Enterprise DNA

Instead of Vanta

Stop renting Vanta. Own your security compliance system.

We build your version around your frameworks, your controls and the way your team works, bring your Vanta controls, risks and people across, and run it with whoever owns security in your business.

Vanta publishes no prices. Its Essentials, Plus, Professional and Enterprise plans are sold by personalised quote, and questionnaire automation, security reviews, access management and several risk features are listed as add-ons. The auditor is a separate bill.

Get your version built See it working
  • check_circleYour data in a database you own
  • check_circleOpen source, no lock-in
  • check_circleBuilt and run by Enterprise DNA

Read the quote

What sits inside the Vanta bill?

Vanta quotes each plan privately. Separate the services you rely on from the record keeping your team does every week anyway.

database

A plan sized by quote

Four plans, no published price. One framework comes with Essentials; more frameworks, more questionnaires and more reporting mean a bigger plan.

checklist

The control register

A list of controls, who owns each, its status and which framework requirement it meets. Underneath, that is a register your team keeps up to date.

description

Evidence collection

Policies, screenshots, reports and test results stored against each control. Most of it already lives in your own drive and systems.

shield

Hourly automated tests

Vanta connects to your cloud, identity and code systems and tests them every hour. Decide how many of those tests your auditor actually samples.

schedule

Questionnaires and supplier reviews

Questionnaire automation, security reviews and several vendor risk features are add-ons on the pricing page. Each is records you already hold, read a different way.

support

Dashboards and the trust centre

Readiness charts and a public trust page. Your own version gives the same readiness figures and a security summary you send customers yourself.

The work you can own

Know what stands between you and the audit

Readiness

Every control, its owner and its evidence

Each control carries its status and a pointer to where the evidence lives, with a date it goes stale. Readiness counts only controls that are in place with current evidence.

  • check Readiness by framework, with days to the audit
  • check Evidence that expires before the auditor arrives
  • check A Statement of Applicability with a reason for every exclusion
  • check The same control counted once across ISO 27001, SOC 2 and the Essential Eight

People and access

Leavers lose access the day they go

Who has access to each system and at what level, checked against who still works here. Access reviews go to each system owner as a draft list to confirm.

  • check Leavers who still hold an account, admin first
  • check Access removed later than your own deadline
  • check Systems overdue for an access review, or never reviewed
  • check Staff missing training, policy sign-off, MFA or a background check

Essential Eight

Patches timed against the published windows

Each vulnerability is timed from the day the fix was released: 48 hours for a critical or exploited flaw in an internet-facing service, two weeks for the rest of those and for browsers and office software.

  • check Days over each window, worst first
  • check The government control reference beside every finding
  • check Internet-facing systems without MFA enforced
  • check Your own window for everything else, changed in one sentence

Risks and incidents

The clocks that matter, in plain view

The risk register, the audit calendar and the incident log in one place. A privacy incident shows the Australian 30-day assessment deadline and whether the New Zealand Privacy Commissioner has been told.

  • check Open risks with no owner or no treatment, first
  • check Internal audit, management review, penetration test and restore test dates
  • check Suppliers holding your data without a current assurance report
  • check A management review pack and risk treatment plan, in your brand

Make it yours

Design your own Vanta replacement

Everything starts from the open-source base. Then it gets your name, the parts you run, your rules and your data from Vanta. Try it here, and we build the real one.

2. What it runs

3. Make it fit

4. Your colour

Your business · your Vanta replacement Your version
YB Your business

auto_awesome

Answered from your own database

Build my version

We build it from the open-source base, bring your Vanta data across and run it for you.

What it looks like

Ask it like you would ask a colleague

Three real answers from fictional demonstration records for a 40-person software company. Ask about readiness, a leaver or a late patch.

forum

Security Compliance for Claude Code

Connected to your own database

How ready are we for each audit?

Essential Eight Maturity Level One

Code
E8
Status
in-progress
Target_date
2026-12-12
Days_to_target
60
Applicable
9
Excluded
0
Implemented
5
Ready
4
Evidence_gaps
5
Ready_pct
44

ISO/IEC 27001:2022

Code
ISO27001
Status
in-progress
Target_date
2027-02-10
Days_to_target
120
Applicable
13
Excluded
3
Implemented
11
Ready
9
Evidence_gaps
4
Ready_pct
69

SOC 2 Type II

Code
SOC2
Status
in-progress
Target_date
2027-06-10
Days_to_target
240
Applicable
11
Excluded
0
Implemented
10
Ready
9
Evidence_gaps
2
Ready_pct
82

Ask it anything

Ten questions to ask of your security compliance

Each answer comes from the records in the free version. Vanta has its own dashboards and reports. Add the questions your auditor and your customers ask.

chat_bubble How many controls stand between us and the ISO 27001 audit date?
chat_bubble Who left the business and still has access, and to what?
chat_bubble Which patches are past their Essential Eight window, and by how many days?
chat_bubble Which evidence will expire before the auditor arrives?
chat_bubble Which suppliers hold our confidential data without a current SOC 2 report or ISO certificate?
chat_bubble When does the 30-day assessment deadline run out on this privacy incident?
chat_bubble Who has admin rights on more than one system?
chat_bubble Which exclusions in our Statement of Applicability have no reason written down?
chat_bubble Which staff have not accepted the policy we approved last month?
chat_bubble What can we honestly answer yes to on this customer's security questionnaire?

Switching

How to switch from Vanta

A move usually involves exporting and mapping your records, checking the imported results, and running both systems alongside each other before you switch.

  1. 1

    Export your Vanta records

    Download your controls one framework at a time, plus your risk register and People list. Vanta provides these as spreadsheets. Policies and evidence files come out as documents and a zipped folder. Keep those files in your own drive and note where each one lives, because the new system records their locations rather than storing the files.

  2. 2

    Load records after a test

    Rehearse the imports first, then load the records once you have checked the test results. Bring in controls framework by framework, along with the risk register and People list. People are matched by email, and controls shared across frameworks are linked rather than duplicated. Compare the imported counts with your Vanta exports before moving on.

  3. 3

    Check flagged records

    Review any records the import marks for attention, and compare the counts with your exports. Check that controls landed under the right framework, shared controls were linked, and people matched to the right email addresses. Spot-check important risks and confirm that the evidence locations you recorded point to files in your drive.

  4. 4

    Run both systems side by side

    For a short period, keep Vanta running while you use the new system for your compliance work. Compare the control and evidence records, people and access details, and risk register in both. Confirm that the new system covers what you need. The free version does not test connected systems hourly or include Vanta's staff portal, device agent or trust page, so decide how to handle those before ending Vanta.

  5. 5

    Switch off Vanta

    Once the records and day-to-day checks are working as expected, switch off Vanta if you have confirmed that you no longer need its features. Keep your exported policies and evidence files in your drive, with their locations recorded in the new system. Talk to your certification body or audit firm before changing tools, as you would with any change in tooling.

construction

Where the real effort goes

The main work is usually mapping your own fields and rules, then deciding how much history to bring across. The controls, risk register and People list have direct import paths. Policies and evidence files stay in your drive, so you need to decide which to retain and record their locations. If Enterprise DNA installs and runs the system for you, it handles the migration work.

Not ready for a call?

Get your Vanta switch plan by email

We will send you the step-by-step plan for moving your business off Vanta, what the move really involves, and how we would do it for you.

One email with your plan. No spam, and you can unsubscribe any time.

Three ways to own it

Start with the free version, then choose the help you need

Open source

Do it yourself

Free, open source

  1. 1 Clone the repository, run npm install and npm run demo
  2. 2 Open the folder in Claude Code, Codex, OpenCode or Cursor
  3. 3 Rehearse import vanta-controls on each framework export, then import vanta-risks and vanta-people
  4. 4 Start an empty database for your own records and run /readiness
Get it on GitHub

Built around your business

We customise it

An agreed setup fee

  • check Your frameworks, controls and evidence rules
  • check Your Vanta controls, risks and people mapped and checked
  • check Scheduled checks against your cloud, identity and code systems, if you want them
  • check A web front end or a customer trust page, or a different technology stack
Get your version built

Omni by Enterprise DNA

We run it for you

One setup fee, then a monthly retainer

  • check Installed and operated through Omni by Enterprise DNA
  • check Evidence chased from control owners before it goes stale
  • check Access reviews, supplier reviews and the Monday report prepared for you
  • check Your team and your auditor keep every judgement call
Book a discovery call

Questions

Instead of Vanta, answered

Does this replace everything Vanta does? expand_more

The free version covers frameworks, controls and evidence, policies, people and their access, systems, suppliers, risks, vulnerabilities, incidents and the audit calendar. Vanta also tests your connected systems every hour, runs a staff portal and a device agent, and hosts a trust page. We agree which of those you need and build them into your version, or keep Vanta for them, before you move.

Will our auditor accept it? expand_more

Auditors test whether your controls work and look at the evidence behind them. They do not require a particular software product. Your version keeps every control, the evidence location and date, and a record of every change and who made it. Talk to your certification body or audit firm before you switch, as you would with any change in tooling.

What can we bring across from Vanta? expand_more

Vanta lets you download your controls one framework at a time, your risk register and your People list as spreadsheets. Those load directly, with a test run first. Policies and evidence files come out as documents and a zipped folder: they stay in your own drive, and your version records where each one lives.

Who decides whether a privacy breach must be reported? expand_more

You and your adviser. The system shows the deadlines from the date an incident was found and drafts the assessment questions. It never contacts a regulator, a customer or an affected person.

How should we compare the price? expand_more

Vanta publishes no prices. Its plans are quoted privately, several features are listed as add-ons, and the audit itself is paid separately. Start from your own quote or invoice. Enterprise DNA quotes an agreed setup fee, then a retainer for running it. The free version costs nothing to use and change.

Bring your last audit report

Spend 30 minutes with Sam. Bring your control list, your last audit findings and the framework your customers ask for. We will show you what your version would flag today, and outline the migration, custom work and ongoing support you need.

Book a discovery call Get the free version

Security Compliance for Claude Code is free and open source, published by Enterprise DNA.

Done paying for Vanta?

Get your version built