Privacy Policy

This Policy explains what we collect when you use the Vanta Intelligence platform (the "Service"), how we use and share it, and the choices you have. It is part of our Terms of Service. Capitalized terms not defined here have the meaning given there.

1. What we collect

Account information. Name, email address, password (stored as a hash), username, subscription tier, and verification status. If an administrator creates your account, they provide the initial information.

Professional profile. Company, division, role, title, biography, domains of expertise, agency and geographic focus, watched companies and programs, contract vehicles, keywords, onboarding answers, and any interview-style responses you give during setup. Part of this becomes your public profile, visible to other users under your visibility settings.

Intelligence fingerprint. From your profile, your onboarding answers, and your activity in the Service, our models derive a structured representation of your professional interests (companies, programs, domains, and keywords, each weighted by relevance) that we use to personalize what you see. You can review it in your account.

Content you submit. Connect posts, comments, direct messages, attestations, endorsements, flags, suggestions, event RSVPs, War Room contents, and documents you upload to the Vault, including their extracted text and derived analysis.

Activity and usage. How you use the Service — what you view, open, save, share, dismiss, and search for; which tabs and features you use; AI-assisted requests you make (and their token counts and cost, which we use to enforce allowances and manage our own costs); timestamps; and device and browser information such as user agent and approximate location inferred from IP address. We use these to rank and personalize content, to operate usage limits, and to understand how the Service is used.

Communications. Messages you send to support and feedback you provide.

We do not knowingly collect information from anyone under 18, and the Service is not directed to them.

2. How we use it

• To provide and personalize the Service — ranking signals, generating briefs and insights, computing relevance, maintaining your fingerprint, and operating Connect, ATLAS, Events, and the Vault.
• To generate AI-assisted content — your queries, profile, activity, and submitted content are processed by machine-learning models (see Section 4) to produce summaries, analysis, and answers.
• To synthesize community intelligence — Connect posts and contributions may be analyzed and combined into aggregate insights shown to other users, unattributed except as described in the Terms (Section 4.2).
• To maintain ATLAS — attestations, endorsements, flags, and suggestions become part of the capability map.
• To enforce usage allowances and security — counting AI-assisted requests, detecting abuse, protecting accounts, and complying with export-control obligations.
• To operate the business — support, analytics, product improvement, and, when offered, billing.
• To communicate with you — service notices, security alerts, and, if you opt in, product updates. We do not send marketing on behalf of third parties.

3. How we share it

With other users, according to your settings and the nature of the content: your public profile appears in the Connect directory; your posts are visible to all users; public RSVPs show your attendance; accepted contributions appear in ATLAS; messages go to their recipients. Other users can see whether you are connected to them.

With service providers that process data on our behalf ("subprocessors"). As of this version:

| Provider | Purpose | Location | |---|---|---| | Anthropic, PBC | AI model processing (analysis, summaries, personalization, moderation) | United States | | MongoDB, Inc. (Atlas) | Database hosting | United States | | Railway Corp. | Application hosting | United States | | Google LLC (Workspace) | Email for support and administration | United States |

Subprocessors are bound by contract to use data only to provide their services to us. Content sent to Anthropic's API for processing is subject to Anthropic's API terms, under which API inputs and outputs are not used to train Anthropic's models.

For legal reasons — to comply with law, regulation, legal process, or governmental request; to enforce our Terms; or to protect the rights, property, or safety of Vanta, our users, or the public.

In a business transfer — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not sell your personal information, and we do not show advertising in the Service or allow advertisers to pay for placement in Service content.

4. AI processing

The Service relies on large language models to read, summarize, classify, and generate content. Your profile, activity, and content — including uploaded documents and their extracted text — may be sent to those models to produce the features described above. Model outputs may be inaccurate. Where the Service shows AI-generated content, treat it as a starting point for your own judgment, not as fact.

We record the token counts and computed cost of AI-assisted requests attributed to your account. This is used to enforce your tier's allowances and to manage our costs; the dollar figures are not shown to you but the usage meters are.

5. Security

We use encryption in transit (TLS), hashed passwords, token-based authentication, access controls, and hosted infrastructure with its own security programs. Uploaded documents are stored in our database and are private to your account unless you share them.

Direct messages are not currently end-to-end encrypted. They are protected in transit and at rest by our infrastructure, and Vanta staff do not read them in the ordinary course of business, but we could access them if required by law or to investigate abuse. Do not use the Service to transmit classified information, Controlled Unclassified Information, or export-controlled technical data. We intend to add end-to-end encryption for messages and will update this Policy when we do.

No system is perfectly secure. If you believe your account has been compromised, contact support@vantaintel.ai.

6. Retention

We keep your account and profile data while your account is active. Activity and usage records are retained for operational analytics and allowance enforcement, then aged out on a rolling basis. Uploaded documents remain until you delete them or your account is deleted.

When you delete your account, we delete your account, profile, fingerprint, messages, RSVPs, War Rooms, uploaded documents, and activity records. Content that has already been synthesized into aggregate community insights or incorporated into ATLAS may persist in derived form, because it can no longer be practically separated from the aggregate; it is not attributed to you. We may retain limited records where required by law, to resolve disputes, or to enforce our agreements.

7. Your choices and rights

• Profile and visibility. You can edit your public profile, choose whether you appear in the directory, and control whether others can send you connection requests. You choose whether each RSVP is public.
• Fingerprint. You can review your intelligence fingerprint in your account and, where the Service allows, adjust or reset it.
• Access, correction, deletion. Contact support@vantaintel.ai to request a copy of your personal information, to correct it, or to delete your account. We will verify the request and respond within a reasonable time.
• State privacy rights. If you are a resident of California, Virginia, Colorado, Connecticut, Utah, or another state with a comprehensive privacy law, you may have rights to access, correct, delete, and port your personal information and to opt out of certain processing. We do not sell personal information or use it for targeted advertising. To exercise rights, use the contact above. We will not discriminate against you for doing so.
• Communications. Service and security notices cannot be opted out of while you hold an account. Other communications will offer an opt-out.

8. International users

The Service is operated from the United States and its data is stored and processed there. If you use the Service from outside the United States, you consent to the transfer and processing of your information in the United States, which may not provide the same protections as your home jurisdiction. The Service is intended for defense-industry professionals and may be restricted in certain jurisdictions under U.S. export-control and sanctions law.

9. Children

The Service is not intended for anyone under 18. If we learn we have collected information from a person under 18, we will delete it.

10. Changes to this Policy

Each version of this Policy carries a version number and effective date. When we make material changes, the Service will present the new version and require your acknowledgment before continued use. Prior versions are available on request.

11. Contact

Questions, requests, and complaints: support@vantaintel.ai Vanta Intelligence LLC · Registered agent on file with the State of Delaware