Is Vanta safe with your data?
Vanta
Vanta Inc.
Partial disclosure · high confidence
Vanta earns a C (59/100) because it discloses its data practices only in part.
#33
of 216 apps ranked
59
score · Security & compliance avg 47
+12
vs category average
Vanta's terms contain a flat promise never to train AI models on customer data and an admin switch to turn AI features off, but the privacy policy sets no retention period, gives no breach-notification commitment, and confirms that identifiers and browsing activity have been sold or shared with ad networks.
What Vanta's privacy policy and terms of service say about your data
No training on customer data
The terms state Vanta will not, and will not permit any third party to, use any Customer Information to train artificial intelligence or machine learning models, and customers can disable AI features at the admin level for all users.
Advertising data sold or shared
The California section discloses that identifiers and internet activity information collected via cookies have been sold or shared with ad networks, analytics providers and marketing providers, with opt-out available through cookie settings and Global Privacy Control.
Retention and breach handling undefined
Data is kept "for as long as necessary" with no number attached, no deletion timeline after account closure is given, and the policy never commits to notifying anyone of a security breach.
Security described only in adjectives
Protection is summarised as "industry-standard technical and organizational measures" with no encryption, access-control or certification named anywhere in the policy or terms.
What the policy is silent or vague on
- Not stated: whether training use differs by plan
- Not stated: your ownership of generated outputs
- Not stated: a deletion timeline after closure or request
- Not stated: shorter retention for AI conversation logs
Vanta privacy rating
Details
- Category
- Security & compliance
- Modalities
- text
- Processes biometrics
- No
- Policy last updated
- 2026-02-25
- Region scored
- Global / US-default
- Last assessed
- 2026-10-13
Documents examined
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.