Tier
The tier sets the baseline: Essentials covers one framework, and risk management, reporting and the advanced Trust Center arrive at Professional. Moving up a tier is the main way a Vanta quote grows.
Pricing guide
Vanta pricing: what it actually costs
Vanta does not publish a price list. This guide sets out what Vanta does publish, what moves a Vanta quote, the figures on the public record, and the costs that sit outside any licence.
Vanta does not publish prices. Its pricing page names four tiers — Essentials, Plus, Professional and Enterprise — and asks buyers to request a demo for personalised pricing. The procurement platform Vendr reports a median of $20,000 a year across Vanta purchases it has data on. The licence is not the whole bill: Vanta's terms say professional services are not included in the subscription, so the audit is budgeted separately unless you buy Vanta's optional auditor bundle.
Last checked against Vanta's public pages on .
What Vanta publishes
Vanta's pricing page lists four tiers and no figures. Each tier is sold through a demo and a personalised quote, and the page does not state what the price scales with.
The entry tier, Essentials, is described as covering one compliance framework with an agentic policy generator, a basic Trust Center and core features of Vanta's AI agent. Higher tiers add questionnaire volume, risk and reporting, and an advanced Trust Center. Vanta's comparison table marks questionnaire automation, security reviews and access management, and some risk and third-party risk features as add-ons.
| Tier | How Vanta describes it |
|---|---|
| Essentials | One compliance framework with an agentic policy generator, a basic Trust Center and core Vanta AI Agent features. |
| Plus | Everything in Essentials, with 25 security questionnaires a year included. |
| Professional | Compliance, risk and reporting in one package, with an advanced Trust Center, agentic issue management and 144 questionnaires a year. |
| Enterprise | A fully customisable package for advanced GRC needs. |
The figures on the record
Every figure on this page, with who published it and the date we read it. Third-party procurement figures describe other buyers' contracts, not a quote for yours; audit estimates are the audit firm's fee, not the platform's.
$20,000 a year (median)
Vendr's median annual contract value for Vanta, based on data from 374 purchases, with a reported range of $7,500 to $57,207. Vendr's page states it was last updated in February 2026.
Source: Vendr, observed
$10,000 to $50,000 for a SOC 2 audit
Vanta's own guide to what a SOC 2 audit usually costs. This is the audit firm's fee, separate from the Vanta subscription unless bought through Vanta's auditor bundle.
Source: Vanta, observed
What moves the bill
The variables a Vanta quote is built from, as Vanta describes them.
Number of frameworks
Essentials is described as covering one compliance framework. Vanta's pricing page does not say how additional frameworks are priced on the other tiers, so get it itemised.
Questionnaire volume
Plus includes 25 security questionnaires a year and Professional 144, and questionnaire automation also appears as an add-on. A sales-led team answering many questionnaires should size this before signing.
Add-on modules
Vanta's tier comparison marks security reviews and access management, and some risk and third-party risk features, as add-ons rather than tier inclusions.
Costs outside the licence
The platform fee is rarely the whole cost of a compliance programme. Budget for these whichever platform you choose.
The audit itself
Vanta's terms FAQ says professional services are not included in a subscription, and its help centre says customers buy either the software alone or the software with a Seamless Auditor Bundle, whose price is not public. Software-only buyers contract an audit firm directly.
Penetration testing
Most SOC 2 and ISO 27001 programmes commission at least one external penetration test a year, and enterprise buyers increasingly ask for the summary. It is a separate engagement unless a quote explicitly bundles it.
Your team's time
Someone owns the programme: writing and approving policies, closing control gaps, answering the auditor and keeping evidence current between audits. Automation shrinks that work but does not remove it, and it is usually the largest cost that never appears on an invoice.
Switching later
Evidence collected from your own systems can be re-collected by another platform; policies, risk registers and audit history need exporting. Ask how exports work before you sign, because the cost of leaving is part of the cost of joining.
Questions to put in the quote request
Which frameworks are included at the price quoted, and what does each additional framework cost?
What headcount, entity or connected-system limits does the quote assume, and what happens when we cross them?
Which line items are add-ons — questionnaire automation, trust center, vendor risk, access reviews, AI features?
Is the audit included? If so, which firm, which report types, and how many audit cycles?
What is the renewal cap, and is it in the order form?
Where is our data hosted by default, and is an EU region included or extra?
Can we export policies, evidence and audit history in a usable format if we leave?
How Noru is priced
Noru does not publish a price list either, and there is no self-serve sign-up. Every deployment includes the platform — one control library mapped across 30+ frameworks, continuous evidence from 20+ integrations, Cortex AI grounded in your programme, EU data residency, role-based access control, a DPA and an SLA — and you license the capability packages your obligations require on top.
Each package is priced per deployment by the scope it governs: Compliance & Audit by the frameworks in scope and the size of your workforce, Privacy Automation by the systems connected and the processing activities in scope, AI Governance by the AI systems under governance, and Third-Party & Supply Chain Risk by the vendors under management. You get a written quote after a demo that itemises each one.
Noru is not an audit firm. Your auditor's fee is a separate contract whichever platform you pick; Noru's job is to have the evidence collected and mapped before the auditor asks for it.
How much does Vanta cost?
Vanta does not publish prices; its pricing page asks buyers to request a demo for personalised pricing. The nearest public reference is Vendr, which reports a median of $20,000 a year across 374 Vanta purchases with a range of $7,500 to $57,207 — other buyers' contracts, not a quote for yours.
Does Vanta's price include the SOC 2 audit?
Not by default. Vanta's terms FAQ says professional services are not included in the subscription. Its help centre describes an optional Seamless Auditor Bundle bought alongside the software; its price is not published. Vanta's own guide puts a SOC 2 audit at $10,000 to $50,000.
What does Vanta Essentials include?
Vanta describes Essentials as one compliance framework with an agentic policy generator, a basic Trust Center and core features of its AI agent. Questionnaire volume, risk management and reporting arrive in higher tiers.
Is Noru cheaper than Vanta?
Neither publishes a price list, so there is no honest headline answer. Noru licenses the platform plus the capability packages your obligations require, priced per deployment by the scope you run. Book a demo for a written quote and compare it line by line with Vanta's.
Primary sources
Every claim about Vanta on this page comes from the public pages below, last checked on . Competitor products and prices change — if something here is out of date, tell us and we will correct it.
Get a written quote to compare
We walk the platform against your obligations, agree the packages and scope, and send a written quote — or tell you Noru isn't the right fit.