Skip to main content
Nuphos authenticates to Vanta with an OAuth client-credentials app you create in your Vanta organization. The connector is read-only: the agent reads which compliance tests are failing (SOC 2, ISO 27001, HIPAA, PCI, GDPR) and helps you remediate — it never writes to Vanta.

​
Connect

​
Create a Vanta app

1

Open the Developer console

Sign in to Vanta as an admin and open Settings → Developer console.
2

Create a "Manage Vanta" app

Create an app of type Manage Vanta (OAuth client credentials) and grant it read access to tests.
3

Copy the credentials

Copy the Client ID (vci_…) and generate a Client Secret (vcs_…) — the secret is shown once.

​
Connect in Nuphos

In Connectors → Connect → Vanta, enter: Nuphos verifies the credentials against the Vanta API before saving. Access tokens are minted on demand and held server-side only — the agent reads through a Nuphos proxy and never sees your Vanta credentials.

​
In the Nuphos app

Compliance work happens through the agent — there’s no dedicated Vanta browsing surface. The binding itself lives in Connectors, where an Administrator can manage its allow-list or remove it.

​
What the agent can do for you

The agent reads your compliance posture: the tests that need attention (optionally filtered to infrastructure-facing categories), each with its failure description and recommended remediation. Where this gets powerful is cross-connector remediation:
  • “What’s failing in Vanta right now?” — it lists the failing tests with their remediation guidance.
  • When a failing test maps to a system you’ve connected — an S3 bucket without encryption on AWS, a missing DNS record on Cloudflare, a repo setting on GitHub — the agent can offer to fix it there, proposing a plan for your approval.
  • After the fix, Vanta’s next check reflects it — the agent can track the test back to passing.

​
Permissions & authorization

Two boundaries govern what happens through this connector:
  • Hard boundary — who can use it. Only team Administrators can bind or remove the app credentials, and they can restrict the binding to specific members with a member allow-list. Within a session the agent only holds credentials you explicitly selected, re-checked on every request.
  • Soft boundary — what the agent may do with it. Toward Vanta itself the connector is read-only, so there is nothing to gate. Remediation happens through your other connectors, where the usual rules apply — changes go through plan approvals and Auto-authorization on that connector.
The outer limit is the Vanta app’s grant: read access to tests, nothing more — the agent cannot alter your compliance data even in principle.

​
Good to know

Vanta allows one active access token per app, so use a dedicated app for Nuphos — sharing the app with other tooling makes the tokens revoke each other.