Vanta: Trust page changed

Trust pagechanged

Vanta’s Trust page added the “Vanta Ongoing Authorization Report (OAR) September 2026_Public Version” resource and an “OAR Report” label, giving customers another security document to review. It also removed the FAQ prompt “What are the key security controls mentioned in the Vanta Trust Center?”; the diff does not show any security-control changes.

Trust pagechanged

Vanta’s Trust page stopped listing “Remote access MFA enforced” and added “Production data segmented,” changing the security controls customers can verify there. It also updated the penetration-test findings reference from August to September 2026 and removed a compliance-frameworks FAQ question; the evidence does not establish that underlying controls changed.

Trust pagechanged

Vanta’s Trust page removed “Data encryption utilized” from Product Security and an example question about access controls and authentication. These are page-content removals; the evidence does not establish that Vanta’s underlying security controls changed.

Trust pagechanged

Vanta’s Trust page added “Production database access restricted” and removed “Production data segmented” from its displayed Infrastructure Security controls. The listed security assurances changed, but the diff does not establish whether the underlying controls changed.

Trust pagechanged

Vanta’s Trust page removed “Production database access restricted” and added “Production data segmented” in Infrastructure Security. This changes the controls shown to customers reviewing Vanta’s security posture, but does not establish whether the underlying controls changed.

Trust pagechanged

Vanta’s Trust page added “Production database access restricted” and “Data encryption utilized” control listings, while removing “Production data segmented” and a security-controls FAQ question. Customers reviewing security assurances now see different controls listed; the diff does not establish changes to underlying security practices.

Trust pagechanged

Vanta reported applying all necessary patches for Node.js vulnerabilities, including CVE-2026-111497, by October 22 following security updates on October 21. The Trust page also changed its displayed security controls; these listing changes do not establish that underlying protections were discontinued.

Trust pagechanged

Vanta added “Penetration Test Status of Findings (Oct 2026)” and a PHP vulnerability response stating its application does not use PHP and production infrastructure is unaffected. Displayed controls replace “Production inventory maintained” with “Password policy enforced”; the SOC 2 report announcement was removed. These update customer-facing security disclosures without establishing changes to underlying controls.

Trust pagechanged

Vanta’s trust page removed “Password policy enforced” and added “Production inventory maintained” in the visible Organizational Security controls list. This changes the controls shown to customers, but the diff does not establish whether the underlying controls changed.

Trust pagechanged

Vanta’s Trust page removed the question “How does Vanta handle access controls and authentication?” This is a page-content change; the evidence does not show any change to Vanta’s security controls.

Trust pagechanged

Vanta’s Trust page added the question “How does Vanta handle access controls and authentication?” The diff shows no answer or security-control change, so this is informational wording only.