Where these pricing figures come from
Every dollar figure GRC Migrate publishes traces to a named source, a claim class, and a date. This page lists them. It documents the curated dataset behind the pricing guides and the audit-cost module - figures the operator verified by hand, each with its own citation. It is a different dataset from the Pricing Observatory, which is crowdsourced from anonymized buyer contributions and k-anonymized before publishing; nothing on this page is a contribution and nothing here implies that mechanism.
Claim classes: Class 1 - primary source (the vendor’s own published terms) · Class 2 - procurement/transaction data (Vendr-derived, always attributed) · Class 3 - buyer/industry-reported pattern (never stated as vendor policy)
Vanta
| Figure | Range / value | Source | Class | As of |
|---|---|---|---|---|
| entry annual price | $10,000–$12,000/yr | vendr.com Vendr buyer guide + aggregators citing it; verified in the July 2026 appendix audit | 2 | 2026-07 |
| entry annual price low reports | $7,500/yr | vendr.com low-end buyer reports cited alongside Vendr ranges | 3 | 2026-07 |
| median annual spend | $20,000/yr | vendr.com Vendr transaction median across 320 purchases | 2 | 2026-07 |
| midmarket annual price | $30,000–$70,000/yr | vendr.com Vendr transaction data | 2 | 2026-07 |
| large org annual price | $60,000–$120,000/yr | vendr.com Vendr transaction data | 2 | 2026-07 |
| addon vendor risk management | $11,200/yr | vendr.com procurement reports | 2 | 2026-07 |
| addon trust center | $6,000/yr | vendr.com procurement reports | 2 | 2026-07 |
| addon additional framework | $5,000/yr | vendr.com procurement reports | 2 | 2026-07 |
| renewal year2 increase | 20–50% | vendr.com publicly reported customer reports; decomposition (escalator + discount roll-off + scope) verified July 5, 2026 | 3 | 2026-07 |
| auto renewal notice days | 30 days written notice | vanta.com Vanta Master Subscription Agreement — auto-renewal for successive one-year periods; 30-day written notice. Verified July 5, 2026 | 1 | 2026-07 |
| renewal uplift standard contract terms | up to 10% | vendr.com Vendr buyer transaction reports — standard contract language commonly includes up-to-10% terms. Verified July 5, 2026 | 2 | 2026-07 |
| renewal uplift negotiated | 3–7% | vendr.com Vendr buyer transaction reports — negotiated to 3–7%, 5% a common landing point. Verified July 5, 2026 | 2 | 2026-07 |
| renewal quote increase absent renegotiation | 10–20% | vendr.com Vendr — renewal quotes commonly 10–20% higher absent proactive renegotiation. Verified July 5, 2026 | 2 | 2026-07 |
Drata
| Figure | Range / value | Source | Class | As of |
|---|---|---|---|---|
| foundation tier annual price | $7,500–$15,000/yr | vendr.com publicly reported tier ranges; Vendr + aggregators | 2 | 2026-07 |
| advanced tier annual price | $15,000–$25,000/yr | vendr.com publicly reported tier ranges | 2 | 2026-07 |
| enterprise tier annual price | $25,000–$100,000/yr | vendr.com publicly reported tier ranges | 2 | 2026-07 |
| median annual spend | $25,000/yr | vendr.com Vendr transaction data; average contract ~$34,000 | 2 | 2026-07 |
| typical buyer range | $10,000–$45,000/yr | vendr.com Vendr reported deals $10,250–42,750 | 2 | 2026-07 |
| addon additional framework | $1,500–$7,500/yr | vendr.com publicly reported | 2 | 2026-07 |
| implementation onboarding | $5,000–$25,000 one-time | vendr.com publicly reported; billed separately, often not disclosed upfront | 3 | 2026-07 |
| renewal baseline escalator | 5–20% | vendr.com publicly reported customer reports | 3 | 2026-07 |
| renewal year2 jump scope expansion | 30–50% | vendr.com publicly reported customer reports | 3 | 2026-07 |
Figures we don’t publish - and why
Publishing a figure means we can trace it to a source with no stake in the number. Where we can’t, we don’t publish it - the honest version of a pricing page names the gap instead of filling it.
- External SOC 2 audit costs - a Type 1 figure and per-firm-tier Type 2 ranges.The figures we had traced to a single archived capture of one directory’s homepage - a site that sells sponsored placement to the very firms it lists - so it is not a neutral pricing authority, and the bands were internally incoherent (a “Big Four” top end below the mid-tier top end). We retired them rather than cite numbers we can’t source cleanly. What we dosay stands without a table: the audit is a separate engagement with a licensed CPA firm you choose, priced independently of any platform, and firm tier drives its cost more than your company size does. We’ll publish audit-cost figures when we can source them to a party with no stake in them - a firm’s own published fee schedule, or the crowdsourcedPricing Observatory once it has enough contributions to publish.