✅ Feature availability: You can use the Vanta Agent when AI is enabled on a current plan. The specific agent features and guided flows available to you depend on your plan and enabled features—refer to Vanta Plans and Pricing for details.
In addition to asking the Vanta Agent questions about your security and compliance program, we've also built guided flows: structured conversations that help you onboard, set up, or implement a specific part of your compliance program. The Vanta Agent asks for the information it needs, takes supported actions after your confirmation, and guides you to the right next step when something needs to be completed elsewhere in Vanta.
⚙️ User permissions: Vanta Agent access depends on your user role and permissions. Within the agent, what you can read or write aligns with your user role, product permissions, and object assignments. Learn more: User Permissions by Product Area
Feature availability
Guided flow | Eligibility |
Available for importing custom controls, custom policies, and custom frameworks. If enabled on your plan, it can also create custom fields and custom frameworks. | |
Available if the Vanta Control Framework (VCF) is enabled on your plan. | |
Available only if SOC 2 guide appears in your account navigation menu. | |
Available if your Trust Center hasn’t been created yet. |
Compliance program import
If you have existing controls, policies, or frameworks to bring into Vanta, you can import them with the Vanta Agent. Ask the agent, “help me import my compliance program”, then upload your files. The agent classifies each file, works out a plan, and asks for your approval along the way before creating anything. If enabled on your plan, it can also create custom fields and custom frameworks.
Here's what you can do with the agent during import:
Create a custom framework from a framework file, or when your control file references a framework that isn't enabled in your account.
Create custom controls from your control file. The agent maps them to the frameworks in your file, matches columns to control fields in Vanta, and suggests custom fields for any that don't match.
Choose whether your imported controls replace Vanta's default controls or are added alongside them.
Create custom policies and map them to your controls.
Map your imported controls to tests and documents.
The import flow is for creating new custom controls, frameworks, and policies, not for overwriting existing ones. After importing, you can ask the agent to suggest evidence for a control, map controls, or update control details like owners.
📖 Learn more: Custom Controls, Custom Policies, or Custom Frameworks
Common controls
When you set up common controls for the first time, the Vanta Agent walks you through mapping your controls to the Vanta Control Framework (VCF):
For VCF-supported frameworks, the Vanta Agent auto-maps default controls for you or suggests mappings for custom controls.
For other frameworks, you can map controls to common controls manually after initial setup is complete.
📖 Learn more: Managing Common Controls
SOC 2 guide
If you’re setting up SOC 2 in Vanta, the SOC 2 guide helps you build a targeted compliance program without having to figure out every next step on your own. It brings together a SOC 2 task list and Vanta Agent guided flows: some tasks are completed directly in Vanta, while others open a guided agent conversation for step-by-step help.
Vanta Agent guided flows in the SOC 2 guide include:
Getting started: The Vanta Agent can help you review your business information, invite your team by connecting an identity provider, and connect a collaboration tool.
Trust Center setup: The Vanta Agent can help create a basic Trust Center and get it ready to share.
Cloud setup: The Vanta Agent can help you connect AWS, GCP, or Azure, review cloud-related SOC 2 tests, and work through remediation steps for failing tests.
Policies: The Vanta Agent can guide you through reviewing the required SOC 2 policies so you can approve them in Vanta.
Risk: The Vanta Agent can recommend risk scenarios based on your company and help you add them to your risk register.
Vendors: The Vanta Agent can help you identify vendors to track for SOC 2, review vendor risk, and understand what documentation and review steps are needed for high- and critical-risk vendors.
Tasks that don’t open a guided Vanta Agent flow will still appear in the SOC 2 guide. You can still ask the agent what a task means or how to complete it.
📖 Learn more: SOC 2 Guide: Your compliance co-founder
Trust Center setup
If you’re setting up a Trust Center for the first time, you can use the Vanta Agent to create a basic Trust Center and get it ready to share.
Ask the Vanta Agent to set up your Trust Center. You’ll review the title, description, security contact email, and privacy policy link before the agent creates anything.
The agent can create the Trust Center, add an engagement letter when one is available, and help make the Trust Center public after you confirm.
If your Trust Center already exists but is private, the agent can help you make it public.
If your Trust Center is already public, the agent will confirm it’s live and share the link with you.
To edit or further customize your Trust Center after it’s created, use the Trust Center page in Vanta.
📖 Learn more: Vanta Trust Center or Vanta Engagement Letter