Attest
Scheduled Oct 1, 2026Continuous compliance evidence, collected in your own account.
Replaces
- Vanta · Vanta Inc. — no published list price
- Drata · Drata Inc. — no published list price
Rented, per year
Not published
These vendors quote privately. We use your contract, not a guess.
Owned, per year
$5,520
AWS infrastructure only. Azure is $5,940.
Build
9 weeks
2 engineers. To parity on the ten core features for SOC 2 Type II and ISO 27001, including twelve evidence collectors and a first full evidence bundle produced against a live estate.
Difficulty
4/5
Substantial. Compliance or realtime depth involved.
Reference organisation: 400 employees, 3 cloud accounts/subscriptions, ~6,000 resources, 40 registered vendors, 2 frameworks, 7-year evidence retention, single region, prod + non-prod. 3-year Compute Savings Plan on Fargate / 3-year reservation on Container Apps. Aurora minimum 0.5 ACU. Evidence storage modelled at 400 GB growing 12 GB/month, transitioning to infrequent-access at 90 days but held under Object Lock. Excludes AWS Config, Defender for Cloud and any vulnerability scanner you already pay for. Excludes the audit fee itself. These figures are infrastructure only and exclude the build.
What it is
Attest collects and stores the evidence a SOC 2 Type II or ISO 27001 audit asks for: control definitions, automated tests against your cloud and SaaS estate, personnel onboarding and offboarding records, access reviews, vendor risk records and policy acknowledgements. It runs inside your own accounts, reads your systems with least-privilege credentials you issue, and keeps every artefact in a Postgres database and object store you control. It is for companies past their second audit cycle, where the compliance platform has become a permanent, unpriced line item and the evidence it holds about your own infrastructure is not exportable in any form your auditor will accept.
Why this one stops making sense
- Neither Vanta nor Drata publishes a price. A renewal you cannot benchmark is a renewal you cannot negotiate, and the vendor knows how close your audit window is.
- The platform holds a complete, timestamped map of your infrastructure, your staff and your access grants. That is one of the most sensitive datasets in the company, and it lives outside your control boundary by design.
- Evidence collection is read-only API polling and a diff. It is genuinely automatable, and it is roughly nine weeks of work — not a permanent subscription.
- Control mappings drift. When your architecture changes, the vendor's generic test for "encryption at rest" often stops matching what you actually run, and you cannot edit the test — only mark it an exception.
- Multi-framework overlap is where the pricing hurts. Adding ISO 27001 next to SOC 2 is largely the same evidence mapped twice, and it is usually priced as a second product.
What ships
- Control library with your own definitions, mapped many-to-many to SOC 2 TSC and ISO 27001 Annex A
- Scheduled automated tests against AWS, Azure, GitHub, your IdP, your MDM and your ticketing system
- Immutable, timestamped evidence store with content hashes and a WORM retention policy
- Personnel lifecycle records: onboarding checklists, background-check attestation, offboarding proof
- Quarterly access reviews with reviewer assignment, reminders and a signed completion record
- Vendor register with risk tiering, subprocessor tracking and renewal dates
- Policy management: versioned documents, acknowledgement campaigns and per-employee proof
- Drift alerting when a passing control starts failing, routed to your on-call or ticketing system
- Auditor workspace: scoped read-only access to a sample set, with every export logged
- Evidence export as a dated, hashed bundle your auditor can take away
Data model
Stack
- frontend
- Next.js 15 App Router + Tailwind + TanStack Query
- backend
- NestJS on Node 22 REST, plus a Python collector runtime for cloud SDK breadth
- database
- PostgreSQL 16 with Row Level Security and an append-only evidence table
- cache
- Redis 7 for collector scheduling locks and dashboard aggregates
- queue
- BullMQ for collector fan-out, review reminders and bundle generation
- auth
- OIDC against the customer IdP; auditor access via time-boxed scoped invitations
- search
- PostgreSQL tsvector across evidence metadata, policies and control text
- ai
- Optional: draft control narratives and summarise test failures through a pluggable LLM gateway. Evidence itself is never sent to a model without an explicit per-source opt-in.
Parity, honestly
What we match, and what we do not.
The rows marked No are the important ones. If one of them is the reason you bought Vanta, keep buying it — and we will tell you that on the first call rather than the fifth month.
| Capability | Vanta | Ours | Note |
|---|---|---|---|
| Automated cloud configuration tests | Yes | Yes | Tests are code in your repo, so you can fix a mismatched test instead of filing an exception. |
| SOC 2 and ISO 27001 control mapping | Yes | Yes | One evidence item maps to controls in both frameworks without paying twice. |
| Personnel onboarding / offboarding evidence | Yes | Yes | — |
| Access review campaigns | Yes | Yes | — |
| Policy acknowledgement tracking | Yes | Yes | — |
| Vendor and subprocessor register | Yes | Yes | — |
| Immutable evidence store with hashes | Yes | Yes | Object lock in S3 or immutable blob policy in Azure, held in your own account. |
| Auditor read-only access | Yes | Yes | — |
| The audit itself | No | No | Neither Attest nor Vanta issues an opinion. You still engage a CPA firm. Attest is the evidence pipeline, not the attestation. |
| Bundled auditor relationships and negotiated audit pricing | Yes | No | This is a real gap. Vanta and Drata sell a marketplace of pre-integrated audit firms with pre-agreed scoping and rates, and for a first-time audit that is worth genuine money. Attest gives your auditor a clean evidence bundle; it does not find you the auditor. |
| Pre-built library covering 30+ frameworks out of the box | Yes | No | We build the two or three frameworks you are actually audited against. HIPAA, PCI DSS, FedRAMP, TISAX and the rest are each a scoping conversation, not a checkbox. If you genuinely need a dozen frameworks, the vendors' breadth is a legitimate reason to keep paying. |
| Vendor maintains mappings across framework revisions | Yes | No | When ISO 27001 next revises Annex A, remapping is yours. Historically that is a few days of work once every several years, and we hand over the mapping as data rather than as vendor configuration. |
| 150+ pre-built SaaS integrations for evidence collection | Yes | Partial | We build the eight to fifteen systems in your actual audit scope. Beyond that the collector SDK is documented and each new source is one to three engineer-days. |
| Vendor-run trust centre page for prospects | Yes | Yes | Attest publishes a static trust page from the same evidence store, behind your own domain. |
Reference architecture
Built twice, on purpose.
Every application in Techtons ships with a production architecture for AWS and one for Azure, using the same diagram grammar so you can read them side by side. Your cloud, your account, your bill.
Amazon Web Services
- Compute
- ECS Fargate (api, collector, worker) behind an ALB; collectors run as scheduled tasks
- Data
- Aurora Serverless v2 PostgreSQL
- Storage and edge
- S3 with Object Lock in compliance mode for the evidence bucket, versioned, KMS-encrypted
- Identity
- Cognito federated to the customer IdP; collectors assume read-only cross-account roles
- Observability
- OpenTelemetry to CloudWatch; collector failures raised as EventBridge events
- Infrastructure as code
- Terraform, including the cross-account read-only role as a distributable stack
Services
The decision worth arguing about
The non-obvious decision is not sourcing configuration evidence from AWS Config, which is the documented AWS answer and the one every architecture review suggests. Config bills $0.003 per configuration item recorded and $0.001 per rule evaluation. In a three-account estate of roughly 6,000 resources with normal deploy churn, the recorder alone captures several hundred thousand configuration items a month, and turning the recorder on across all resource types has surprised more than one finance team with a four-figure line. Attest instead polls each account's describe APIs on an hourly schedule from a Fargate task assuming a read-only cross-account role, and computes its own diffs into Postgres. The trade is real and we state it plainly: we get hourly resolution rather than Config's near-continuous change stream, so a resource that is misconfigured and corrected inside the same hour can go unrecorded. For SOC 2 evidence, where the auditor samples periodic states rather than a continuous stream, that is an acceptable trade — and where a specific control genuinely needs change-level fidelity, we turn Config on for that one resource type rather than the whole estate. Evidence goes to an S3 bucket with Object Lock in compliance mode, which means not even the account root can delete an artefact before its retention expires. That is the property an auditor cares about, and it is stronger than what a SaaS platform can offer you, because you can prove the bucket policy.
Microsoft Azure
- Compute
- Azure Container Apps (api, worker) plus Container Apps Jobs for scheduled collectors
- Data
- Azure Database for PostgreSQL Flexible Server
- Storage and edge
- Blob Storage with an immutable time-based retention policy, locked, customer-managed keys
- Identity
- Microsoft Entra ID; collectors use managed identities with Reader and Security Reader roles
- Observability
- Azure Monitor and Application Insights; collector failures to Event Grid
- Infrastructure as code
- Bicep, with the subscription-scope role assignments as a separate deployment
Services
The decision worth arguing about
Azure differs from AWS in where the configuration truth lives, and the decision is which of two overlapping services to read. Azure Policy already evaluates compliance state across every subscription and costs nothing to query — its results are available through Resource Graph in a single KQL query across the whole tenant, which is genuinely better than anything AWS offers for free. Defender for Cloud layers a regulatory-compliance dashboard on top with SOC 2 and ISO 27001 initiatives already mapped, which is tempting, but Defender CSPM is billed per billable resource per month and turning it on across a mid-size estate is a recurring four-figure decision that mostly buys a dashboard we are rebuilding anyway. So Attest reads Azure Policy compliance state through Resource Graph and pays nothing for it. The honest cost of that choice: Policy tells you about configuration, not about vulnerabilities or attack paths, so the ISO 27001 controls covering technical vulnerability management (A.8.8) need a separate source — usually the customer's existing scanner — and we wire that in as its own collector rather than pretending Policy covers it. The other Azure-specific note is that immutable blob retention must be locked to be audit-credible; a policy that has not been locked can still be shortened, and an auditor who knows that will ask.
Sources
Every price on this page, with the page we read it from and the date we read it.
| Product | Plan | List price | Checked | Source |
|---|---|---|---|---|
| Vanta | Essentials / Plus / Professional / Enterprise | Not published | 2026-09-05 | www.vanta.com/pricing Vanta names four tiers on its pricing page but publishes no price against any of them. The page's only pricing instruction is "Request a free demo today to discuss your business needs and get personalized pricing". We will not print a number the vendor does not. |
| Drata | — | Not published | 2026-09-05 | drata.com/pricing Drata's pricing page carries no plan names and no prices — only "Get a Demo". Pricing is quoted per company after a sales conversation. |
Should you still be paying for Vanta?
Two weeks, fixed price. We audit what you actually use, map it against Attest, cost the replacement on your own AWS or Azure account, and give you a delivery plan. If the honest answer is to keep the licence, that is what the report will say.