Log inSubmit a tool

Is Vanta UK GDPR compliant?

answer from its trust card · not checked yet

> short_answer

Vanta handles customer data, so it acts as a supplier under UK GDPR. You’ll want a contract that covers processing, and to check where the data goes. The facts below are from its trust card.

No tool is “compliant” on its own; compliance depends on how you use it. This page shows the facts you need to decide.

The facts that matter for UK GDPR

Data to vendor: Its trust centre lists customer and employee personal information, card and health information among the data it may hold.○ unclaimed
Data location: Core data on AWS and MongoDB in the US, EU or Australia; Cloudflare in the US and EU.○ unclaimed
Sub-processors: Includes AWS (hosting; US, EU or Australia), MongoDB (database; US, EU or Australia), Cloudflare (hosting and delivery; US, EU), Chameleon (in-app notifications; US). Full list on its trust centre.○ unclaimed
Certifications: SOC 2 Type II, ISO 27001:2022, ISO 27701, ISO 27017, ISO 27018, ISO/IEC 42001, PCI DSS 4.0.1, FedRAMP 20x○ unclaimed

What you still need to do

  1. Add it to your record of processing. Pre-filled entry
  2. Check your contract covers processing and any transfers abroad. DPIA starter
  3. Watch it, so you hear if any of this changes. Watch Vanta