Vanta publishes a package rate card
Vanta does not put a price list on its own website, which is where the reputation for opacity comes from. It does publish one on AWS Marketplace, where the listing carries a full pricing-dimension table with named packages and dollar figures against each. That is a public list price, and it is the single most useful number a buyer can start from.
Vanta on AWS Marketplace: the published dimensions
checked July 2026
Every figure below is priced per 12-month contract and the listing labels its own pricing as a starting price, so read these as floors rather than as prices.
| Dimension, as listed | Listed price |
|---|---|
| Essentials Package1-20 employees | from $14,000 |
| Plus Package | $21,500 |
| Professional Package | $23,000 |
| Trust Center | $6,000 |
| Third-Party Risk Management | $13,600 |
Listed on AWS Marketplace (prodview-5ophamrbfxt44), checked July 2026. AWS shows no price-effective date on the pricing tab, so the check date is the provenance. These are the dimensions the listing publishes separately; it publishes no combined figure, so add only the lines your own scope needs. Lines marked from are worded as a starting price on the listing itself. The listing also offers a private-offer path, so a negotiated price may differ from the list dimensions above. A marketplace list price is a real public fact; what the vendor actually sells at is not something we know.
Two things on that listing are true at once, and buyers who see only one of them draw the wrong conclusion. The public dimensions above are real. And the same page carries an express private-offer call to action plus the line that pricing is tiered by company size and programme complexity. So the list price is a genuine anchor, not a promise: what Vanta lists is a fact, what Vanta sells at is not something we know.
Read Essentials as a floor, not a price
The Essentials dimension is scoped to a 1-20 employee band and is described on the listing as a starting cost. Both halves of that matter. The band means the figure only speaks to companies of that size, so a 60-person company reading $14,000 as its own entry point is reading a number written for someone else. The starting-cost wording means that even inside the band it is a floor rather than a fixed price.
Above Essentials, Vanta lists Plus at $21,500 and Professional at $23,000. The listing does not publish which employee bands those two are scoped to, nor what each package includes, so what separates them is not a public fact. That is the honest boundary of what the listing tells you: the prices are published, the scope of the upper packages is not.
Trust Center and vendor risk are priced as their own lines
The listing prices Trust Center at $6,000 and Third-Party Risk Management at $13,600, each as its own dimension. The useful inference is structural rather than arithmetic: these are separately priced modules, so a buyer cannot assume either is inside a package price. Whether your package already includes one is exactly the sort of thing to pin down in writing before signing, because the listing does not answer it.
Resist the temptation to add the lines up. The listing publishes each dimension separately and publishes no combined figure, so a package-plus-Trust-Center total would be arithmetic of your own, and only you know which lines your scope actually needs.
Comparing Vanta to the other platforms, honestly
This is where most comparisons go wrong, including the ones written by vendors. The seven GRC platforms that publish on AWS Marketplace do not scope their listings to the same band, so their headline numbers are not interchangeable. Vanta's cheapest package covers 1-20 employees. Drata's platform fee is scoped to a 100-FTE organisation. Secureframe and Sprinto both scope their platform dimension to 100 employees. Putting those four figures in one column would compare different products at different sizes and call the result a ranking.
Where the bands do line up, the comparison is fair and worth making. At roughly twenty employees, Vanta lists Essentials at $14,000 and Scrut lists its single Compliance Automation dimension at $15,000 for organisations up to 20 employees. Those two are genuinely comparable, and Vanta's listed figure is the lower of the pair. The platforms comparison sets out every published dimension side by side with its band attached.
What the listing does not tell you
Three things drive real spend and none are published. First, the employee bands above Essentials: the listing shows that headcount is a pricing axis without saying where the steps fall, so growth through a band is a real budgeting risk you can only size by asking. Second, what each package includes: with Trust Center and vendor risk priced separately, package contents matter, and they are not listed. Third, the renewal: no vendor publishes its escalation terms, so the cap on year-two and year-three increases is a contract question, not a research question.
The listing is also silent on the audit, correctly, because Vanta does not sell one. The SOC 2 examination is a separate engagement with a CPA firm, quoted against your scope. No CPA firm publishes a rate card, so that line cannot be looked up at all. The audit firms guide covers what actually sets that quote.
How to use these numbers in a negotiation
The private-offer path on the listing is itself the most useful thing on this page. A marketplace offers that mechanism precisely because list is not where every deal lands, so the published dimensions are a floor to negotiate from rather than a take-it-or-leave-it price. What a typical discount looks like is not something anyone publishes, and the figures that circulate through buyer-data aggregators are self-reported and unverifiable, so this page does not carry one.
What you can do is arrive with the list dimensions in hand, a written scope, and the same scope in front of two other vendors. Ask for the band structure and the renewal escalator in writing, because those are the two things the listing cannot tell you and the two that decide what you actually pay over three years.