The Documents Page gives your company a list of needed documents for specific IT Security compliances and indicates whether your team has uploaded them to meet audit requirements. Documents often need to be uploaded, renewed, removed, or adjusted. All of this can be done from Vanta's Documents Page.
In Vanta, some tests require you to upload a document as evidence, these are called document tests. When you upload or edit a document for a test, it appears both on the Monitors (Tests) page and the Documents page. The Documents page provides a single view of all file-based evidence, whether uploaded directly or attached to a test.
Document Statuses and What They Mean
Each document in Vanta can have a status that shows its current state in the compliance workflow. Here’s what each status means:
Status on /docs | Status on /tests | Status on detail page | Compliance status | Definition |
OK | OK | Passing | Passing | A non‑expired file exists in the document container → compliance status is passing. |
Needs update | Due soon | Passing | Passing | The document is nearing expiration (within the reminder window for the recurrence cadence) → compliance status is passing. |
Needs document | Needs remediation | Needs attention | Failing | No files have ever been uploaded. |
Needs document | Overdue | Needs attention | Failing | There are only expired files uploaded. |
Not relevant* | Not relevant | Deactivated | N/A | Deactivated or ignored for the standard by an auditor. |
Upcoming | Upcoming | Preview | N/A | A new document test that is rolling out soon. |
Adding or Updating Documents
From the left-hand navigation panel, select Documents. From here, you will be able to view the complete list of required documents and those that have already been uploaded.
Select Document Needed for a specific document or Add Document at the top right-hand corner to add a new record.
After clicking "Add Document," you will be prompted to complete the pop-up with the Document itself and its information.
Clicking on a specific document name will bring you to a page with information surrounding the Document's history.
You can upload a new document, a new version of the Document, or add a link to it if it is stored elsewhere.
Vanta supports various file types for document uploads, ensuring flexibility and convenience for users. The supported file types include .ai, .csv, .docx, .jpg, .pdf, .png, .txt, .webp, .xlsx, and .zip. The maximum file size allowed for uploads is 50 MB. This will enable users to upload documents in formats that are most accessible and convenient for them, including image files like .png### Troubleshooting File Format Compatibility
Why Is My Upload Failing Due to an Invalid File Type? Vanta does not accept certain file formats, such as
.XLS. If you encounter an invalid file type error, convert your file to a supported format, such as.XLSX,.CSV, or.PDF, and re-upload.Why Are Word or Excel Documents Showing Upload Errors? Documents with Microsoft Information Protection (MIP) labels or similar protections cannot be uploaded to Vanta. To fix this:
Remove the protection label if possible.
Export the document to an unprotected format (e.g., PDF) and re-upload.
This page will also show you the audit history, showing the actions taken in the document within Vanta.
The Details section of the page will describe the Document, its time density and occurrence, and ownership.
Ownership can be adjusted by selecting 'Edit' and choosing a new assignee from the dropdown.
or
Select the checkbox for the row of the Document, and then select the new owner in the dropdown next to the search bar
Bulk Uploading Documents
From the right-hand navigation panel, select Add Document, followed by Import documents
Download the Excel template
Complete the columns with the following information
Name: Document name
Description: Description of the document
Restricted: Valid values include:
true– document can only be viewed by Admins, owners, and auditorsfalse– document is visible to all usersTip: Use
truefor sensitive files like employment agreements or background checks
Cadence (How often the document should be renewed):
NeverWeeklyMonthlyQuarterlyBi-annuallyAnnuallyTip: This field helps Vanta notify you when it’s time to reupload or review the document
Time Sensitivity:
Valid values include
AnytimeandDuring audit windowTip:
Anytimemeans the document can be valid year-roundDuring audit windowmeans the document is only relevant during a defined audit period
Control IDs (optional): Assign one or more Vanta control IDs the document maps to.
Example:
"AST-1"or"AST-1,AST-5"Important: This must be a Vanta control ID, not a framework or criteria ID
You can find control IDs on the Controls page
Tip: You can leave this blank if the document doesn’t map to a control
Once the template is completed, select the + and upload it to Vanta.
Select Import
Vanta will validate each row and alert you of any formatting errors
If no issues, the documents will appear under the Custom Documents section in Vanta
Please Note: Make sure each column has a valid entry. This helps avoid upload errors. You won’t always be able to avoid errors completely, but entering clean data reduces back-and-forth fixes.
This upload method helps reduce manual work and ensures consistent tracking of document requirements across your organization.## Common Document Upload Troubleshooting
Why Can’t I Upload Sensitive Documents? In Vanta, users with "Editor" permission cannot upload sensitive documents. To resolve:
Have an Admin upload the document.
Request an upgrade to "Admin" permissions from your account admin.
Why Is the Submission Button Greyed Out? This usually occurs with actions on expired documents. To resolve:
Remove the expired document.
Update or upload a valid document.
Why Don’t Documents Appear After Uploading to a Control? This issue might happen if the control is snoozed. To resolve:
Go to Frameworks > ISO > Control: A.8.14 Redundancy of Information Processing Facilities.
Click Add Control.
Use the filter to select "No Framework."
Select "Redundancy of Information Processing Facilities."
Click Add.
Editing Document details
To edit the document filename or description, select the Edit button on the right-hand side of the page
To edit the recurrence or owner, click the buttons for the owner or recurrence underneath the title and description
If the document is attached to a test, any updates you make here, such as renaming the file or updating the owner, will also be reflected in that related test.
Setting / Editing Document Recurrence
Click into the document you would like to edit
From the Details section, select Edit under Time Sensitivity & recurrence
Select
Annually
Bi-annually
Quarterly
Monthly
Weekly
Never
For documents that are part of automated or recurring document tests, adjusting the recurrence also updates how often Vanta checks that evidence for compliance.
Removing Documents
To remove a document, select the title you want to delete
Once on the document's details page, select ... the document you would like to delete
Select Delete
Please Note: the document is tied to a test, deleting it here will cause that test to fail until a new version of the document is uploaded. Always confirm whether the document is linked to an active test before deleting it.
Downloading Documents
Export All: This option will download all documents stored on the Documents page in a zipped file.
Export One:
Select the title of the document you would like to download
Once on the document's details page, select the Document you want to export.
Select Download
Please Note: Downloaded documents will include any that were uploaded as part of document tests. These files serve as your point-in-time compliance evidence and can be shared with auditors if needed.
Sensitive Documents
Documents marked with a sensitive tag are restricted to document owners and users with Admin permissions. Auditors are granted temporary access to sensitive documents during a scheduled audit period to verify that your organization is following the requirements for SOC 2.Additionally, users with the "Editor" permission level cannot upload sensitive documents. To address this:
Have an Admin upload the document on your behalf.
Request an upgrade to "Admin" permissions from your account administrator if you need ongoing access.
It is not possible to change the sensitivity of a default document. Custom documents can be flagged as Sensitive; see "Marking Custom Documents as Sensitive" for more details.
Examples of documents that may be marked as sensitive include:
Board of Directors meeting (note: not sensitive by default)
Background checks
Exit interview
Org chart
Performance evaluations
Contractor Agreement
Employee agreement
Approval Workflows for Documents
For more information about plan types and capabilities, see Vanta's pricing page
From the Compliance settings page, enable the Document approval workflow. Select the individual(s) for each approval step. Up to three approvers can be assigned to each step, and you may have up to five steps in your approval process.
Please note that this approval workflow will be enabled for all documents once turned on.
Once your document has been uploaded (either directly or as part of a document test), you can submit it for approval. Approved documents automatically mark their related tests as “OK,” confirming compliance evidence for the associated control.
From the Evidence tab of the selected document, select Submit for approval.
Approvers will receive an email to review and approve the evidence submitted to a document. If there are multiple steps, all approvers in each step must approve before the next step begins.
Once the document has been approved, it will become visible to auditors from their Auditor instance.