GovernAtlasSubmit your product ↗
Discover platforms/Immuta

GOVERNATLAS / PRODUCT DOSSIER

Immuta

Immuta describes authoring data policies and applying masking or access restrictions through supported data infrastructure.

Explore the product ↗Add to comparison ↗

01 / CONTEXT & SCOPE

Understand the proposition.
Define the boundary.

The decision to make

Evaluate where a policy is authored and where access is actually enforced. The central question is whether the intended restriction reaches every required access path in your supported data infrastructure, including a change to a user's role or a dataset's classification.

What this record does not establish

Vendor-described policies and restrictions do not establish coverage of every engine, interface or identity path. Do not infer enforcement from the policy configuration screen alone.

2 current sources · 4 published assertions
Source coverage is a research boundary, not a quality score.

02 / YOUR EVALUATION

Turn interest into a useful trial.

Open the evaluation playbook ↗
A

A test worth running

Create a synthetic sensitive field and two user roles. Apply the proposed policy, query the data through each required access path and inspect the observed masking or restriction. Change the role or policy, include a synchronization failure and preserve the outcomes.

GovernAtlas editorial proposal. We have not performed this test.

B

Evidence to bring back

  1. Demonstrate actual data access as ordinary users, with query and policy versions linked in the trial record.
  2. Explain how conflicting policies, identity changes and an unavailable integration affect the enforced result.

03 / DOCUMENTED EVIDENCE

Read the claim. Inspect the basis.

Each statement retains its classification and preserved source. A vendor assertion is not an independent test result.

01
vendor asserted

Immuta distinguishes its GDPR processor/subprocessor role for licensed SaaS use from controller processing for its own purposes. Its trust page includes recipient lists marked March 16, 2026. These documented roles and lists still need reconciliation with the customer's agreement and actual processing.

Source, dates & preserved provenanceImmuta — Product capabilities and published scope ↗

Authority: vendor owned
Observed 2026-11-03 · Reviewed 2026-11-03 · current until 2026-12-03

Artifact SHA-256: 97a8899daff7e97a24a9157997ec9f6435685cd062b1439cb48530c0cc894eca

The hash identifies the preserved capture. The live source may have changed.

02
vendor asserted

Immuta's trust page lists ISO 27001 and ISO 27701. GovernAtlas has not inspected the certificates, standard editions, issuing body, validity or detailed ISMS/PIMS scope; these public labels are not independent certificate validation.

Source, dates & preserved provenanceImmuta — Product capabilities and published scope ↗

Authority: vendor owned
Observed 2026-11-03 · Reviewed 2026-11-03 · current until 2026-12-03

Artifact SHA-256: 97a8899daff7e97a24a9157997ec9f6435685cd062b1439cb48530c0cc894eca

The hash identifies the preserved capture. The live source may have changed.

03
vendor asserted

Immuta's trust page lists SOC 2 Type 2 assurance. GovernAtlas has not reviewed the underlying report, audit period, opinion or exceptions; the public label alone does not establish the precise service boundary or customer configuration.

Source, dates & preserved provenanceImmuta — Product capabilities and published scope ↗

Authority: vendor owned
Observed 2026-11-03 · Reviewed 2026-11-03 · current until 2026-12-03

Artifact SHA-256: 97a8899daff7e97a24a9157997ec9f6435685cd062b1439cb48530c0cc894eca

The hash identifies the preserved capture. The live source may have changed.

04
vendor asserted

Immuta describes authoring data policies and applying masking or access restrictions through supported data infrastructure. Scope: vendor documentation only; edition and availability boundaries require confirmation.

Source, dates & preserved provenanceImmuta — official product or documentation page ↗

Authority: vendor owned
Observed 2026-10-14 · Reviewed 2026-10-15 · current until 2026-11-13

Artifact SHA-256: 98c3187d246fe81ec1086d011a758eda8063fa2b725a94705e6c461936095ba1

The hash identifies the preserved capture. The live source may have changed.

Source register

Brand asset provenance

Organization identity asset from its official website; inclusion does not imply endorsement.

Official website ↗ · Original asset ↗

04 / BEFORE YOU COMMIT

Better questions.
A clearer decision.

Resolve these with the provider and your own evaluation team.

01

Which enforcement points are native integrations and what happens when policy synchronization fails?

02

What deployment, retention and access-control evidence supports the intended use?

03

What underlying assurance documents are available, and which claims remain unverified?

Regulatory applicability requires a separate, current determination. Inclusion is not certification.

COMPLIANCE / CLAIMS, SCOPE & GAPS

Start with the requirement.
Inspect the support.

Prepare your vendor review ↗

These labels describe this dossier’s current evidence coverage. A published mention may be a framework mapping, a qualified assertion or a limitation; it is not a compliance finding.

GDPR

Published mention available

EU personal data protection

Data-processing documentation

Review the operative DPA, current recipient changes, support locations and selected region; do not equate hosting geography with every access or transfer.

Read the source-attributed statement

Immuta distinguishes its GDPR processor/subprocessor role for licensed SaaS use from controller processing for its own purposes. Its trust page includes recipient lists marked March 16, 2026. These documented roles and lists still need reconciliation with the customer's agreement and actual processing.

vendor asserted

Immuta — Product capabilities and published scope ↗

Explore GDPR evidence ↗

SOC 2

Published mention available

Assurance report · not a law

Vendor-reported assurance

Request the full current report and compare the SaaS services, integrations and complementary customer controls.

Read the source-attributed statement

Immuta's trust page lists SOC 2 Type 2 assurance. GovernAtlas has not reviewed the underlying report, audit period, opinion or exceptions; the public label alone does not establish the precise service boundary or customer configuration.

vendor asserted

Immuta — Product capabilities and published scope ↗

Explore SOC 2 evidence ↗

ISO 27001

Published mention available

Information security management standard

Vendor-reported assurance

Obtain the current certificates and check entities, locations, services and exclusions with the issuer where appropriate.

Read the source-attributed statement

Immuta's trust page lists ISO 27001 and ISO 27701. GovernAtlas has not inspected the certificates, standard editions, issuing body, validity or detailed ISMS/PIMS scope; these public labels are not independent certificate validation.

vendor asserted

Immuta — Product capabilities and published scope ↗

Explore ISO 27001 evidence ↗

For HIPAA-regulated use, request service-specific BAA eligibility, processing scope and responsibility details. Missing evidence here does not establish noncompliance. Payment cannot alter these evidence labels.

KEEP THE RECORD USEFUL

A dossier should stand up to scrutiny.

Have a source that changes this picture? Submit it for editorial review.

Raise an evidence issue ↗