Immuta Federal

FedRAMP package ID

FR2629068833

Cloud service provider

Immuta

Certification status

Initial Implementation

Impact level

Not listed

Certification class

Class C (Moderate)

Authorization path

Program

Certification type

20x

Marketplace phase

Initial Implementation

Deployment model

Government Community Cloud

Register snapshot

September 3, 2026

Service model

SaaS

Independent assessor

Fortreum

Status date

July 22, 2026

Business categories

Data Management, Governance, Risk, and Compliance (GRC)

SAM.gov UEI

47-1877648

Milestones on record

1

The marketplace carries Immuta Federal under package FR2629068833 with 16 recorded fields. Its current status was set on July 22, 2026. Fortreum is named as the independent assessor. No agency authorizations are listed against it in the current feed. It is delivered as SaaS on a government community cloud, filed under 2 business categories including Data Management and Governance, Risk, and Compliance (GRC). Its SAM.gov unique entity identifier is 47-1877648.

• Partos for Government

  Partos Inc.

  Initial Implementation, no impact level listed, Program path, 20x.

• Certivo Compliance Platform

  Certivo, Inc.

  Initial Implementation, no impact level listed, Program path, 20x.

• SunStone Artemis Platform

  SunStone Secure, LLC

  Initial Implementation, no impact level listed, Program path, 20x.

• Tarly Cowork

  Pincus Technologies Inc

  Initial Implementation, no impact level listed, Program path, 20x.

• ComplianceAide Government Cloud

  ComplianceAid INC.

  Initial Implementation, no impact level listed, Program path, 20x.

Immuta's SaaS platform, the Immuta Data Security Platform, provides a number of capabilities that enable customers to govern and provision data access, automating how data is delivered to both human and non-human consumers while maintaining continuous compliance. These capabilities are managed through Immuta's web-based interface and Application Programming Interface (API). Authentication to Immuta's service is controlled via a variety of Single Sign-on (SSO) and directory systems maintained by the customer or a third party. Management of each customer's Immuta environment is split into a number of roles so that customers desiring a separation of duties for governance purposes can limit users to specific roles to achieve that goal. User attributes can be defined within the platform's identity manager or synced from an external identity management system. This functionality is central to implementing attribute-based access and control (ABAC) of data, which is a key capability of the platform. Users allowed to act under the application admin role may register metadata from their cloud data warehouse systems, such as Snowflake, Databricks, Starburst, Redshift, Synapse, and BigQuery, etc., with Immuta. Selected tables from these warehouses then appear as entries in Immuta's metadata catalog interface, where users can add documentation, discuss the data, and tag tables and columns. Tables, called Data Sources in Immuta, can further be grouped into Immuta Projects, which are a logical collection of Data Sources, users, documentation, and clearly defined purposes. Immuta Projects ensure that customers can use data in accordance with laws and regulations that require traceability to the legitimate reasons that sensitive data is used in the various distinct contexts that permeate each organization. Registered metadata is also analyzed by the platform's Sensitive Data Discovery functionality, which can determine if data in a column is in one of a number of categories, such as personally identifiable information (PII) or "PII First Name," that are commonly used to drive data access policies. Analysis of this data occurs completely in the customer's data platform; no data ever leaves back to Immuta. This information is used to tag data within Immuta. Additionally, for customers who have successfully cataloged data in other systems, this kind of information can be synced to Immuta from a variety of common external catalogs. As users, data, and their attributes are registered with Immuta, users are allowed to act under the Data Owner and Governance roles, and can use Immuta's natural language policy builder to apply access control policies to the data at the data set and row levels, and minimize access to data through Privacy Enhancing Technologies (PETs). Each Data Owner can manage such policies for the data they own. Users in the Governance role can manage policies at a global level. This global policy capability allows governors to review policies for compliance and set up policies that automatically impact new data and new users as they are added to the system. Based on these policies, Immuta connects to the customer cloud data warehouse and administers those policies into the data platform in question, keeping Immuta out of the data path but still enforcing policy. Users query data in the systems they are already using, but Immuta enforces their access based on the defined policies. Immuta also extends this policy-driven model to AI agents acting on behalf of users. When an agent requests data, Immuta evaluates the request in real time and provisions a temporary, scoped role in the underlying data platform - reflecting only the permissions relevant to that specific task. This access is automatically removed once the task is complete, so no standing privilege persists. Because the agent acts on behalf of a human user rather than as that user, Immuta maintains a dual-identity audit trail showing both the human who delegated the request and the agent that acted. Finally, Immuta provides robust auditing of actions taken within the platform to allow customers to document their data controls and have evidence for compliance purposes. For certain cloud warehouses, such as Databricks or Starburst, this examination extends to queries users perform in the source data systems. For others, Immuta logs and warehouse logs can easily produce an organization's complete compliance picture when combined in their existing log aggregation and analysis system. This audit trail extends to agent activity, distinguishing human actions, agent actions, and agent-on-behalf-of-user actions.