Vanta

Choose which application evidence reports Vanta receives and when VeriProof sends them. Organization member and governance task updates support assignment and compliance work through a separate update process.

Access

Administrators manage connections with permission to manage integrations. Administrators and Compliance Officers manage reports with compliance access and evidence export permission, within their authorized application scope. Automatic delivery also requires report scheduling permission.

Other users may see a permitted connection summary. They cannot use the report catalog, PDF previews, or delivery history. Custom roles, demo sessions, sandbox previews, and role previews cannot manage report delivery. Auditors continue to use their authorized Compliance exports.

Choose the integration for the task

Connect Vanta

The administrator also needs permission to authorize integrations in Vanta. Each VeriProof environment has its own Vanta configuration. If Settings says the VeriProof Vanta partner app is not enabled in this environment, Connect Vanta stays disabled until that environment has its approved Vanta configuration. Contact VeriProof support to arrange it.

1. Open Settings → Vanta in VeriProof.
2. Select Connect account, or Configure connection for a saved connection.
3. Select your organization’s Vanta region and select Connect Vanta.
4. Review the requested Vanta resources and approve the connection.
5. Return to VeriProof and select Verify connection.
6. After an hourly resource update, check the expected member and task records in Vanta.

VeriProof uses the selected region for authorization and keeps customer connections separate. Vanta access authorized confirms authorization; compare Last accepted update with the expected records to check resource delivery. Zero tasks can be correct when no tasks qualify.

Evidence destinations

Each report goes to its own Vanta document. Assessment reports use one document per application. An administrator sets each one:

1. In Vanta, create or choose a document for the report, and copy its ID from the document URL.
2. In VeriProof, open the report row and enter the ID in Vanta document ID.
3. Select Save receiving document. VeriProof checks the ID with Vanta and keeps your previous setting if Vanta can’t find it.

Saving sends no report. Two reports can’t share one Vanta document, so a new upload never replaces another report’s file.

Clear a document ID to stop that report without disconnecting member and task updates. Resolve an unresolved report before changing its document. Renewing authorization for the same receiving account preserves approved report schedules and history. Changing the receiving account or document requires a new first report before automatic delivery resumes.

Member and task updates

VeriProof uses Vanta’s supported UserAccount and SecurityTask resources:

• Members include identity, role, group, activation, and sign-in fields. Seed accounts are excluded. The identity provider owns MFA records.
• Governance tasks include supported remediation and review work, owners, priority, status, resolution, and an authorized link to VeriProof.

These resources update each hour, independently of report sharing. Prompts, responses, session content, raw evidence, secrets, and subject data captured in governed sessions are excluded.

Resource update failed means the latest attempt did not complete. Previously accepted counts can remain visible; check Last update attempt. Verify connection checks access only. It does not send resources or retry an update. Check the next hourly attempt and contact VeriProof support if failures persist. Connection check failed requires another access check. Renew authorization when Authorization needed appears.

Choose applications and reports

Select Applications and save the applications that may be included in reports. All listed applications selects the current listed population. New applications are not added automatically. The inventory includes selected suspended applications.

Open a report row to see its delivery state, timing, and source requirements. Reports start in Manual mode:

Routine activity alone doesn’t send a new report. More options lets you change Refresh at least every or use a report-specific application selection. Set the refresh shorter than any renewal period on the Vanta document, so the current file doesn’t expire first.

Each governance summary and runtime report starts where the previous received report ended, so a longer refresh never leaves a gap. Your first report covers the preceding seven days. Runtime reports also support a manual reporting period. Inventory and exceptions reports describe their state when generated.

Preview and send

1. Open a report row.
2. For an assessment report, select one application with a saved assessment.
3. Select Preview and send and review the exact PDF, application names, evidence period, recorded outcomes, gaps, and destination.
4. Select Send report.
5. Check Delivery history, then select Open in Vanta from the report row.
6. In Vanta, link the document to the controls for the citations listed under Finish in Vanta. You only link once.
7. Select Mark as complete, or submit the document for approval if your account uses approval workflows. Auditors can’t see the report until you do. Repeat this step after each new report.

The submitted PDF is the PDF you previewed. An expired preview or changed destination requires a new preview. Preview same report reuses a current PDF prepared for another GRC provider. Each destination requires separate delivery authorization.

Manual assessment reports retain pending reviews, adverse findings, evidence gaps, and original assessment periods. They cover represented requirements, rather than the complete framework. Outcome, review, and evidence summaries report separate recorded facts. Completed collection checks do not mean requirements were met. Organization assertion counts are part of required outcome totals. Their document requirement counts are part of evidence totals. VeriProof reports supporting HIPAA runtime evidence. It cannot establish organizational requirements that need customer documents. Organization document intake is not available; those requirements remain disclosed as evidence gaps. Current previews can include declared application, model, and rule names, current user display names, and approved public links. Ownership, assignment, revision, review state, and dates describe the recorded sources. Display names reflect user records at export. They do not identify a user’s role at a past decision. Current previews exclude email fields, raw content, credential fields, private review rationale, and free-text notes. Review included names before authorizing delivery; they can contain sensitive customer text. PDFs prepared under an earlier content policy remain read-only. Their recorded policy describes the fields retained in those PDFs.

Send automatically

Send and confirm the first report for every selected report scope. An assessment needs a separate first receipt for each application. Then turn on Send automatically and confirm the named destination, applications, report, and timing.

Subsequent deliveries within that authorization need no repeated approval. The report panel shows Next refresh due while automatic delivery is on. After report sharing fields change, automatic delivery pauses. Review a new PDF, confirm its receipt, and authorize automatic delivery again. Automatic assessments use new saved revisions with completed required reviews; they do not run reassessments or redate old evidence.

Changed application scopes or destinations need a new confirmed first receipt before automatic delivery can resume. Select Pause automatic delivery in a report panel, or Pause all automatic delivery for Vanta. Member and task updates continue separately.

Review report delivery

Delivery history records report dates, attempts, and receipts separately from resource update results. Select View PDF to read a retained report. Review and send resumes an eligible prepared report with its saved PDF. Expired and received PDFs remain read-only. Download PDF saves the exact retained report. Received by Vanta means Vanta acknowledged the report and VeriProof retained the receipt. It does not mean provider review, approval, or compliance. New PDFs have a Document ID that stays the same across providers. Delivery ID and receipts identify each destination’s submission. Exports display UTC timestamps. Period reports include exact start and end boundaries; as-of reports use the frozen export time. Saved assessment evaluation times remain in the PDF and differ from the export time.

For Receipt not confirmed, use Check receipt when offered. VeriProof checks the saved upload’s identity without uploading another copy. Use Retry report only when the report’s state permits it. Do not create another upload to bypass an unknown outcome.

Customer-owned deployments

A customer-managed VeriProof deployment uses a private Vanta app and stores its secret in the customer’s Azure Key Vault. VeriProof SaaS and VeriProof-owned Azure resources are not used for that connection. Run the command shown in Configure connection, then select Verify connection. The same report qualification, application scope, and sharing permissions apply.

Disconnect Vanta

Open Configure connection and select Disconnect Vanta. Disconnecting stops future resource and evidence updates. Delivery history remains in VeriProof. Accepted data remains subject to the customer’s Vanta retention and access controls.