Is Vanta safe with your data?
Vanta
Vanta Inc.
Partial disclosure · high confidence
Vanta earns a C (58/100) because it discloses its data practices only in part.
#78
of 116 apps ranked
58
score · Security & compliance avg —
—
vs category average
Vanta's controller-level website privacy policy earns a mid-C. It has a complete data-subject rights menu, a named subprocessor disclosure, and named international transfer safeguards. It says nothing about AI training and gives only vague retention language, so it lands well below the B band. Every quoted mechanism appears verbatim in the snapshot, no certifications were invented, and the empty dealbreaker list is correct because the one adverse practice (selling and sharing for ads) carries a working opt-out.
What Vanta's privacy policy says about your data
Full rights menu
The policy grants access, deletion, portability ("in a portable and structured format"), correction, objection, and the right to appeal a refusal, all exercisable via privacy@vanta.com.
Named transfer safeguards
International transfers rely on "the EU standard contractual clauses" and self-certification under the EU-U.S., Swiss-U.S., and UK Extension Data Privacy Framework, with the Irish Data Protection Commissioner named as lead supervisory authority.
Sells and shares for ads, with an opt-out
Vanta states it "has sold or shared information (such as identifiers and internet activity information via Cookies) to ad networks," and it provides a Cookie-settings and Global Privacy Control opt-out. That makes it an adverse practice with an opt-out, which counts as a half, not a dealbreaker.
Vague retention and no breach clause
Retention is only "for as long as necessary for the purposes described," with no deletion timeline and no breach-notification commitment, and security rests on "industry-standard technical and organizational measures."
What the policy is silent or vague on
- Not stated: keeping user inputs out of model training
- Not stated: a way to opt out of training
- Not stated: whether training use differs by plan
- Not stated: your ownership of generated outputs
Vanta privacy rating
Details
- Category
- Security & compliance
- Modalities
- text
- Processes biometrics
- No
- Policy last updated
- 2026-02-25
- Region scored
- Global / US-default
- Assessed
- 2026-06-20
Other security & compliance apps
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.