ALTR vs Immuta

ALTR offers hosted classification of Snowflake samples and an In-Warehouse mode that keeps sampled values in Snowflake and returns classification results. [5]

In-Warehouse mode does not evaluate Column Content, Google DLP or Amazon Comprehend conditions. A skipped condition can change a combined rule result. Validate the configured rules, sample size and warehouse cost. [5]

Immuta runs regex and dictionary identification queries in Snowflake, returning column names and matching identifiers without raw values. Column-name identification uses metadata held in Immuta. [5]

Content identification generally covers text columns, with documented date and time exceptions. Competitive identifiers require a 90% sample match and queries time out after 15 minutes by default. Test sparse sensitive values and complex views. [5]

ALTR supports native Snowflake masking through tag connections. Its default masking uses an external function to request a policy decision from ALTR at query time. [6]

Native masking requires policy redeployment after rule changes and does not produce ALTR Database Activity Monitoring records. Direct column connections use an external-function protection type. Test the required query paths and audit evidence. [6]

Immuta administers native Snowflake column-masking and row-access policies on registered objects. Users query Snowflake directly and receive policy-controlled results. [4]

The integration requires Snowflake Enterprise. User mapping and policy sync must be configured. Listed excepted users and roles bypass Immuta policies. Include those identities and views in the acceptance test. [4]

Redshift uses policy-enforced views. S3 supports subscription policies but the comparison table does not list data-policy enforcement. [1]

BigQuery uses policy-enforced views. The integration matrix limits sensitive-data discovery to column-name identification. [1]

Snowflake and Databricks are documented integrations. Protection features differ by store. [1]

Snowflake and Databricks integrations support native access policies. Verify feature parity for your integration mode. [1]

Snowflake policy evaluation depends on the protection type. [2] [3] [4]

Enforcement

Native masking evaluates inside Snowflake. Other documented protection types call ALTR.

Classification

ALTR-hosted jobs sample data externally. In-Warehouse classification uses customer warehouse compute.

Snowflake setup

ALTR requires Snowflake Enterprise Edition or higher and ACCOUNTADMIN for connection setup. ALTR states that ACCOUNTADMIN is not needed after setup. Accounts with network policies must allow ALTR IP addresses.

Ongoing privileges

The documented service role includes account-level APPLY MASKING POLICY, APPLY ROW ACCESS POLICY, APPLY TAG and MANAGE GRANTS, plus source access. Review the full grant list before connecting production data.

In Snowflake, Immuta administers native row-access and column-masking policies on tables. [2] [3] [4]

Query path

Users query Snowflake directly while those policies are enforced.

Connection setup

The integration requires Snowflake Enterprise. An Immuta application administrator registers the connection. The Snowflake setup user needs CREATE DATABASE, CREATE ROLE and MANAGE GRANTS with grant option.

Retained system access

The generated script grants the system account CREATE ROLE, MANAGE GRANTS, APPLY MASKING POLICY and APPLY ROW ACCESS POLICY with grant option. Scope source USAGE and REFERENCES to the registered objects.

Content access

SELECT is required for identification or specialized masking that uses fingerprinting. Iceberg and external tables need grants for their own object types.

Pricing was not established in the reviewed sources.

Pricing was not established in the reviewed sources.

1. Which protection types require an external call, and where will classification run?
2. Demonstrate the audit evidence for native and external-function masking, including the activity each mode does not record.
3. Review setup and retained service-user grants separately. Demonstrate credential rotation and policy removal on a test database.

1. Show masking and row filtering through every query path used by your applications.
2. What privileges remain after initial integration and how are policies removed safely?
3. Measure warehouse compute and query latency with your actual policy set.