Immuta Startup Diligence Report
Proceed to confirmatory diligence only. The upside case is a differentiated cross-platform data provisioning/governance layer aligned with AI-era data-access demand and regulated-enterprise needs. The diligence thesis fails if private evidence shows weak retention, concentrated ARR, poor sales efficiency, native-platform displacement, unresolved security/privacy control gaps or material patent/IP exposure.
Immuta Startup Diligence Report
Immuta remains an eligible public-list private unicorn based on CB Insights, and public materials support a real operating company with meaningful product breadth in data provisioning, access governance, marketplace workflows, classification and data-platform integrations. However, underwriting cannot rely on public evidence alone: financial statements, ARR quality, customer concentration, retention, contracts, current security artifacts, partner economics and legal exposure remain private-data-room gating items.
Cross-platform access governance competes against native cloud controls, catalogs, privacy/security platforms and in-house workflows.
Diligence request: Conduct buyer interviews, competitive win/loss, pricing benchmarks and market-share analysis by data platform ecosystem.
Public materials do not disclose audited statements, ARR, margin, burn, cash/debt, receivables, backlog or forecast accuracy.
Diligence request: Request audited/management financials, KPI pack, cash/debt schedule, ARR bridge, gross margin, burn/runway and board-approved plan.
Enterprise logos and historical customer-base growth do not disclose current top-customer ARR, renewals, churn, NRR or deployment depth.
Diligence request: Request ARR by customer, contracts, renewal calendar, churn/NRR cohorts, product usage and independent customer calls.
Immuta handles data-access governance for sensitive data; current control reports, incidents, DPAs, regulatory correspondence and cyber insurance are not public.
Diligence request: Have security/privacy counsel review SOC reports, pen tests, incident history, DPAs, subprocessors, privacy assessments and insurance.
A public legal analysis says ALTR alleges the Immuta Platform infringes five patents related to dynamic data access controls. Allegations are unproven but could affect product, costs and indemnities.
Diligence request: Obtain official pleadings and counsel assessment; evaluate non-infringement, invalidity, settlement range, insurance and customer indemnity obligations.
Immuta integrates with cloud data platforms that can be partners, distribution channels and potential competitors; changes to APIs, native controls or commercial terms could affect value.
Diligence request: Review partner agreements, certification requirements, API dependencies, integration roadmap and win/loss against native platform features.
Public roadmap emphasizes guardrails, exception workflows, marketplace and agentic governance; execution and monetization across complex enterprise governance workflows remain unproven publicly.
Diligence request: Request roadmap, release adoption, attach rates, product telemetry, AI governance risk controls, implementation timelines and customer references.
The public $1B unicorn valuation dates to June 2022; CB profile funding total differs from company total financing, and current market/secondary valuation is unknown.
Diligence request: Reconcile financing history, preferences, current share price, secondary transactions and 409A/fair-value evidence.
Immuta has strong public financing and unicorn-status evidence, but no public financial statements, current ARR/retention, cash/debt, cap table, tax or accounting detail.
not publicly verifiable confidence: high
Audited/management financial statements, ARR, margin, cash/debt, backlog and receivables were not public. Public evidence supports financing history but not operating quality.
| Checklist area | Evidence reviewed | Private request |
|---|---|---|
| Income statement, balance sheet, cash flow | Public materials disclose funding and valuation, not financial statements. | Audited financials, management accounts and KPI pack for the last three years. |
| Planned vs actual results | Historical 2021 ARR growth claim only. | Board plan, budget-vs-actuals and forecast model with variance analysis. |
| Sales/gross profit by product, channel, geography | Product pages disclose modules; no ARR mix or margin. | ARR/bookings/gross margin by product, geography, channel and cohort. |
| Backlog and accounts receivable aging | No backlog, receivables or collections data found. | Backlog, billings, deferred revenue and AR aging schedules. |
Private-company normal, but high-priority for any transaction.
partially verified confidence: medium
CB Insights and company materials support public valuation/funding anchors and historical 2021 ARR growth, but projections and current growth drivers are private.
| Anchor | Date or period | Source | Diligence interpretation |
|---|---|---|---|
| CB Insights unicorn listing | 2022-06-08 | CB Insights unicorn list | Confirms public unicorn eligibility; does not prove current value. |
| Series E round | 2022-06-08 | Immuta funding release/blog | Supports financing event; request definitive documents and preference stack. |
| Total financing / total raised | 2022 public claim; CB profile accessed 2026-05-20 | Immuta; CB Insights profile | Reconcile methodology, timing and instruments before cap-table modeling. |
| 2021 growth claim | 2021, disclosed 2022 | Immuta Series E materials | Positive historical signal; stale without 2022-current ARR, churn and cohort data. |
Use as a public-evidence bridge only; private financial diligence is mandatory.
Amounts are public anchors, not current valuation proof.
partially verified confidence: medium
Investor names and financing totals are public, but share ledger, preferences, option pool, debt and dilution are not.
| Item | Known or inferred status |
|---|---|
| Unicorn valuation | Public market-database listing. |
| Investors | Investor set visible but rights/economics private. |
| Total financing | Minor discrepancy requiring reconciliation. |
| Debt/options/warrants/off-balance-sheet obligations | Unknown. |
Capital structure cannot be underwritten from public sources alone.
not publicly verifiable confidence: low
Tax positions, revenue-recognition policies, accounting policies and financing detail beyond headline rounds are not public.
Public materials support a broad data provisioning/access governance platform spanning policy, discovery/classification, marketplace, monitoring and integrations, but adoption and product quality are private.
partially verified confidence: medium
Public product pages and docs support product breadth across data provisioning, access governance, marketplace, classification and Databricks integration.
| Capability | Source evidence |
|---|---|
| Data provisioning platform | Homepage positioning. |
| Data Access Governance | Product page. |
| Data Marketplace | Product page. |
| Discovery and classification | Product page. |
| Databricks Unity Catalog integration | Immuta documentation. |
| Product area | Hidden risk |
|---|---|
| Cross-platform governance | Cloud platforms may absorb features natively or change APIs. |
| Marketplace/provisioning workflow | Workflow adoption may be narrower than platform narrative. |
| Classification/policy engine | Accuracy and explainability determine buyer trust. |
| Agentic governance | Automated decisions could create compliance or liability concerns. |
Conceptual; not a verified system architecture.
Public logo, partner and integration signals indicate enterprise-market presence; top-customer revenue, renewal health and supplier/partner economics are not public.
partially verified confidence: medium
Public logos and enterprise claims provide customer signals but no top-15 customer schedule, applications or timing of purchases.
| Signal | Evidence strength |
|---|---|
| Homepage enterprise logos | Medium for brand awareness; company-published. |
| Leadership blog customer characterization | Medium for enterprise penetration narrative. |
| 2021 customer-base growth claim | Medium but stale and company-published. |
| Regulated-sector logos | Suggests regulated-market fit. |
Use logos to build reference-call targets; do not model revenue from logos.
partially verified confidence: medium
Public evidence supports Snowflake/Databricks and broader data-platform ecosystem signals; economics and legal terms are private.
| Relationship type | Potential economic relevance |
|---|---|
| Investor/partner | Strategic validation and possible go-to-market/technical alignment. |
| Databricks integration | Key data-platform integration and potential customer acquisition channel. |
| Ecosystem platform partners | Supports cross-platform value proposition. |
| Top suppliers/infrastructure | Potential gross-margin, reliability and data-residency exposure. |
not publicly verifiable confidence: high
Revenue by customer, 5%+ concentration, churn and NRR are not public.
| Sales model metric | Why it matters |
|---|---|
| Pipeline by stage/source | Needed to evaluate growth predictability and partner/channel leverage. |
| Quota, attainment and sales cycle | Enterprise governance deals may have long cycles and heavy security review. |
| CAC, payback and retention | Determines durability and efficiency behind historical growth. |
| Implementation capacity | Governed data access requires integrations and change management; capacity can constrain growth. |
not publicly verifiable confidence: low
No severed significant relationships were identified publicly, but absence of evidence is not evidence of absence.
not publicly verifiable confidence: low
Top suppliers and purchase amounts are not public; platform and infrastructure dependencies need review.
Immuta competes in data access governance/provisioning where cross-platform breadth is valuable but native cloud controls and adjacent governance tools can pressure pricing and differentiation.
partially verified confidence: medium
Competitive positioning is inferable from Immuta product claims and integrations, but market share, win/loss and pricing are private.
| Segment | Immuta positioning |
|---|---|
| Native cloud data-platform controls | Cross-platform policy orchestration and governance layer. |
| Independent data access/governance vendors | Data provisioning, marketplace and policy engine. |
| Catalog/marketplace/data product tools | Marketplace plus governed provisioning and approvals. |
| Manual/internal governance workflows | Automated provisioning and monitoring. |
Representative alternatives are analyst categories; validate against customer win/loss.
| Competition basis | Buyer diligence test |
|---|---|
| Policy automation | Ask buyers whether Immuta reduces approval latency and policy bloat. |
| Cross-platform consistency | Validate consistency across Databricks/Snowflake/BigQuery/Starburst estates. |
| Security/compliance trust | Review current SOC exceptions, incident history and customer security reviews. |
| AI-era governance | Assess governance controls for automated decisions and AI access. |
The public GTM story emphasizes data provisioning, regulated enterprise logos and cloud/data-platform ecosystem alignment, while pipeline, sales productivity and CAC/retention remain private.
partially verified confidence: medium
GTM messaging emphasizes data provisioning, automation, regulated enterprise logos and cloud ecosystem alignment.
| GTM element | Diligence implication |
|---|---|
| Category positioning | Company is repositioning around provisioning rather than only data security/access governance. |
| Enterprise/regulated credibility | Brand signals are strong but need references and contractual proof. |
| Cloud ecosystem | Partnerships can accelerate GTM but create dependency. |
| Thought-leadership around AI/data access | AI narrative may expand urgency but requires risk controls. |
not publicly verifiable confidence: high
Major-customer status, trends, expansion potential and pipeline are not public despite public logos.
partially verified confidence: medium
New-business avenues appear to include enterprise direct sales, platform ecosystem influence and category marketing, but channel contribution is private.
not publicly verifiable confidence: high
Sales compensation, quotas, average sales cycle, rep productivity and hiring plan are not public.
not publicly verifiable confidence: low
Marketing plan budget sufficiency is not public.
R&D evidence is strongest around product pages and documentation; the roadmap toward guardrails, marketplace workflows and agentic governance requires proof of adoption, control quality and monetization.
partially verified confidence: medium
R&D organization detail is private, but technical domains are visible through product pages and Databricks documentation.
| Technical domain | R&D diligence question |
|---|---|
| Classification and metadata | How accurate, explainable and scalable are classifiers across data types? |
| Policy authoring/enforcement | How are conflicts, edge cases, propagation delays and auditability handled? |
| Marketplace/workflows | Are workflows generally available, adopted and integrated with customer systems? |
| Agentic governance / AI consumers | What models/automation are used, what controls prevent over-permissive access and how is liability allocated? |
partially verified confidence: medium
Guardrails, exception workflows, multi-approver workflows and agentic governance are public roadmap/product signals, but costs and adoption are private.
| Roadmap item | Value thesis |
|---|---|
| Guardrail Policies | Prevent approval mistakes and reduce governance risk. |
| Policy Exception Workflows | Manage unique/time-bound data needs without breaking policy. |
| Multi-Approver Workflows | Keep human judgment in the loop for sensitive access. |
| Agentic governors | Scale data-access decisions for humans and AI consumers. |
Public leadership/careers pages show an active company with named executives, but org chart, headcount, compensation, turnover and employee-relations data are not public.
partially verified confidence: medium
Named public leadership exists, but official reporting structure and full org chart are private.
| Person or role | Evidence source |
|---|---|
| Matthew Carroll | Immuta company page. |
| Steve Touw | Immuta company page. |
| Mary Byrne / Moritz Plassnig / Cory Phillips | Immuta company page. |
| Mike Scott | Immuta company page. |
Reporting lines are inferred for visualization from executive roles, not confirmed reporting structure.
not publicly verifiable confidence: high
Historical/projected headcount by function and location is not public.
| Personnel area | Gap |
|---|---|
| Headcount by function/location | No HRIS headcount, location mix or hiring plan. |
| Compensation and benefits | No compensation bands, benefits costs or key agreements. |
| Incentive stock/option pool | Option pool, grants, refreshes and dilution unknown. |
| Turnover and employee relations | Attrition, regretted loss, engagement and disputes unknown. |
partially verified confidence: medium
Public biographies/names for senior management are visible but employment histories, tenure details and references need verification.
not publicly verifiable confidence: high
Employment agreements, compensation arrangements and benefit plans are private.
not publicly verifiable confidence: high
Incentive stock plan and option pool details are private.
not publicly verifiable confidence: low
No significant employee-relations problems were identified publicly, but private records are required.
not publicly verifiable confidence: high
Turnover and retention data are not public.
Public security/privacy and legal materials reveal historical SOC 2, privacy notices and a recently surfaced patent lawsuit; current controls, legal exposure, insurance and contracts require counsel review.
partially verified confidence: medium
A public legal analysis identifies ALTR Solutions patent litigation against Immuta; official docket/pleadings and counsel assessment are required.
| Matter | Potential exposure |
|---|---|
| ALTR Solutions Inc. v. Immuta Inc. | Patent infringement claims concerning data-security/governance product. |
| Patent allegations | Injunction/royalty/settlement risk, defense costs and customer indemnities. |
| Company-initiated lawsuits | Unknown recoveries or disputes. |
| Regulatory or customer disputes | Unknown privacy/security/customer-contract exposure. |
not publicly verifiable confidence: low
No lawsuits initiated by Immuta were identified in the reviewed public materials.
partially verified confidence: medium
For a software company, environmental/safety exposure appears secondary; privacy/data-security obligations are more material and public privacy notice is available.
| Area | Risk implication |
|---|---|
| SOC/security controls | Historical control signal; current exceptions and scope unknown. |
| Privacy notices | Enterprise SaaS privacy posture requires deeper artifact review. |
| Insurance coverage | Litigation and security events could create uncovered exposure. |
| Regulatory agency problems | Absence in public materials is not proof of absence. |
partially verified confidence: medium
Product IP is material, and public litigation analysis raises patent allegations requiring dedicated IP review.
| Asset or contract area | Risk or unknown |
|---|---|
| Patents/accused technology | Scope, validity and exposure unknown. |
| Product IP / software rights | Ownership, open-source, licenses and third-party components unknown. |
| Customer contracts and indemnities | Security/privacy/IP indemnity exposure unknown. |
| Partner/platform agreements | Partner rights, certification and commercial terms unknown. |
not publicly verifiable confidence: high
Insurance coverage and material exposures are not public.
not publicly verifiable confidence: high
Material contracts, customer terms, partner terms and supplier obligations are private.
partially verified confidence: medium
Historical SOC 2 and privacy notice evidence exists; regulatory agency correspondence and current control reports are private.
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | Immuta is listed by CB Insights as a private unicorn at a $1B valuation, joining the list on 2022-06-08 in Boston under Enterprise Tech. | verified high | SRC-001 |
| EC-002 | CB Insights profiles Immuta as founded in 2015, Series E - III, Alive, with total raised of $259.5M. | partially verified medium | SRC-002 |
| EC-003 | Immuta announced a $100M Series E round led by NightDragon with Snowflake Ventures and existing investors, bringing total financing to $267M. | verified medium | SRC-003SRC-004 |
| EC-004 | Immuta publicly claimed that in 2021 it increased commercial ARR by more than 100%, doubled its customer base and expanded globally. | partially verified medium | SRC-003SRC-004 |
| EC-005 | Immuta positions itself as a data provisioning platform that orchestrates policies, provisioning and monitoring. | verified medium | SRC-005 |
| EC-006 | Immuta’s company narrative spans Data Security, Data Provisioning and Agentic Governance. | verified medium | SRC-006 |
| EC-007 | Immuta describes Data Access Governance as a unified plane for cross-platform data access control, discovery, tagging, policy authoring and enforcement. | verified medium | SRC-007 |
| EC-008 | Immuta describes Data Marketplace as a collaborative provisioning product for discovering and delivering data products. | verified medium | SRC-008 |
| EC-009 | Immuta says automated data discovery and classification enable policies to be consistently enforced across data platforms and marketplaces. | verified medium | SRC-009 |
| EC-010 | Immuta’s Databricks Unity Catalog integration documentation describes fine-grained access control, subscription policies and row-/column-level security. | verified medium | SRC-011 |
| EC-011 | Immuta publishes customer-logo and partner-platform signals, including enterprise logos and ecosystem links to Databricks, Snowflake, Google BigQuery and Starburst. | partially verified medium | SRC-005SRC-006 |
| EC-012 | Immuta presents active leadership and employer signals. | verified medium | SRC-006SRC-014 |
| EC-013 | Immuta publicly announced SOC 2 Type 2 attestation in 2021. | partially verified medium | SRC-012 |
| EC-014 | Immuta’s privacy notice describes personal-data processing and separates website/privacy activities from SaaS platform processing. | verified medium | SRC-013 |
| EC-015 | A public legal analysis identifies ALTR Solutions Inc. v. Immuta Inc., D. Del. 1:25-cv-01586, alleging the Immuta Platform infringes five U.S. patents. | partially verified medium | SRC-015 |
| EC-016 | Audited financial statements, ARR, gross margin, cash/debt, receivables, backlog, cap table and debt terms are not public in the reviewed materials. | not publicly verifiable high | SRC-001SRC-002SRC-003SRC-004 |
| EC-017 | Customer concentration, current top customers, ARR by account, churn, NRR and contract terms are not public. | not publicly verifiable high | SRC-004SRC-005SRC-006 |
| EC-018 | Immuta faces competitive and dependency pressure from the same cloud data platforms it integrates with and from adjacent governance/catalog/security products. | partially verified medium | SRC-005SRC-007SRC-011 |
| EC-019 | Immuta’s recent public roadmap emphasizes data provisioning, guardrails, exception workflows, multi-approver workflows, marketplace and AI/human access. | verified medium | SRC-006SRC-010 |
| EC-020 | The public diligence record is source-rich for eligibility and product narrative but weak for private-company economics, contracts, current controls and legal outcomes. | verified high | SRC-001SRC-002SRC-003SRC-005SRC-015 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.