Vanta
Compliance automation and trust management platform covering 35+ frameworks, including ISO 42001, the NIST AI RMF and the EU AI Act
Last checked October 15, 2026Quick facts: Vanta is an AI compliance vendor founded in 2018 and headquartered in San Francisco, United States. The vendor publicly documents coverage for ISO/IEC 42001, NIST AI RMF, EU AI Act, and SOC 2. Pricing is tiered. Profile last checked October 15, 2026; sources are cited at the bottom of this page.
About Vanta
Vanta is a compliance automation and trust management platform founded in 2018 and based in San Francisco. It says 16,000 companies use it and that it passed $300 million in annual recurring revenue in April 2026. It has raised $504 million since 2021; its latest round was a $150 million Series D led by Wellington Management in July 2025 at a $4.15 billion valuation, and Fortune reported no newer round as of April 2026. The platform connects to more than 400 tools to collect audit evidence, run continuous control tests, manage policies, risks and access reviews, and publish a Trust Center. Vanta says its AI answers more than 80% of security questionnaire questions. In November 2025 it launched an agent-based Agentic Trust Platform for evidence, questionnaires, vendor oversight and risk, and its agent can be used inside Claude and Cursor through an MCP server. It bought Riskey, a third- and fourth-party risk monitoring company, in July 2025. More than 100 audit firms work in the platform. **AI compliance coverage** Vanta has dedicated products for ISO/IEC 42001, the NIST AI RMF (launched in preview in January 2024 with 60 pre-built requirements and 10 risk scenarios) and the EU AI Act (announced in October 2024). The ISO 42001 product includes policy and document templates, mapped controls, automated tests, AI risk scenarios and access to accredited ISO 42001 auditors who review evidence in the platform. The EU AI Act product classifies AI systems by role and risk level, inventories AI use, and provides templates, AI-drafted policies, impact assessments and post-market monitoring records. **Who it's for** Startups through enterprises that need SOC 2, ISO 27001 or HIPAA and want AI frameworks on the same platform. It manages governance evidence; it does not test models.
Verified certifications
Compliance certifications independently verified against the vendor's own public trust page. Each badge links to the source we verified against.
Last verified Aug 22, 2026. Certification links are checked when a vendor profile is reviewed. See our methodology.
Featured in
Vanta is ranked in the following independent collections.
Frameworks supported
Regulations, voluntary standards and compliance programs Vanta documents support for on their own materials. Chip shading reflects the strength of the claim, not an independent audit.
Voluntary standard · Global · voluntary
Voluntary standard · US · voluntary
Regulation · EU · Phased — in force; high-risk rules deferred
Compliance program it supports (not its own certification) · United States (AICPA)
Compliance program it supports (not its own certification) · International (ISO)
Regulation · United States · active
Compliance program it supports (not its own certification) · International (PCI SSC)
Regulation · EU · in force
Vanta features
Capabilities Vanta markets publicly. Inclusion means the feature is documented on the vendor's site — not that it's best-in-class. Last checked October 15, 2026.
Audit Evidence Collection
Automated collection, hashing, and retention of evidence (model cards, test results, approvals) for audit.
Policy Management
Authoring, versioning, and distribution of AI usage policies mapped to regulations.
Risk Assessment Workflow
Guided workflows for completing AI impact assessments, risk scoring, and approval routing.
Third-Party AI Vendor Risk
Intake and assessment of AI features in third-party SaaS used by the organization.
Third-Party AI Risk Management
Due diligence and ongoing monitoring of AI vendors, subprocessors, and foundation model providers against compliance and security criteria.
AI Model Inventory
Centralized registry of all AI/ML models in use across the organization, with ownership, lifecycle stage, and risk classification.
AI Discovery
Inventory of AI assets, models, prompts, and datasets across an enterprise environment.
Integrations
Documented by Vanta in public product materials.
- Okta
- GitHub
- Jira
- Slack
- AWS Marketplace
Vanta pricing
Four plans: Essentials, Plus, Professional and Enterprise. No prices on vanta.com; its AWS Marketplace listing gives 12-month starting prices for 1-20 employees: Essentials $14,000, Plus $21,500, Professional $23,000. Enterprise is quoted. Third-party risk management is a separate product ($13,600 a year for up to 50 vendors on AWS).
Third-party reviews
Publicly cited ratings from independent review platforms. We don't collect reviews ourselves and we don't weight these in our rankings. Low review counts (≤2) are noted so you can decide how much signal to take from them.
G2
2744 reviews
We publish the cited numbers as-is and do not combine them into an aggregate rating, on this page or in search-result markup.
Vendor changelog
Durable events we've independently sourced — acquisitions, certification milestones, product launches. Each entry cites a primary or trusted secondary source.
- product launch
Launched the Agentic Trust Platform
AI Agent 2.0 and agent-based workflows for evidence, questionnaires, vendor oversight and risk.
Vanta - funding
Raised $150M Series D at a $4.15B valuation
Led by Wellington Management; total raised since 2021 reached $504M.
Vanta - acquisition
Acquired Riskey
Vanta bought Riskey, a third- and fourth-party risk monitoring company. Terms were not disclosed.
Vanta
Pros and cons of Vanta
Pros
- Dedicated ISO 42001, NIST AI RMF and EU AI Act products on the same platform as SOC 2, ISO 27001 and HIPAA, with controls mapped across frameworks.
- Public list prices on AWS Marketplace, from $14,000 a year for 1-20 employees, which many competitors don't publish.
- Large ecosystem: 400+ integrations and 100+ audit firms working in the platform, including accredited ISO 42001 auditors.
- Questionnaire automation and a Trust Center are built in; Vanta says its AI answers more than 80% of security questions.
Cons
- No prices on vanta.com, Enterprise is quoted, and larger headcounts and add-ons such as third-party risk management cost extra.
- Vanta doesn't publish how many ISO 42001 or EU AI Act controls and tests it ships, so check the framework content in a demo.
- It manages governance evidence, not models: no bias, robustness or security testing, so teams building AI systems need a testing tool alongside it.
Alternatives to Vanta
Frequently asked
What is Vanta?+
Vanta is a compliance automation and trust management platform founded in 2018 and based in San Francisco. It automates evidence collection, control monitoring, policies, risk, questionnaires and a Trust Center across 35+ frameworks, and says 16,000 companies use it.
Does Vanta support ISO 42001, the NIST AI RMF and the EU AI Act?+
Yes. Vanta has a dedicated product for each. The ISO 42001 product includes templates, mapped controls, automated tests and access to accredited auditors; the EU AI Act product classifies AI systems by role and risk level and inventories AI use. Vanta doesn't publish control counts, so review the content in a demo.
How much does Vanta cost?+
Vanta doesn't publish prices on its website. Its AWS Marketplace listing gives 12-month starting prices for 1-20 employees: Essentials $14,000, Plus $21,500 and Professional $23,000. Enterprise is quoted, and larger companies and add-ons cost more. See our Vanta pricing page for add-on prices.
What is the difference between Vanta and Drata?+
Both cover SOC 2, ISO 27001, ISO 42001 and the NIST AI RMF. Vanta has a dedicated EU AI Act product; Drata doesn't list the Act as a framework. On AWS Marketplace, Vanta starts at $14,000 a year for 1-20 employees, while Drata charges a $25,000 platform fee plus $7,500 per framework.
Has Vanta been acquired?+
No. We found no acquisition of Vanta as of October 2026. Vanta itself bought Riskey, a third- and fourth-party risk monitoring company, in July 2025.
Sources
- Vanta: Series D announcement ($150M at $4.15B, July 2025)
- SecurityWeek: Vanta raises $150M at $4.15B valuation ($504M since 2021)
- Vanta: $300M ARR, 16,000 customers, 400+ integrations (April 2026)
- Fortune: Vanta hits $300M ARR (April 29, 2026)
- Vanta: Vanta acquires Riskey (July 2025)
- Vanta: Introducing the Agentic Trust Platform (November 2025)
- Vanta: VantaCon UK 2026 recap (Vanta Agent, MCP server, Vanta Privacy)
- Vanta: ISO 42001 product page
- Vanta: NIST AI RMF product page
- Vanta: NIST AI RMF launch (January 2024)
- Vanta: EU AI Act product page
- Vanta introduces EU AI Act support (press release, October 2024)
- Vanta: Plans (Essentials, Plus, Professional, Enterprise)
- AWS Marketplace: Vanta (12-month prices)
- Vanta: Questionnaire Automation
- Vanta: Vanta for auditors (100+ audit firms)
- Vanta: Integrations
- G2: Vanta reviews
Keep reading
See an error or outdated detail?
Profiles carry a last-checked date. If something is out of date or wrong, send a correction and we will review it.
Work at Vanta?
Claim this listing to propose edits to the tagline, description, pricing notes, and headquarters details. Every change is still reviewed by our editorial team.