Can you take your audit evidence with you?
Test the export before you sign or cancel. A downloaded audit package may contain only the evidence for that audit period, while other records need separate export paths. Check the files, their dates, control relationships and exceptions in a format your team can still use after access ends.
Drata provides a concrete reason to test completeness
Drata’s export guide says there is no single bulk evidence export without API access. It documents individual and control-related downloads as well as an Audit Hub package scoped to a period. That package is not a full export of every evidence type.
The practical question is therefore “which records does this method include?” rather than simply “does export exist?” API-based coverage also needs to be checked; the documentation does not establish that an API route preserves every relationship you will want.
Build an export inventory
Use this as a proposed migration checklist. Agree required retention and audit handling with your own responsible team; there is no universal retention duration established by this article.
On a small screen, scroll the table sideways to see every column.
| Keep track of | Why it matters | Practical acceptance check |
|---|---|---|
| Evidence files | Documents, screenshots and generated artifacts | Open a sample outside the platform |
| Record context | Source, dates, scope and owner | Match an exported file to its original record |
| Relationships | Controls, frameworks and audit requests | Reconstruct one chain without the old interface |
| Exceptions | Issue history, decisions and resolution | Follow a known exception end to end |
| Program records | Policies, risks, people and vendors as needed | Check each relevant export separately |
An API is a route to investigate, not a migration promise
Vanta describes API-based external reporting and private integrations. That establishes a programmatic route to some data; it does not establish a complete, ready-made migration archive. Ask for the endpoints, permissions, package access and unsupported fields for your exact export inventory.
Source: Vanta API: private integrations and external reporting
Run a small rehearsal while the subscription is active
Choose one completed audit request, one historical policy version and one exception. Export them using the proposed procedure, then have a colleague who did not build the archive locate each record from a short index.
If the colleague cannot identify the relevant period or control without logging back into the old platform, the archive needs more context. Repeat with the auditor’s requested sample before relying on the process for a full migration.
Our selection rule: if portability matters, make a usable sample archive and written exit terms part of the evaluation. An unresolved export gap can outweigh a discount when the missing history is important to your next audit.
- Ask about export access after termination and any applicable charges.
- Confirm ownership of custom scripts and exported files.
- Arrange secure storage and access controls for the archive.
- Keep the old records until your responsible team approves the transition.