Hey everyone! I've been deep in our Vanta implementation for the past few months, and like many of you, I kept hitting a common snag: evidence collection deadlines sneaking up on control owners. 😅 Our compliance lead was spending *hours* each week sending manual reminders.
So, I built a little internal Slack bot to automate the nudge. It's been live for a few weeks now and has cut our follow-up time dramatically.
Here's the basic flow:
* It pulls a daily report from Vanta (via their API) on items with evidence due in the next 3 or 7 days.
* It cross-references the control owner with our company directory.
* Then, it sends a direct Slack message to that person with a clear, friendly reminder. The message includes the control name, the due date, and a direct link back to the specific task in Vanta.
The key was making it helpful, not spammy. We set it to only message someone once per task, and the tone is collaborative ("A quick reminder from the compliance team...").
The impact has been pretty great:
* Evidence submissions are now almost always on time.
* Control owners appreciate the clear, direct link—less hunting around.
* Our compliance team can focus on actual reviews instead of chase-downs.
I'm curious—has anyone else built similar workflow bridges around Vanta? I'd love to compare notes on other pain points we might automate away. I'm thinking about tackling the "new employee onboarding to control assignments" link next.
happy evaluating!
This is such a classic and useful automation. I've done similar things for cost anomaly alerts and security finding tickets. The "once per task" rule is crucial for adoption, nobody wants a daily nag.
Did you run into any issues mapping Vanta's control owners to Slack handles? We found that was the trickiest part, maintaining a clean sync between our HRIS, email, and Slack. Ended up using a small Lambda to keep a DynamoDB table updated.
Also, curious if you're running this on a schedule in a Fargate task or as a Lambda? I'm always interested in the ops overhead of these helper bots.
terraform and chill
Mapping the identities was absolutely the hardest part, and it's a hidden cost that gets underestimated in these projects. We took a different route than your Lambda-Dynamo approach because we already have a centralized employee directory service exposed via a GraphQL API. The bot queries that, using the email from Vanta as the key, and caches the Slack ID in memory for 24 hours. It's simpler, but it creates a hard dependency on that internal service's uptime.
On the infrastructure, we run it as a scheduled Lambda. The execution time is under a minute daily, so Fargate would be overkill and introduce more moving parts. The ops overhead is essentially zero, which is the whole point. You're right to focus on that, the minute these helpers become a ticket in the on-call queue, they've failed.
Your point about the "once per task" rule is key, but I'd extend it: the notification should also be the *final* step. Our bot only messages the owner if the evidence is still marked "pending" in Vanta after the daily sync. If they've already uploaded it, the bot suppresses the message. This prevents the "I just did that, why are you nagging me?" reaction that kills goodwill.