Vanta Trust Center

{
  "id": "vanta",
  "name": "Vanta Trust Center",
  "tier": "tier1",
  "adapter_status": "implemented",
  "connect_method": "signed_graphql",
  "auth": "none (constant CSRF header + pre-signed query manifest)",
  "normalized_coverage": {
    "organizations": true,
    "certifications": true,
    "controls": true,
    "subprocessors": true,
    "documents": true,
    "securityUpdates": "publicUpdates_when_present"
  },
  "rate_limit": {
    "recommendedRps": 8,
    "maxConcurrency": 6,
    "readCeiling": "Cloudflare-fronted same-origin GraphQL; ~2 signed POSTs/tenant. No 429 observed at low concurrency.",
    "limiter": "Cloudflare in front of the tenant origin / app.vanta.com",
    "penalty": "401 Invalid signature if the pinned query text drifts from the live bundle version (re-capture queries + manifest)",
    "backoff": "keep <=6 concurrent; memoize the signature manifest per client version across the batch"
  },
  "stats": {
    "providerId": "vanta",
    "name": "Vanta Trust Center",
    "adapterStatus": "implemented",
    "organizations": 2307,
    "trustCenters": 2307,
    "certifications": 5855,
    "controls": 145183,
    "subprocessors": 16482,
    "documents": 9156,
    "securityUpdates": 0,
    "sources": 2307
  }
}

{
  "support_status": "supported",
  "sync_cadence": "daily_full_sync_with_provider_rate_limit",
  "rate_limit": {
    "recommendedRps": 8,
    "maxConcurrency": 6,
    "readCeiling": "Cloudflare-fronted same-origin GraphQL; ~2 signed POSTs/tenant. No 429 observed at low concurrency.",
    "limiter": "Cloudflare in front of the tenant origin / app.vanta.com",
    "penalty": "401 Invalid signature if the pinned query text drifts from the live bundle version (re-capture queries + manifest)",
    "backoff": "keep <=6 concurrent; memoize the signature manifest per client version across the batch"
  },
  "known_source_count": 2675,
  "harvestable_source_count": 2675,
  "seed": "seeds/vanta-backfill-2026-06-11.json"
}

{
  "companies": 2307,
  "trust_centers": 2307,
  "certifications": 5855,
  "controls": 145183,
  "subprocessors": 16482,
  "documents": 9156,
  "security_updates": 0,
  "sources": 2307
}

{
  "score": 88,
  "score_kind": "bounded_0_to_100_observed_normalized_trust_center_coverage",
  "granularity_tier": "deep_security_posture",
  "observed_capabilities": {
    "trust_centers": true,
    "certifications": true,
    "controls": true,
    "subprocessors": true,
    "documents": true,
    "security_updates": false,
    "provenance": true
  },
  "available_capabilities": [
    "trust_centers",
    "certifications",
    "controls",
    "subprocessors",
    "documents",
    "provenance"
  ],
  "missing_capabilities": [
    "security_updates"
  ],
  "analysis_readiness": {
    "vendor_risk_profile": true,
    "security_questionnaire_evidence": true,
    "subprocessor_monitoring": true,
    "document_inventory": true,
    "compliance_tracking": true,
    "security_advisory_monitoring": false,
    "provenance_audit": true
  },
  "counts": {
    "trust_centers": 2307,
    "certifications": 5855,
    "controls": 145183,
    "subprocessors": 16482,
    "documents": 9156,
    "security_updates": 0,
    "sources": 2307
  }
}

{
  "access_profiles": [
    {
      "key": "vanta_signed_graphql",
      "count": 2307
    }
  ],
  "access_levels": [
    {
      "key": "unknown",
      "count": 2307
    }
  ],
  "data_access": {
    "certifications": 2071,
    "controls": 2237,
    "subprocessors": 1562,
    "documents": 1425,
    "security_updates": 0
  }
}

{
  "rank": 2,
  "segment": "smb_to_enterprise",
  "owner": "Vanta (independent; platform cites 16k+ customers)",
  "auth": "signed_graphql_query_reusable_across_tenants",
  "connect": {
    "method": "graphql",
    "fetchSlug": "GET https://{tenantDomain}/ -> html attr data-slugid",
    "fetch": "POST https://{tenantDomain}/graphql?operation=fetchDataForTrustReport",
    "body": "captured {query, extensions.signedQuery} with variables.slugId swapped per tenant",
    "operations": [
      "fetchDataForTrustReport",
      "fetchReportContext",
      "fetchCustomizableControlsDataForExternalTrustCenter",
      "SubprocessorsSectionPaginated",
      "fetchFaqsForOverviewPage",
      "linkedTrustCenters"
    ],
    "signatureNote": "signature signs query string only, NOT variables; one capture harvests all tenants; re-capture on TTL/schema change",
    "officialApi": "GET api.vanta.com/v1/trust-centers/{slugId} (OAuth bearer, per-customer, NOT usable cross-tenant)"
  },
  "discovery": {
    "cnameTarget": "{trustCenterId24hex}.cname.vantatrust.com",
    "handleInCname": false,
    "fingerprints": [
      "CNAME *.cname.vantatrust.com",
      "assets.vanta.com bundles",
      "data-slugid attr"
    ],
    "channels": [
      "dns_cname_sweep",
      "crt.sh",
      "builtwith:Vanta"
    ]
  },
  "backfill_2026_06_11": {
    "priorKnown": 6,
    "harvestableNow": 2675,
    "netNew": 2669,
    "totalKnown": 2675,
    "commonCrawlFloor": 2455,
    "observedHostDomains": 2628,
    "missingObservedHostDomains": 47,
    "unit": "companyDomain; observedHosts retained where present in raw CNAME resolution files",
    "sourceChannels": [
      "Common Crawl ccindex host enumeration over trust/security/compliance prefixes",
      "live CNAME resolution against vendor fingerprints",
      "URLScan and Certificate Transparency enrichment",
      "7,144-company status-page corpus CNAME sweep"
    ],
    "seed": "seeds/vanta-backfill-2026-06-11.json",
    "notes": "Confirmed source-registry floor from full top-five discovery pass; adapter hydration still needs signed GraphQL replay."
  }
}

{
  "self": "/v1/coverage/providers/vanta",
  "provider": "/v1/providers/vanta",
  "companies": "/v1/companies?provider=vanta",
  "trust_centers": "/v1/trust-centers?provider=vanta",
  "sources": "/v1/sources?provider=vanta"
}