Connect Vanta

• A SPHIOR Business or Enterprise plan.
• The administrator role in your SPHIOR organization.
• A Vanta account that is allowed to add integrations.

1. In the SPHIOR console, open Connections in the header.
2. Select GRC integrations, then click Connect on the Vanta row.
3. Choose the projects whose evidence should be sent to Vanta, then click Save & continue to authentication.
4. Vanta opens in a new tab. Allow SPHIOR to access your Vanta account.
5. Back in SPHIOR, the Vanta row shows Connected.

• Assets. Each domain in the selected projects that SPHIOR diagnoses.
• Vulnerabilities. Open findings from the latest completed diagnosis: name, description, severity, the URL and HTTP method where it was detected, and remediation guidance. Resolved findings, findings marked as false positives and informational findings are not sent. Up to 50 detection locations are sent per finding, without request or response contents.
• Users. Name, email address, role, sign-in method, multi-factor authentication status and last sign-in time of each person with access to SPHIOR.

SPHIOR does not send source code, page contents collected during diagnosis or credentials.

• SPHIOR sends the full current set about once an hour for each connection. Each sync replaces what Vanta shows from the previous one.
• Vulnerabilities come from the latest completed diagnosis of each domain, so they appear after the first diagnosis has finished.

In Connections, open Manage on the Vanta row and click Disconnect at the bottom. SPHIOR stops sending to Vanta, revokes the access granted to SPHIOR in Vanta and deletes the credentials stored in SPHIOR.

• Re-authentication required. The access granted in Vanta has expired. Click Continue to authentication and allow access again.
• No vulnerabilities appear. Check that the selected projects contain a domain and that its diagnosis has completed.
• Still not working. Contact support@sphior.com with your organization name and the time the problem occurred.