Preparing for SOC 2 with Vanta

Vanta collects a slice of your evidence continuously and watches your configuration. It does not decide your scope, it does not write your policies, and it does not fix a control you do not have.

Last reviewed 2026-08-27Written by Jacob Masse, TrazTech Inc.

Vanta is a compliance automation platform. It connects to your cloud accounts, identity provider, code repository and device management, tests the configuration continuously against a control set mapped to the Trust Services Criteria, and keeps the resulting evidence with dates on it. For a Canadian company the practical cost is roughly $13,000 to $38,000 CAD a year for a small team on one framework, billed in United States dollars. It is the widest integration catalogue of the three platforms this site covers and the one most oriented towards getting a first report quickly.

What it genuinely does for you

Continuous configuration testing. The core of the product. It checks encryption settings, password policy, multi-factor enforcement, storage exposure, branch protection and dozens of similar items on a schedule, and flags a change the day it happens rather than the week before fieldwork. This is the part that is worth money, because it turns a periodic manual sweep into something that runs whether anyone remembers or not.

User and access evidence. Pulling user lists across connected systems, matching them against your people, and producing the export an auditor asks for. On a team of any size this is hours per quarter that disappear.

Device compliance tracking. Screen lock, disk encryption and endpoint protection status per machine, which is the item remote-first Canadian teams most often cannot evidence otherwise.

Vendor and questionnaire handling. A vendor register with document storage, plus tooling for answering inbound security questionnaires and publishing a customer-facing trust page. That last part is a sales asset rather than an audit one, and for a company whose deals stall on security review it can be the reason to buy rather than a side benefit.

Policy templates with acknowledgement tracking. A full set of documents you can edit in the product, with version history and per-person acknowledgement recorded automatically. The templates are American in wording, which matters below.

What it emphatically does not do

It does not decide your scope. Which products, which environments, which acquired system, which of your data stores is inside the audit. This is the single most consequential decision in a SOC 2 and the platform has no opinion on it. Get it wrong and you have a year of evidence covering the wrong boundary.

It does not write your policies. It gives you templates, which is not the same thing. Every cadence in a template is a commitment your auditor will test, so a set adopted unedited manufactures exceptions in your own report. The editing is the work and it stays with you.

It does not fix a control you do not have. A failing check tells you access reviews are missing. Running one, deciding what to revoke, and recording who reviewed what is your afternoon, and the platform's role ends at storing the result.

It does not cover the judgement-based evidence. Access review decisions, vendor assessments, the tabletop exercise, the risk assessment, incident write-ups, training completion and the penetration test with its remediation. On a first audit that remainder is a large share of the list, and it is the share people underestimate. The evidence tracker shows which items on your list fall on each side of that line.

It does not audit you. Only a licensed CPA firm issues the report. Vanta will introduce you to firms it works with, and a referral is a shortlist rather than a selection process. Compare on GetSOC2 before you take the introduction, because fees vary widely for the same scope.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

What it costs a Canadian company

Vanta publishes plan names and no prices, so every quote goes through a sales call. The figures below come from third-party procurement datasets that aggregate signed contracts, converted from United States dollars at roughly 1.35. Treat them as bands to negotiate against rather than a price list.

How the three compare on price

The entry point is the only figure that differs enough to decide anything. Above the entry tier the three converge, and the quote you are given depends more on whether you have a competing one than on which product it is for.

All three figures are converted from reported United States dollar contract values at roughly 1.35 and are bands to negotiate against, not price lists.

Below thirty people it is poor value

The threshold is around thirty staff, and the reasoning is arithmetic rather than preference. What a platform replaces is manual evidence collection, and the volume of that work scales with people and systems. Under thirty people you typically have one cloud account, one identity provider, a handful of hires and departures a year, and a change population small enough that a saved query answers it. Collecting that manually is a few hours a month on a routine, and the platform's annual fee lands at somewhere between a quarter and a half of your entire audit fee.

Above thirty the arithmetic reverses. Populations get large enough that manual assembly becomes error-prone rather than merely tedious, the number of connected systems grows past what one person tracks in a spreadsheet, and somebody starts spending a real fraction of their week on it. That is the point where the platform is cheaper than the alternative rather than more convenient.

Two things override the headcount rule in both directions. A company under thirty that carries two frameworks, or that loses deals in security review, should buy earlier, because the questionnaire and trust page tooling is doing sales work rather than audit work. A company over thirty with an unusual stack that the platform cannot integrate with should think again, since a platform covering half your systems leaves you running two processes instead of one.

Under the threshold, the choice is not Vanta or a spreadsheet. A free compliance workspace sits between the two and gives you the mapped control set, the evidence register and the policy templates without the subscription. TrazTech, which operates this site, runs one. It checks AWS, Okta, Google Workspace, GitHub, GitLab, Cloudflare and Jira daily. What it does not have is Vanta's integration breadth, its endpoint agent or its HR connectors, which is most of what the subscription buys. If your systems sit outside those seven, the headcount rule does not apply and you should buy. Readiness without a paid platform compares them.

The Canadian specifics

Vanta is an American company hosting your evidence in the United States. Two consequences follow.

The first is that it becomes one of your own subprocessors. It goes in the vendor register you build for the audit, you assess it like any other vendor, and you keep its own SOC 2 report on file. Companies routinely forget to list the compliance platform as a vendor, which is an easy finding for an auditor to notice.

The second is Quebec. If you hold personal information about people in Quebec, Law 25 requires an assessment before that information is communicated outside the province, and a compliance platform holding your user lists and HR evidence is a transfer. This is a documented assessment rather than a barrier. It has to exist.

The policy templates are written to American practice and do not contain the PIPEDA breach record obligation, the accountability requirement, or anything from Law 25. The policy templates page covers the edits, and the policy checklist lists the Canadian documents the platform's set will not include.

The position

Vanta is the reasonable default for a Canadian SaaS company above thirty people whose infrastructure sits with providers it integrates with, and particularly for one whose sales cycle keeps stalling on security review, since the questionnaire and trust page tooling is a revenue argument. It is the most expensive of the three at the entry band, and what you buy for the difference is integration coverage and speed to a first report rather than depth of workflow.

Below thirty people, on one cloud, with a date you control, buy nothing yet. A spreadsheet, a shared drive, a scheduled export script and a recurring calendar entry get a first audit done, and the money does more good spent on remediation or on a readiness assessment. You can add the platform in year two, when there is a running program for it to automate. Vanta's product and current plan structure are at vanta.com.

Common questions