We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk
Vanta logo

Vanta review

Software product

US software your team runs to collect evidence for SOC 2, ISO 27001 and ISO 42001 audits, suggest answers to security questionnaires and monitor AI vendor risk.

Relevant if you want SOC 2 or ISO 42001 evidence collected automatically, with a published uptime commitment

Price Not published
Indemnity cover Published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Vanta scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 4/5
Qualifications of the people who do the work 5/5
What it publishes about fees 1/5
Knowledge of your sector 3/5
Independence from what it sells 5/5
Who carries the risk if the advice is wrong 5/5

What Vanta offers, and what it publishes

This is software you run, not advice. It collects audit evidence automatically, suggests answers to security questionnaires and monitors risk from your AI vendors, with a separate ISO 42001 module. Vanta says it holds SOC 2 Type II, ISO 27001 and ISO 42001, the last from an ANAB-accredited assessor.

Vanta does not publish a price. Its pricing page shows four plans with no figures and asks you to book a demo for a quote. It does publish an uptime commitment: 99% a month, with service credits of 10% or 20% depending on how far it falls short.

Vanta lists a London office, but you contract with Vanta Inc., the US company in San Francisco; we found no UK or EU subsidiary. It is not on the UK G-Cloud marketplace, so UK public bodies cannot buy it that way. It publishes named case studies; one says GitHub automated 93% of its security questionnaires.

Strengths

  • Holds independently certified ISO/IEC 42001:2023 (AI management system) certification via an ANAB-accredited assessor, not just a self-declared claim
  • Publishes a specific SLA with numeric uptime commitments and service credits, rather than leaving availability undefined
  • Large base of named customer case studies with quantified outcomes (e.g. GitHub automating 93% of security questionnaires)
  • Continuous, automated evidence collection is central to the product rather than a bolt-on, reducing manual audit prep

Things to check

  • No pricing figures are published anywhere on Vanta's site, all four tiers require a sales conversation to get a quote, making cost comparison difficult before engaging with sales.
  • Vanta is not a supplier on the UK Government Digital Marketplace/G-Cloud, so UK public-sector buyers cannot procure it through that standard route.

Common questions

Does Vanta publish its prices?

No. Its pricing page lists four plans, Essentials, Plus, Professional and Enterprise, with no figures. Each asks you to request a demo for a personalised quote.

Is Vanta advice or software?

Software. Your team sets it up and runs it, with support from Vanta, but no consulting engagement is built into the product.

Does Vanta hold its own AI certification?

Yes. Vanta says it holds ISO/IEC 42001:2023, issued by an ANAB-accredited assessor, alongside SOC 2 Type II and ISO/IEC 27001:2022.

Evidence for each Vanta score

Show our working

Notes behind each thing to check

  • No pricing figures are published anywhere on Vanta's site, all four tiers require a sales conversation to get a quote, making cost comparison difficult before engaging with sales. (vanta.com/pricing shows four named tiers with 'request a free demo... to get personalized pricing' as the only CTA and no dollar amounts.)
  • Vanta is not a supplier on the UK Government Digital Marketplace/G-Cloud, so UK public-sector buyers cannot procure it through that standard route. (A direct search of applytosupply.digitalmarketplace.service.gov.uk for 'Vanta' returns zero results.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 4/5 Vanta documents continuous, automated evidence collection with real-time tracking of evidence requests/approvals and direct auditor access to source data (vanta.com/products/audit), though this is framed around SOC 2/ISO audits rather than explicitly ICO or AI Act enforcement scenarios.
Qualifications of the people who do the work 5/5 Vanta names a CISO (Jadee Hanson, appointed January 2024) and holds independently certified SOC 2 Type II, ISO 27001 and ISO 42001 (via an ANAB-accredited assessor), verifiable on vanta.com/company/security.
What it publishes about fees 1/5 vanta.com/pricing shows four tiers with no dollar figures at all, only a 'request a demo for personalized pricing' call to action.
Knowledge of your sector 3/5 Vanta offers framework-specific product modules (e.g. a dedicated ISO 42001 product, plus HIPAA/PCI DSS/FedRAMP support) but no named industry-vertical modules beyond framework mapping.
Independence from what it sells 5/5 Vanta's ISO/IEC 42001:2023 certification was issued by an ANAB-accredited assessor and its SOC 2 Type II is an independent attestation, both verifiable rather than self-declared (vanta.com/company/security).
Who carries the risk if the advice is wrong 5/5 Vanta publishes a public SLA (vanta.com/legal/sla) with a 99% monthly uptime guarantee and specific service-credit percentages (10% for 95.0-98.99% uptime, 20% below 95.0%).

Sources for Vanta

  • Corporate entity/jurisdiction (Vanta Inc., a Delaware corporation, HQ 655 Montgomery Street, Suite 1600, San Francisco, CA 94111; no separate UK/EU subsidiary entity was found, Vanta Inc. is the sole global contracting party, with an outsourced EU GDPR representative (GDPR Local Ltd, Brighton) named in its privacy policy) (vanta.com, checked 17 July 2026)
  • AI product scope (vanta.com/products/ai describes Instant Expert Answers, Evidence Verification, Questionnaire Automation (a cited 95% acceptance rate on auto-suggested answers), Vendor Risk Monitoring and Remediation Assistance, sitting alongside Vanta's separate ISO 42001 product module) (vanta.com, checked 17 July 2026)
  • Pricing disclosure (No dollar figures are published anywhere on vanta.com/pricing; four named tiers (Essentials, Plus, Professional, Enterprise) are shown with 'request a free demo... to get personalized pricing' as the only call to action, pricing is fully gated behind a sales conversation) (vanta.com, checked 17 July 2026)
  • UK presence (Vanta is not listed as a supplier on the UK Digital Marketplace/G-Cloud (a direct site search returns zero results), but Vanta maintains a London office alongside San Francisco, New York, Dublin and Sydney per its careers listings) (G-Cloud, checked 17 July 2026)
  • Own certifications (Vanta states it holds SOC 2 Type II, ISO/IEC 27001:2022 and ISO/IEC 42001:2023 (the latter certified by an ANAB-accredited assessor), on its own security page) (vanta.com, checked 17 July 2026)

SOC 2 Type II ISO/IEC 27001:2022 ISO/IEC 27701:2019 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 42001:2023

Seeking ISO 42001 certificationExposed to the EU AI ActSwitching provider

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.