Vantage

Why this exists

Compliance software is usually sold before it is shown. You get a demo booking form, a sales call, and a sandbox three weeks later. Vantage is the opposite: the entire product is sitting at vantage.insta.host with the password printed on the sign-in page, and the source is on GitHub under an MIT licence.

It is an independent reimplementation of the trust-management category — the same job a tool like Vanta does — built to be read, run and taken apart. If it is useful to you as a working system, host it yourself. If it is useful as a way of understanding what these platforms actually do underneath, that is just as good a reason to open it.

It tests, rather than asks

The difference between a compliance platform and a spreadsheet is whether anything is actually checked. Vantage carries 49 automated tests that evaluate real resource data — cloud storage encryption, IAM multi-factor, endpoint disk encryption, security training, vendor reviews — on an hourly loop and on demand.

Each test is a rule, not code: a JSON description of which population it applies to and what each member must satisfy. Adding a test is a row of data. When a test fails it opens a remediation task with a deadline set by severity — three days for critical, thirty for low — and the failure propagates up through the control, the requirement and the framework readiness figure.

Seven frameworks, one control set

159 requirements across SOC 2 Type II, ISO/IEC 27001:2022, the HIPAA Security Rule, GDPR, PCI DSS v4.0, NIST CSF 2.0 and ISO/IEC 42001 map onto a single set of 62 controls. Evidence gathered once counts everywhere it applies, which is the entire economic argument for this category of tool.

Readiness is control-weighted rather than a count of ticks: the share of a framework's mapped controls that are not failing. Fix one of two failing tests on a control and the passing count moves but readiness does not — because the control is still failing. That is not a rounding quirk, it is how an auditor reads it.

Ten minutes, in this order

1. Sign in. The details are already filled in. Note the readiness ring on the dashboard.
2. Open Monitoring → Failing and pick Endpoints have disk encryption enabled. It names the exact machine that failed and why.
3. Press Fix. The test re-runs, the control clears, and framework readiness moves while you watch.
4. Open Questionnaires and press Auto-answer on the security review. Answers are drafted from your live controls and approved policies, each scored for confidence, with anything below 70% flagged for a human instead of asserted.
5. Visit the Trust Center at /trust in a private window — the public face, generated from the same live monitoring.
6. Settings → Reset demo data puts everything back for the next person.

What the demo is, plainly

It is one shared workspace of entirely fictional data. Everybody signs in with the same published account, so anything you change is visible to every other visitor until the daily reset. There is no company called Northwind, no real personnel, and no customer data in it.

It does not save credentials

The sign-in fields arrive filled in, so there is no reason to type anything. The page asks your browser not to save or autofill credentials against it, your session lives only as long as the tab is open, and nothing you type is written to the database or the logs. The abuse counters that stop brute-forcing keep a keyed digest rather than the address you entered.

It resets daily

Once a day the whole workspace returns to its seeded starting state, so nobody inherits yesterday's mess. The schedule is measured from the last reset that actually happened and remembered across restarts, so a redeployment cannot quietly postpone it.

Please do not put anything real into it

Treat everything you type as public and disposable. If you want a private instance, that is what the source is for.

Run your own

The server has no runtime dependencies. It runs on Node 24 using only built-in modules, including the built-in SQLite driver, so there is nothing to install on the server side and no database to provision.

A self-hosted instance is private by default: no shared-demo banner and no scheduled data reset. Change the seeded passwords in server/seed.js before putting one on a network, and put your own identity gate in front of it if the data stops being fictional.

MIT licensed. An independent educational reimplementation of the product category — framework requirement titles are paraphrased summaries of publicly published standard structures, and no proprietary content or branding is reproduced.