> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Vanta

> Connect Vanta to read your compliance posture — the failing tests that need attention.

Nuphos authenticates to Vanta with an **OAuth client-credentials app** you
create in your Vanta organization. The connector is **read-only**: the agent
reads which compliance tests are failing (SOC 2, ISO 27001, HIPAA, PCI, GDPR)
and helps you remediate — it never writes to Vanta.

## Connect

### Create a Vanta app

<Steps>
  <Step title="Open the Developer console">
    Sign in to Vanta as an admin and open **Settings → Developer console**.
  </Step>

  <Step title="Create a &#x22;Manage Vanta&#x22; app">
    Create an app of type **Manage Vanta** (OAuth client credentials) and grant
    it read access to tests.
  </Step>

  <Step title="Copy the credentials">
    Copy the **Client ID** (`vci_…`) and generate a **Client Secret**
    (`vcs_…`) — the secret is shown once.
  </Step>
</Steps>

### Connect in Nuphos

In **Connectors → Connect → Vanta**, enter:

| Field             | Notes                                 |
| ----------------- | ------------------------------------- |
| **Label**         | A friendly name, e.g. "Acme Vanta"    |
| **Client ID**     | Starts with `vci_`                    |
| **Client Secret** | Starts with `vcs_` — stored encrypted |

Nuphos verifies the credentials against the Vanta API before saving. Access
tokens are minted on demand and held server-side only — the agent reads through
a Nuphos proxy and never sees your Vanta credentials.

## In the Nuphos app

Compliance work happens **through the agent** — there's no dedicated Vanta
browsing surface. The binding itself lives in **Connectors**, where an
Administrator can manage its allow-list or remove it.

## What the agent can do for you

The agent reads your compliance posture: the tests that need attention
(optionally filtered to infrastructure-facing categories), each with its
failure description and recommended remediation. Where this gets powerful is
**cross-connector remediation**:

* *"What's failing in Vanta right now?"* — it lists the failing tests with
  their remediation guidance.
* When a failing test maps to a system you've connected — an S3 bucket without
  encryption on [AWS](/connectors/aws), a missing DNS record on
  [Cloudflare](/connectors/cloudflare), a repo setting on
  [GitHub](/connectors/github) — the agent can offer to **fix it there**,
  proposing a [plan](/agent/plans) for your approval.
* After the fix, Vanta's next check reflects it — the agent can track the test
  back to passing.

## Permissions & authorization

Two boundaries govern what happens through this connector:

* **Hard boundary — who can use it.** Only team **Administrators** can bind or
  remove the app credentials, and they can restrict the binding to specific
  members with a [member allow-list](/security/access-control). Within a
  session the agent only holds credentials you explicitly selected, re-checked
  on every request.
* **Soft boundary — what the agent may do with it.** Toward Vanta itself the
  connector is read-only, so there is nothing to gate. Remediation happens
  through your **other** connectors, where the usual rules apply — changes go
  through [plan approvals](/security/approvals) and
  [Auto-authorization](/security/auto-mode) on that connector.

The outer limit is the Vanta app's grant: read access to tests, nothing more —
the agent cannot alter your compliance data even in principle.

## Good to know

<Info>
  Vanta allows one active access token per app, so use a dedicated app for
  Nuphos — sharing the app with other tooling makes the tokens revoke each
  other.
</Info>