13 open ports detected
Vanta's infrastructure (IP 198.202.211.1) exposes 13 open ports: 80, 443 (HTTPS/HTTP), 2052, 2053, 2082, 2083, 2086, 2087, 2095, 2096 (Cloudflare service ports), 8080, 8443, 8880 (HTTP variants). While these are standard web and CDN infrastructure services, the breadth of the attack surface warrants verification that all exposed services are necessary and actively monitored.
low
Subprocessor page contains placeholder content
Vanta maintains a subprocessor page at https://vanta.com/privacy/subprocessors but it currently contains placeholder content with no individual subprocessors listed (0 entries extracted). For a vendor with medium data access, a current, detailed subprocessor list is a material due diligence requirement under GDPR Article 28 and equivalent data protection laws.
low
3 certifications claimed but not independently verified
Vanta's [trust page](https://vanta.com/security) claims SOC 2, ISO 27001, and GDPR compliance, but independent registry verification (FedRAMP Marketplace, IAF CertSearch, HITRUST directory) could not confirm these certifications. ISO 27001 in particular was not found in the public IAF certification search. …
low
Threat intelligence pulses detected
Vanta's domain appears in 18 threat intelligence pulses within the Open Threat Exchange (OTX). Review of pulse content shows references to phishing campaigns, malware variants, and threat research — not indicators of malicious behavior by Vanta itself. …
Showing the 4 most severe of 5 findings.
✓
Security Strengths
Evidence that positively supports Vanta's posture
Neutral observations, source coverage notes and items ThirdProof could not independently establish are recorded separately in the complete assessment — they are not counted as strengths.
✓
No Sanctions Matches Found
Sanctions & Watchlist Screening →✓
No SEC Enforcement Filings Found
SEC Filing Search →✓
Vendor Commits to Not Training on Customer Data
AI Data Usage Policy →✓
Clean domain reputation
Threat Intelligence →✓
Clean Safe Browsing Status
Malware & Phishing Check →✓
Clean Website Security Scan
Website Security Scan →✓
Established Domain (23+ years)
Domain Registration →Vanta complete vendor assessment
Tier 4
Low Risk
111 / 133
questionnaire answers
27
sources checked
Aug 27, 2026
assessment date
- Complete 133-question security questionnaire
- Evidence behind every answered item
- Full findings and risk rationale
- Recommended vendor follow-ups
- Source and evidence inventory
- Source-cited PDF assessment
Risk tiers are set by a deterministic rules engine. AI summarises sourced evidence and writes the narrative; it does not assign the tier. Read the full methodology.
Frequently asked about Vanta
Is Vanta FedRAMP authorized?+
Vanta was not found in the FedRAMP Marketplace when it was checked on August 27, 2026. Absence of a public record is not evidence that the certification is absent; organisations with a hard requirement should confirm directly with the vendor.
Does Vanta have SOC 2 Type II?+
Vanta states that it maintains SOC 2 on its trust page. Because SOC 2 reports are generally confidential and there is no public SOC 2 registry, ThirdProof classifies this as vendor-attested until the current report and its scope have been reviewed. Request the report directly to confirm the audit period and which systems are in scope.
Is Vanta on the OFAC sanctions list?+
Vanta returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of August 2026.
What is Vanta's vendor risk tier?+
ThirdProof assigned Vanta a risk tier of Low Risk as of August 2026, with an evidence confidence of 100% across 27 intelligence sources. Evidence confidence describes how much of the evidence ThirdProof set out to gather it was able to gather — not certainty about every fact concerning Vanta.
Has Vanta had any data breaches or security incidents?+
ThirdProof's adverse media and incident screening as of August 2026 did not surface a validated security incident involving Vanta. Public sources do not record every incident, so this is not a guarantee that none occurred — ask Vanta directly for its incident disclosure history and breach notification commitments.
Does Vanta support HIPAA and sign BAAs?+
HIPAA compliance / BAA claim found on trust page (Vendor attested) If protected health information is in scope for your use, confirm BAA availability in writing before contracting.
Can ThirdProof pre-fill a Vanta security questionnaire?+
Yes. ThirdProof answered 111 of 133 questions (83%) about Vanta from public evidence, before contacting the vendor. Each answered item carries the evidence it was drawn from. The remaining 22 are listed as open, so the follow-up you send Vanta is short and specific.
What evidence should I request from Vanta?+
Public evidence settles a large part of the review, so the request you send should be short. Ask Vanta for the current SOC 2 report and, where applicable, a bridge letter covering the period since the report date; the audit scope — which systems and services the report actually covers; written answers on data security, access control, incident response; contractual commitments, cyber insurance, and the current subprocessor list. Everything ThirdProof could already establish is recorded with its source, so you are not asking Vanta to re-confirm what is already documented.
Represent Vanta? Submit updated security evidence.
If Vanta is in your vendor stack, can you prove you assessed them?
SOC 2 CC9.2, HIPAA, PCI DSS and CMMC all require documented vendor due diligence — not just knowing the answer, but holding evidence that you verified it. The Vanta assessment above is already written; ask for it and it lands in your inbox.
✓ This assessment: free, no account required✓ Your first 5 vendor investigations are free✓ No credit card required