Compliance Integrations (Drata, SecureFrame and Vanta)

Overview

The compliance integrations connect Fencer to GRC (Governance, Risk, and Compliance) platforms — Drata, SecureFrame, and Vanta. These integrations push your security findings from Fencer into your compliance workflows, so evidence stays current without manual exports.

By syncing vulnerability data automatically, you reduce the effort required to maintain compliance artifacts and ensure your compliance posture reflects your actual security state. Each Fencer organization can connect one account of each platform.

Prerequisites

• The Administrator role in your Fencer organization.
• An active Fencer subscription on a plan that includes GRC integrations. Without it, the cards on Admin > Integrations show Upgrade.
• For Drata: A Drata account with an API key and at least one workspace configured.
• For SecureFrame: A SecureFrame API key and secret, created by a user with access to tests, personnel, and third-party vendors.
• For Vanta: A Vanta account with sufficient permissions to authorize an OAuth application. For identity sync, you also need Manage Vanta API credentials (client ID and secret).

How it works

Drata uses an API key to authenticate. Once connected, Fencer generates a spreadsheet (XLSX) of your open, in-scope vulnerabilities and uploads it as evidence (“Fencer Scan Results”) to the controls you select. This evidence is refreshed nightly and whenever you save the configuration.

SecureFrame uses an API key and secret. Fencer uploads the same vulnerability spreadsheet as evidence to the compliance test you select, nightly and whenever you save the configuration.

Vanta uses an OAuth 2.0 flow to authenticate. After connecting, Fencer pushes structured vulnerability data directly to Vanta’s connector API — your in-scope code repositories and their open secrets, dependency vulnerabilities, and static analysis findings. Each data type maps to a specific Vanta resource, and Fencer keeps them in sync nightly.

All three integrations also support identity sync, importing users from Drata, SecureFrame, or Vanta into Fencer’s identity management system so you can track personnel across your security and compliance tools. While a connection exists, you can also import your vendor list from it under Admin > Vendor Catalog (see GRC Import and Vendor Tracking).

Usage / Configuration

Connecting Drata

1. Go to Admin > Integrations.
2. Under Available Integrations, click the Drata card, then click Continue.
3. In Drata, go to Settings > API Keys, click Create API Key, and make sure the key can read your workspaces, controls, and users.
4. Paste the key into API key and click Connect. Fencer validates the key by fetching your available workspaces and opens the connection’s edit page.
5. Select a Workspace, one or more Controls to attach evidence to, and an Evidence owner (a Drata user who will own the uploaded evidence). Keep Sync vulnerabilities on.
6. Click Save changes. Fencer immediately syncs your vulnerability data and then syncs it nightly.

Connecting SecureFrame

1. Go to Admin > Integrations.
2. Under Available Integrations, click the SecureFrame card, then click Continue.
3. In SecureFrame, open Profile → Company settings → API keys and create an API key. Copy both the API key and the secret — the secret is shown only once.
4. Paste them into API key and Secret key and click Connect. Fencer validates the credentials and opens the connection’s edit page.
5. Choose the Compliance test that should receive vulnerability scan evidence. Click Refresh tests if a test you just created in SecureFrame is missing. Keep Sync vulnerabilities on.
6. Click Save changes.

Connecting Vanta

1. Go to Admin > Integrations.
2. Under Available Integrations, click the Vanta card, then click Continue.
3. Click Connect Vanta. You are redirected to Vanta’s authorization page. Grant the requested permissions.
4. After authorization, you return to the connection’s edit page and Fencer begins syncing vulnerability data.

Configuring Vanta identity sync

To enable identity sync with Vanta, you need to provide Manage Vanta API credentials:

1. In Vanta, go to Settings > Developer Console, click Create, and create an application named Fencer (Manage Vanta) of type Manage Vanta. Grant Read and Write access to the API scopes, then copy the Client ID and generate a Client Secret.
2. On the Vanta connection’s edit page in Fencer, enter the Manage Vanta Client ID and Manage Vanta Client Secret. Fencer validates the credentials by querying the Vanta People API.
3. Click Save changes. Fencer imports your Vanta users into the identity management system.

The same form has the Sync Vulnerabilities toggle; saving it also requires the Manage credentials.

Note

Manage Vanta API credentials are separate from the OAuth connection and require additional setup in Vanta. Contact your Vanta administrator to obtain them.

Syncing on demand

On a Drata, SecureFrame, or Vanta edit page with Sync vulnerabilities turned on, click Resync under Manual Sync to send the latest findings immediately instead of waiting for the nightly sync.

Disconnecting

To disconnect any of these integrations, go to Admin > Integrations, find the integration, click Remove, and confirm with Remove. This soft-deletes the connection and removes the associated vendor record and the identities it synced. For Vanta, stored tokens are cleared. For SecureFrame, the API key and secret are cleared.

Examples

Scenario: Automatically uploading vulnerability evidence to Drata

1. You connect Drata and select the “SOC 2” workspace, the “Vulnerability Management” control, and your security lead as the evidence owner.
2. Fencer generates a spreadsheet listing all open, in-scope vulnerabilities in your organization.
3. The spreadsheet is uploaded to Drata as evidence attached to the selected control.
4. On the next nightly sync, Fencer regenerates the spreadsheet with the latest data and updates the existing evidence — keeping your compliance artifacts current without any manual work.

Scenario: Syncing code scan findings to Vanta

1. You connect Vanta via OAuth.
2. Fencer automatically pushes your open secrets, dependency vulnerabilities, code repositories, and static analysis findings to Vanta’s connector resources.
3. When a vulnerability is resolved in Fencer, the next sync removes it from Vanta’s data, keeping your compliance view accurate.

Troubleshooting

• “Unable to connect your Drata account. Please check your API key.” — The API key is invalid or has been revoked. Create a new key in Drata and enter it on the connection’s edit page.
• Drata evidence not updating — Ensure you have selected a workspace, at least one control, and an evidence owner, and that Sync vulnerabilities is on. All of these are required for the sync to run.
• “Unable to connect your SecureFrame account. Please check your API key and secret.” — Check that you copied both the API key and the secret, and that the creating user has the required access.
• “A SecureFrame connection already exists for this organization.” — Remove the existing SecureFrame connection before connecting a different account.
• SecureFrame evidence not updating — Select a Compliance test and make sure Sync vulnerabilities is on.
• Vanta connection shows as unhealthy — The OAuth tokens may have expired and could not be refreshed. Open the connection’s edit page and click Reconnect.
• Vanta identity sync not working — Identity sync requires Manage Vanta API credentials (client ID and secret) to be configured on the edit page. The standard OAuth connection alone does not provide access to the People API.

Caution

Disconnecting a compliance integration stops all data syncing. Evidence previously uploaded to Drata or SecureFrame remains there, and data previously pushed to Vanta remains in Vanta — but none of it will be updated further.

Related pages

• Integrations Overview
• Vulnerability Management
• Secrets Detection
• Identity Management
• GRC Import and Vendor Tracking