# Vanta

- **Type:** Software product
- **Website:** https://www.vanta.com/products/ai
- **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd)

US software your team runs to collect evidence for SOC 2, ISO 27001 and ISO 42001 audits, suggest answers to security questionnaires and monitor AI vendor risk.

## Vanta scores

Scored 1 to 5 on six criteria. There is no overall score.

### Help when things go wrong: 4/5

Vanta documents continuous, automated evidence collection with real-time tracking of evidence requests/approvals and direct auditor access to source data (vanta.com/products/audit), though this is framed around SOC 2/ISO audits rather than explicitly ICO or AI Act enforcement scenarios.

### Qualifications of the people who do the work: 5/5

Vanta names a CISO (Jadee Hanson, appointed January 2024) and holds independently certified SOC 2 Type II, ISO 27001 and ISO 42001 (via an ANAB-accredited assessor), verifiable on vanta.com/company/security.

### What it publishes about fees: 1/5

vanta.com/pricing shows four tiers with no dollar figures at all, only a 'request a demo for personalized pricing' call to action.

### Knowledge of your sector: 3/5

Vanta offers framework-specific product modules (e.g. a dedicated ISO 42001 product, plus HIPAA/PCI DSS/FedRAMP support) but no named industry-vertical modules beyond framework mapping.

### Independence from what it sells: 5/5

Vanta's ISO/IEC 42001:2023 certification was issued by an ANAB-accredited assessor and its SOC 2 Type II is an independent attestation, both verifiable rather than self-declared (vanta.com/company/security).

### Who carries the risk if the advice is wrong: 5/5

Vanta publishes a public SLA (vanta.com/legal/sla) with a 99% monthly uptime guarantee and specific service-credit percentages (10% for 95.0-98.99% uptime, 20% below 95.0%).

## Sources for Vanta

Every line carries the page it was read on and the date it was checked.

- Corporate entity/jurisdiction
  - Source: https://www.vanta.com/legal/terms
  - Checked: 2026-07-17
- AI product scope
  - Source: https://www.vanta.com/products/ai
  - Checked: 2026-07-17
- Pricing disclosure
  - Source: https://www.vanta.com/pricing
  - Checked: 2026-07-17
- UK presence
  - Source: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/search?q=Vanta
  - Checked: 2026-07-17
- Own certifications
  - Source: https://www.vanta.com/company/security
  - Checked: 2026-07-17

## What this provider publishes

Not published means we did not find it on the firm's own pages.

- Price: Not published
- Indemnity cover: Published
- Credentials: Published
- Independent accreditation: Published
- Client results: Published
- How it uses AI: Not published

## Strengths

- Holds independently certified ISO/IEC 42001:2023 (AI management system) certification via an ANAB-accredited assessor, not just a self-declared claim
- Publishes a specific SLA with numeric uptime commitments and service credits, rather than leaving availability undefined
- Large base of named customer case studies with quantified outcomes (e.g. GitHub automating 93% of security questionnaires)
- Continuous, automated evidence collection is central to the product rather than a bolt-on, reducing manual audit prep

## Things to check

Each one carries the factual basis it rests on.

- No pricing figures are published anywhere on Vanta's site, all four tiers require a sales conversation to get a quote, making cost comparison difficult before engaging with sales.
  - Basis: vanta.com/pricing shows four named tiers with 'request a free demo... to get personalized pricing' as the only CTA and no dollar amounts.
- Vanta is not a supplier on the UK Government Digital Marketplace/G-Cloud, so UK public-sector buyers cannot procure it through that standard route.
  - Basis: A direct search of applytosupply.digitalmarketplace.service.gov.uk for 'Vanta' returns zero results.

## Where this firm appears

- [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking)
- [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed)
- [How do you change your data protection provider?](https://theassurancedesk.com/best/switching-provider)
- [Compare providers](https://theassurancedesk.com/compare)

---

**Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in.

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.

**Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.