Scan your cloud, export the findings, then hand-assemble screenshots, CSV exports, and IAM JSON and upload them into Vanta, Drata, or Secureframe — repeated every audit cycle.
Run one compliance scan and push mapped, redaction-gated evidence straight into your GRC workspace at scan time — opt-in, and Zero-Data-Exfiltration by default.
The Vanta, Drata, and Secureframe connectors are shipped, opt-in, and covered by an extensive test suite. Live validation against production Vanta, Drata, and Secureframe tenants is in progress as partner onboarding proceeds — until it completes, treat production use as early-access and validate against your own tenant first. This is a single-workspace, operator-configured connector: it pushes to the one workspace whose token you provide. It is not a managed sync across many tenants, and there is no partner-hosted pipeline behind it. Secureframe's API shape is published-assumed pending live-tenant validation. We'd rather tell you exactly where the connector is than oversell it.
01What the connector does
NSAuditor has always written a GRC-ready JSON evidence artifact you could import by hand. The GRC connectors close the last gap: when you enable one, a single compliance scan maps each finding to the provider's evidence/test model and pushes it as the scan runs. Under the hood the push loop is built for the failure modes that matter when you write to someone else's API:
- Suppression-aware outcome mapping — each control is pushed as pass, fail, or passed-with-compensating-control, honoring your suppression decisions rather than blindly reporting raw findings.
- Framework-dimensioned idempotency keys — a deterministic key per control-and-framework means a network-timed-out retry updates the existing record instead of creating a duplicate.
- Rate-limit backoff + circuit breaker — the loop backs off on HTTP 429 and trips a consecutive-failure circuit breaker so a degraded provider API never stalls or corrupts your scan.
- Durable per-control audit artifact — every push writes a
scan_grc_push_<provider>.jsonrecord next to your scan output, so you always have local proof of exactly what was sent and how the provider responded. - Loud, never-silent outcomes — a skipped or no-op push is surfaced visibly in the scan summary; the connector never fails quietly.
The push is the only outbound call, it happens only when you opt in, and its egress is redaction-gated. Your API token is read from the environment, redacted from every log and error path, and never serialized to any artifact. The audit record captures a non-reversible fingerprint of the pushed body — counts and signals, never secret values and never the token.
What changed in EE 0.32.9 for pushed outcomes
EE 0.33.0 changes nothing in the push path itself — its work was in wiring eleven compliance options that nothing shipped could populate (the new entry points live in Community Edition, so EE 0.33.0 requires CE ≥ 0.2.37), in restating Zero Data Exfiltration as a positive register of 17 enumerated outbound paths, and in freezing algorithm and backend into each signature record at signing time. All seven coverage matrices are UNCHANGED and the plugin count is UNCHANGED at 28, so no pushed outcome moves with it. A GRC push is one of the 17 enumerated outbound paths, and it stays opt-in. Two things from the 2026-07-29 release do change what your GRC workspace receives, and both still apply before your next push:
- A cloud that could not be scanned no longer pushes as clean. When a cloud plugin could not start — its optional SDK is absent, or the credentials are unusable — the scan used to produce a report identical to one where the scanner ran and found nothing, so every in-scope control pushed as a pass. Now every in-scope control of a cloud that could not be scanned carries a fail-closed evidence gap, and that is what the connector pushes. Expect gaps where you previously saw passes: that is the corrected reading, not a regression.
- The evidence-gap finding title changed, so old suppression rules stop matching. If you suppress on the previous title text, those rules go inert and the findings resurface. That is the safe direction — nothing hides — but it is silent, so re-check any suppression rule keyed to the old wording.
02Quick start
Set two environment variables and run a compliance scan as usual. With nothing set, scans behave exactly as before and only write the local evidence JSON.
The GRC connectors are an Enterprise capability and require the @nsasoft/nsauditor-ai-ee package.
03Configuration reference
| Environment variable | Required | Purpose |
|---|---|---|
COMPLIANCE_GRC_PROVIDER | Yes (to enable) | Selects the connector: vanta, drata, or secureframe. Unset means the push is disabled and only the local evidence JSON is written. |
COMPLIANCE_GRC_TOKEN | Yes | The provider API token / key for the target workspace. Read at scan time, redacted from all output, never serialized. |
COMPLIANCE_GRC_BASE_URL | Optional | Override the provider API base URL — for a regional endpoint or a proxy that keeps egress on your own perimeter. |
COMPLIANCE_GRC_CONTROL_MAP | Vanta: optional Drata: required | Vanta — optional mapping that aligns NSAuditor controls to your workspace's test/control IDs when they differ from the defaults. Drata — points at the Custom Connection config (connectionId, resourceId, schemaMap); the shipped defaults are empty, so Drata pushes require it and fail-fast without it. |
COMPLIANCE_GRC_REDACTION | Optional | Egress redaction policy applied to the pushed body before it leaves your infrastructure. One of off, hash, or remove. |
04Vanta — scan-time push, activated
NSAuditor has shipped a Vanta connector library since v0.11.0 — but it was dormant: nothing read the configuration and nothing pushed at scan time. EE 0.32.0 wired it in; see the current release notes. With COMPLIANCE_GRC_PROVIDER=vanta set, each compliance scan maps its findings to Vanta test results and pushes them, carrying the full reliability discipline above: suppression-aware outcomes, framework-dimensioned idempotency, rate-limit backoff, the consecutive-failure circuit breaker, and the token-redacted per-control audit log. This activation went through four rounds of adversarial external review across idempotency, timeout/abort, evidence-integrity, and fail-closed configuration before it shipped.
One honest note on scope: the shipped connector targets Vanta's evidence/test model, and the production Vanta API integration (OAuth authorization and the live resource-push endpoint) is being finalized with the partner. Until that lands and live-tenant validation completes, treat Vanta push as early-access and validate against your own tenant first.
05Drata — a new connector (Custom Connections)
New in the GRC connector trio: a Drata connector built on Drata's Custom Connections model. It pushes structured records to your Custom Connection resource; your own Drata Test Builder rules (Advanced/Enterprise plans) then evaluate them. The division of labor is deliberate — the connector delivers the evidence, your rules do the evaluation. It's self-contained and rides the same hardened push loop as the Vanta path, so it carries the same reliability and audit-integrity guarantees without touching the reviewed Vanta code.
Secureframe completes the trio on the same records model (early-access): NSAuditor pushes structured control records to your Secureframe evidence collection and your Secureframe rules evaluate them — the connector carries each control's status verbatim and does not compute pass/fail. Enable it with COMPLIANCE_GRC_PROVIDER=secureframe. Its API shape is published-assumed and live-tenant validation is deferred pending partner intake.
06Platform status
| Platform | Status | Model | Notes |
|---|---|---|---|
| Vanta | Shipped · scan-time push activated | Test results | Findings map to Vanta test results with suppression-aware outcomes. Live-tenant validation in progress. |
| Drata | Shipped · connector | Custom Connections | Pushes structured records; your Test Builder rules evaluate (Advanced/Enterprise plans). Live-tenant validation in progress. |
| Secureframe | Shipped · early-access | Records / evidence collection | Pushes structured control records; your Secureframe rules evaluate. API shape published-assumed; live-tenant validation deferred (partner intake). |
07What "shipped" means
The Vanta, Drata, and Secureframe connectors are shipped, opt-in, and tested. Live validation against production Vanta, Drata, and Secureframe tenants is in progress as partner onboarding proceeds. This is a single-workspace, operator-configured connector — you point it at one workspace with one token, and it pushes there. Until live-tenant validation completes, treat production use as early-access and validate against your own tenant first. If that's the honest state of an integration, that's what we'll tell you.