Vanta Subprocessors List (November 2026): Changes and History
Vanta names 43 subprocessors on its published list. Read from the vendor's own page and re-checked daily.
Vanta subprocessors (November 2026)
| # | Subprocessor | Purpose | Location |
|---|---|---|---|
| 1 | Amazon Web Services | Infrastructure Hosting | US, EU or AUS |
| 2 | Mongo DB Inc. | Database Hosting | US, EU or AUS |
| 3 | Chameleon Intelligent Tech, Inc. | Application notifications | US |
| 4 | Cloudflare | Hosting and Content Delivery | US, EU |
| 5 | Confluent | Platform Data Streaming | US |
| 6 | Datadog | Logging & Monitoring | US |
| 7 | Courier | Customer Notification Delivery | US |
| 8 | svix | Webhook Delivery | US |
| 9 | Snowflake Inc. | Data Warehouse | US |
| 10 | Sigma | BI Analytics | US |
| 11 | Coefficient.io | Analytics & Reporting | US |
| 12 | Dagster Labs | Data pipeline orchestration | US |
| 13 | Fivetran | Logging & Monitoring | US |
| 14 | Qlik | Analytics support | US |
| 15 | Polytomic | Data Integration and Streaming | US |
| 16 | Secoda.co | Data Cataloging and Analysis | US |
| 17 | Tableau | Data Visualization Platform | US |
| 18 | Heap Inc. | Application Analytics | US |
| 19 | Statsig | Product Analytics | US |
| 20 | OpenAI, LLC | AI Functionality | US |
| 21 | Anthropic | AI Functionality | US |
| 22 | AI Functionality | US | |
| 23 | Cohere | Monitoring and Evaluation of AI Product Features | US |
| 24 | Langchain (using Langsmith product) | Monitoring and Evaluation of AI product Features | US |
| 25 | Browserbase | AI Application Functionality | US |
| 26 | Microsoft | AI Application Functionality | US |
| 27 | e2b | AI Application Functionality | US |
| 28 | kernel.sh | AI Application Functionality | US |
| 29 | Hatchet.run | Workflow Orchestration | US |
| 30 | reducto.ai | Document Parsing Tool | US |
| 31 | Lakera | AI Security | US |
| 32 | Intercom | Customer Support Tool | US |
| 33 | Salesforce | Subscription Management | US |
| 34 | Zapier | Workflow Automation | US |
| 35 | Finch | HR Platform Integration Tool (customer optional) | US |
| 36 | Merge.dev | Platform Integration Tool (customer optional) | US |
| 37 | OneSchema | CSV Importer (customer optional) | US |
| 38 | WorkOS | SCIM integration (customer optional) | US |
| 39 | Vanta Technology Australia Pty Limited | Region local Vanta entity | — |
| 40 | Vanta Technology Canada Limited | Region local Vanta entity | — |
| 41 | Vanta Technology Ireland I Limited | Region local Vanta entity | — |
| 42 | Vanta Technology UK Limited | Region local Vanta entity | — |
| 43 | Riskey Technologies Ltd. | Region local Vanta entity | — |
Get an email when Vanta changes its subprocessors
ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.
AI and customer data at Vanta
What Vanta's own documents say, with the sentence each answer comes from.
- Trains AI models on customer data
-
No
“Vanta will not, and will not permit any third party to, use any Customer Information to train any artificial intelligence or machine learning models”
Terms of service, www.vanta.com ↗ - Sends customer data to AI model providers
-
Not stated in the documents we track.
- How to opt out
-
Customers can disable AI Features entirely at the admin level through the Services settings.
“Customer will have the ability to disable AI Features within the Services at the admin level for all Authorized Users by using the functionality of the Services.”
Terms of service, www.vanta.com ↗
Key DPA terms at Vanta
What Vanta's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?
- Breach notification
-
Without undue delay, with no set deadline
“In the event of a Personal Data Breach, Vanta shall, without undue delay, inform Customer of the Personal Data Breach”
DPA, www.vanta.com ↗ - Notice of a new subprocessor
-
10 days ahead
“At least ten (10) days before enabling any third party other than existing Sub-Processors to process Personal Data, Vanta will add such third party to the List and notify subscribers”
DPA, www.vanta.com ↗ - Transfers outside the EU
-
Standard contractual clauses and adequacy decisions
“The parties agree that ex-EEA Transfers are made pursuant to the EU SCCs, which are deemed entered into (and incorporated into this DPA by this reference)”
“If Vanta transfers Personal Data protected under this DPA to a jurisdiction for which the European Commission has not issued an adequacy decision, Vanta will ensure that appropriate safeguards have been implemented”
DPA, www.vanta.com ↗ - Customer data after the contract ends
-
Deleted or returned when the contract ends
“Following completion of the Services, at Customer's choice, Vanta shall return or delete Personal Data, unless further storage of such Personal Data is required by applicable law.”
DPA, www.vanta.com ↗ - Audit rights
-
Once a year
“such audit shall only be performed during business hours and occur no more than once per calendar year”
DPA, www.vanta.com ↗
Documents we track for Vanta
- AI terms
- checked November 3, 2026 changed November 3, 2026 www.vanta.com ↗
- DPA
- checked November 3, 2026 www.vanta.com ↗
- Privacy policy
- checked November 3, 2026 www.vanta.com ↗
- Subprocessor list
- checked November 3, 2026 changed November 3, 2026 trust.vanta.com ↗
- Terms of service
- checked November 3, 2026 www.vanta.com ↗
Change history
Tracking since October 14, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.
Vanta subprocessors FAQ
- How many subprocessors does Vanta use?
- Vanta lists 43 subprocessors on its published list, including Amazon Web Services, Mongo DB Inc., Chameleon Intelligent Tech, Inc., Cloudflare, and Confluent and 38 more.
- Where does Vanta process customer data?
- The subprocessors named by Vanta are located in US, EU or AUS, and EU, as stated on its list.
- Does Vanta use customer data to train AI models?
- According to its terms of service, Vanta does not use customer data to train AI models: “Vanta will not, and will not permit any third party to, use any Customer Information to train any artificial intelligence or machine learning models”
- How quickly does Vanta report a personal data breach to customers?
- According to its DPA, Vanta reports a personal data breach to customers without undue delay, with no set deadline: “In the event of a Personal Data Breach, Vanta shall, without undue delay, inform Customer of the Personal Data Breach”
- How much notice does Vanta give before adding a subprocessor?
- Vanta's DPA gives 10 days' notice of a new subprocessor, the time customers have to object: “At least ten (10) days before enabling any third party other than existing Sub-Processors to process Personal Data, Vanta will add such third party to the List and notify subscribers”
- How does Vanta transfer personal data outside the EU?
- Vanta's DPA relies on standard contractual clauses and adequacy decisions: “The parties agree that ex-EEA Transfers are made pursuant to the EU SCCs, which are deemed entered into (and incorporated into this DPA by this reference)”
- When was Vanta's subprocessor list last checked?
- ClauseTrail last checked Vanta's subprocessor list on November 3, 2026 and last saw it change on November 3, 2026. Lists are re-checked daily.
- How do I find out when Vanta adds or removes a subprocessor?
- ClauseTrail monitors Vanta's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.