Vendor drift
Classified material changes to Vanta’s public trust documents, from continuous monitoring.
Data as of 2026-09-10 — refreshed on a rolling bake, not live. · vanta.com
Prohibits training on customer data
as of 2026-09-10
high · AI subprocessor added · 2026-07-30 · subprocessor_list
Vanta added 1 subprocessor(s): kernel.sh.
high · AI subprocessor added · 2026-07-22 · subprocessor_list
Vanta added 42 subprocessor(s): Amazon Web Services, Mongo DB Inc., Chameleon Intelligent Tech, Inc., Cloudflare, Confluent, Datadog, Courier, svix, Snowflake Inc., Sigma, Coefficient.io, Dagster Labs, Fivetran, Qlik - Stitch, Polytomic, Secoda.co, Tableau, Heap Inc., Statsig, OpenAI, LLC, Anthropic, Google, Cohere, Langchain (using Langsmith product), Browserbase, Microsoft, e2b, Hatchet.run, reducto.ai, Lakera, Intercom, Salesforce, Zapier, Finch, Merge.dev, OneSchema, WorkOS, Vanta Technology Australia Pty Limited, Vanta Technology Canada Limited, Vanta Technology Ireland I Limited, Vanta Technology UK Limited, Riskey Technologies Ltd..
medium · Terms changed · 2026-07-10 · dpa
Vanta's DPA was substantially reorganized and clarified, with the most significant change being the relocation of the notification obligation for instructions that infringe Data Protection Laws from Section 8.5 to Section 2.2, and the restructuring of supplementary measures in Section 6.6 to apply universally rather than only to ex-EEA/UK/Switzerland transfers. Additionally, Section 8 was renamed to include "Data Protection Impact Assessments, Prior Consultations" and Personal Data Breach provisions were moved to a new Section 9, while the conflict clause was simplified to remove reference to Vanta's privacy policy.
Paste your vendor list, confirm your email, and our engine builds your report automatically — which vendors add AI subprocessors or reserve the right to train on your data, and where your nth-party exposure concentrates. Free, usually within the hour.