Skip to content
XFA
Sign inStart for free
XFA integrates with VantaListed in Vanta’s integrations

Device checks at sign-in, sent to Vanta.

Keep Vanta. XFA checks each device when someone signs in and sends the results to Vanta about twice an hour.

Start for freeCompare plans
A desk with an audit checklist beside a laptop

What Vanta does

Vanta runs your compliance program. It holds your frameworks, controls, and policies, and the evidence your auditor reviews. That stays as it is.

Adds to Vanta

What XFA adds

  • Checks each device at every sign-in
  • Covers contractors and personal laptops too
  • People fix problems themselves in the XFA app
  • Can block sign-in until a problem is fixed

How XFA works with Vanta

  1. 1. Connect XFA to Vanta

    Connect your identity provider to XFA. Then connect your Vanta account and confirm the connection in Vanta.

  2. 2. People check their device at sign-in

    On their first sign-in, XFA walks each person through installing the XFA app. When a check fails, they fix it from the app.

  3. 3. Results arrive in Vanta

    XFA sends each device’s results to Vanta about twice an hour. Your audit stays in Vanta.

Already using the Vanta Device Monitor?

XFA checks the same four settings each time someone signs in. If one is off, the person sees what to fix and fixes it in the XFA app.

Vanta’s help centre, 5 October 2026: Device Monitoring (opens in a new tab), Computers page (opens in a new tab)

The four settings both check

  • Antivirus
  • Disk encryption
  • Screen lock
  • Password manager
Alex Ulyanov, Head of Security, Gateway.fm

Gateway.fm prepared for SOC 2 and ISO 27001 with contractors on their own laptops. XFA sends its device results to Vanta.

"I first installed it on my device to see how it works. When I verified that actually it is what it claims (that there is no privacy invasion) it was easier to be an ambassador and explain it to everyone in the team."
Alex UlyanovHead of Security, Gateway.fmRead the Gateway.fm story

Questions about XFA and Vanta

People working on laptops along a long shared table
Do I need a paid plan to send results to Vanta?

Yes. Sending results to Vanta is part of every paid plan. XFA is free to start, with no cap on people, four checks at every sign-in, and the Fix button.

See pricing
Do XFA’s results count for Vanta’s device tests?

Yes. Vanta has four device tests: antivirus installed, hard drive encryption, a screen lock after at most 60 minutes idle, and a password manager. XFA checks all four settings and sends the results to Vanta.

Which checks does XFA run?

XFA starts with four: the operating system version, disk encryption, screen lock, and antimalware. You can add more as you grow, such as automatic updates, browser version, password manager, firewall, and recent reboot, up to 34 checks in all.

Does XFA block a device that fails a check?

Only if you set it to. You decide per check whether a device that fails gets a warning or is blocked, and after how many days. Either way, the person sees what to fix.

What does XFA see on a contractor’s own laptop?

Only the security settings it checks, such as the operating system version, disk encryption, and screen lock. XFA does not collect browsing history, personal files, or location data. The app installs without admin rights.

How XFA works
Can XFA help with SOC 2 or ISO 27001?

It covers the device part. XFA checks each device at sign-in, including contractors’ and personal laptops, and sends the results to Vanta. Gateway.fm used it this way to prepare for SOC 2 and ISO 27001. The rest of the audit sits with Vanta and your auditor.

Read the Gateway.fm story
Does XFA work with Drata too?

Yes. XFA also sends device results to Drata, Thoropass, and TrustCloud.

All integrations

Keep Vanta. Start checking devices.

Try it on your own laptop first, then bring in the team. Connect Vanta when you are ready.

Start for freeCompare plans
Two people working on laptops at a shared table