{"id":"FR2629068833","name":"Immuta Federal","provider":"Immuta","providerSlug":"immuta","status":"Initial Implementation","impact":"Not yet listed","authType":"Program","serviceModel":["SaaS"],"deployment":"Government Community Cloud","businessFunctions":["Data Management","Governance, Risk, and Compliance (GRC)"],"assessor":"Fortreum","assessorId":"201664","smallBusiness":false,"website":"https://www.immuta.com","description":"Immuta's SaaS platform, the Immuta Data Security Platform, provides a number of capabilities that enable customers to govern and provision data access, automating how data is delivered to both human and non-human consumers while maintaining continuous compliance. These capabilities are managed through Immuta’s web-based interface and Application Programming Interface (API). Authentication to Immuta’s service is controlled via a variety of Single Sign-on (SSO) and directory systems maintained by the customer or a third party. Management of each customer’s Immuta environment is split into a number of roles so that customers desiring a separation of duties for governance purposes can limit users to specific roles to achieve that goal. User attributes can be defined within the platform’s identity manager or synced from an external identity management system. This functionality is central to implementing attribute-based access and control (ABAC) of data, which is a key capability of the platform. Users allowed to act under the application admin role may register metadata from their cloud data warehouse systems, such as Snowflake, Databricks, Starburst, Redshift, Synapse, and BigQuery, etc., with Immuta. Selected tables from these warehouses then appear as entries in Immuta’s metadata catalog interface, where users can add documentation, discuss the data, and tag tables and columns. Tables, called Data Sources in Immuta, can further be grouped into Immuta Projects, which are a logical collection of Data Sources, users, documentation, and clearly defined purposes. Immuta Projects ensure that customers can use data in accordance with laws and regulations that require traceability to the legitimate reasons that sensitive data is used in the various distinct contexts that permeate each organization. Registered metadata is also analyzed by the platform’s Sensitive Data Discovery functionality, which can determine if data in a column is in one of a number of categories, such as personally identifiable information (PII) or “PII First Name,” that are commonly used to drive data access policies. Analysis of this data occurs completely in the customer’s data platform; no data ever leaves back to Immuta. This information is used to tag data within Immuta. Additionally, for customers who have successfully cataloged data in other systems, this kind of information can be synced to Immuta from a variety of common external catalogs. As users, data, and their attributes are registered with Immuta, users are allowed to act under the Data Owner and Governance roles, and can use Immuta’s natural language policy builder to apply access control policies to the data at the data set and row levels, and minimize access to data through Privacy Enhancing Technologies (PETs). Each Data Owner can manage such policies for the data they own. Users in the Governance role can manage policies at a global level. This global policy capability allows governors to review policies for compliance and set up policies that automatically impact new data and new users as they are added to the system. Based on these policies, Immuta connects to the customer cloud data warehouse and administers those policies into the data platform in question, keeping Immuta out of the data path but still enforcing policy. Users query data in the systems they are already using, but Immuta enforces their access based on the defined policies. Immuta also extends this policy-driven model to AI agents acting on behalf of users. When an agent requests data, Immuta evaluates the request in real time and provisions a temporary, scoped role in the underlying data platform – reflecting only the permissions relevant to that specific task. This access is automatically removed once the task is complete, so no standing privilege persists. Because the agent acts on behalf of a human user rather than as that user, Immuta maintains a dual-identity audit trail showing both the human who delegated the request and the agent that acted. Finally, Immuta provides robust auditing of actions taken within the platform to allow customers to document their data controls and have evidence for compliance purposes. For certain cloud warehouses, such as Databricks or Starburst, this examination extends to queries users perform in the source data systems. For others, Immuta logs and warehouse logs can easily produce an organization’s complete compliance picture when combined in their existing log aggregation and analysis system. This audit trail extends to agent activity, distinguishing human actions, agent actions, and agent-on-behalf-of-user actions.","logo":"https://immuta-public-info-648834167897.s3.us-gov-west-1.amazonaws.com/immuta_logo.png","inMarketplace":false,"agencies":[],"reuseCount":0,"leverages":[],"leveragedBy":[],"cr26":{"type":"20x","trustCenterUrl":"https://vault.immutacloud.us","trustCenterAuth":false,"secureConfigUrl":"https://documentation.immuta.com/saas/configuration","nextOcr":"2026-12-16","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"},{"level":"warning","message":"no documentation overview (repositories) listed","rule":"CDS-CSO-PUB"}],"assessor":"Fortreum"},"timeline":[{"date":"2026-07-22","to":"Initial Implementation","certType":"20x"}],"trustCenterCheck":{"url":"https://vault.immutacloud.us","ok":false,"kind":"blocked","reason":"Refused automated requests (HTTP 403, Cloudflare)","status":403,"ms":1057,"finalUrl":"https://vault.immutacloud.us/","checkedAt":"2026-11-02T18:00:41.342Z"}}