Overview
Vanta is a compliance automation platform that helps companies achieve and maintain SOC 2, ISO 27001, HIPAA, and other security certifications. The Shortcut integration allows compliance tasks and control remediations to be tracked as Stories, integrating security compliance into your development workflow.
Key Features
- Compliance Task Sync: Vanta tasks appear as Shortcut Stories
- Control Tracking: Monitor security control implementation status
- Evidence Collection: Link Story completions as compliance evidence
- Audit Preparation: Track audit-related work items in your normal workflow
Setting Up the Integration
- In Vanta, go to Integrations > Task Management
- Select Shortcut from the available integrations
- Click Connect and authorize access to your Shortcut workspace
- Choose default settings for Story creation:
- Default Team
- Workflow
- Labels
Admin access in both Vanta and Shortcut is required to set up this integration.
Using the Integration
Task Synchronization
When Vanta identifies a compliance task or control that needs attention:
- A Story is created in Shortcut with task details
- The Story includes the compliance framework and control reference
- Completing the Story in Shortcut updates the task status in Vanta
Evidence Linking
Completed Stories can serve as evidence for compliance audits:
- Story history shows when work was completed
- Linked commits and PRs demonstrate implementation
- Comments provide context for auditors
Audit Workflows
During audit preparation, create an Epic for audit-related tasks and link all Vanta-generated Stories to maintain organization.
Best Practices
- Create a “Compliance” label for easy filtering
- Set up a dedicated Workflow state for “Pending Evidence Review”
- Use Story templates for common compliance tasks
- Link related Stories to show how controls are implemented