Data Access Governance Software and Tools: 12 Platforms Compared on Verified Pricing

Immuta is the reference implementation of warehouse access policy. It discovers and classifies columns, then compiles policy-as-code into the native controls of Snowflake, Databricks, BigQuery and Starburst rather than proxying your queries, so nothing new sits in the data path and there is no new failure point at 3am. Attribute-based access control, dynamic masking and purpose-based restrictions are all first class. Its AWS Marketplace listing sells 960 Immuta Units for $96,000.00 on a 12-month contract, which is exactly $100.00 per Unit, and the listing never defines what a Unit entitles you to. It will not tell you what a column means or where it came from, which is why it is usually bought next to a catalog rather than instead of one. Full breakdown on our Immuta comparison.

Privacera was founded in 2016 by the people who built the software that became Apache Ranger, and that heritage is the whole product thesis: it extends a Ranger policy model most large Hadoop estates already have off-premises into Snowflake, Databricks, AWS and Azure. Like Immuta it pushes enforcement down into each source rather than intercepting queries, so there is no proxy and no single point of failure in the query path. That makes it the natural choice when you are migrating a Hadoop estate and want to carry existing Ranger policies with you instead of rewriting them. Two things to know before you shortlist it. Its AWS Marketplace listing, titled PrivaceraCloud - SaaS Data Access Governance, sells a dimension named Data Access Governance Starter pack for $100,000.00 a year. And the company is moving to a new identity: privacera.com now redirects to trust3.ai, where the product is positioned as purpose-based access for AI agents across Snowflake, Databricks, Iceberg, Anthropic and OpenAI.

Satori takes the opposite architectural bet to Immuta and Privacera: it sits in the data path as an agentless layer in front of your databases, which is why it deploys in hours rather than weeks and why it can do database activity monitoring that pushdown tools structurally cannot. The trade is that something new is now between your analysts and your data, and that is a real conversation with an infrastructure team. Its Marketplace listing is the most transparent in the category, with three named tiers: Starter at $0.00, Base at $70,000.00 and Business at $150,000.00, 12 months only. The strategic caveat is ownership. Commvault announced its intent to acquire Satori Cyber on 24 July 2025 and closed in December 2025, and satoricyber.com/platform now redirects to commvault.com. If you shortlist Satori in 2026 you are buying from a backup and cyber-resilience company, and you should ask directly about the standalone roadmap.

Varonis is the oldest and largest company on this page and it solves a genuinely different problem from the warehouse tools: who currently has access to the twelve million files, mailboxes and SharePoint sites nobody has audited since 2019. Effective-permissions mapping, blast-radius analysis and automated remediation of overexposed data are what it is actually good at, and no warehouse-native tool comes close on unstructured data. It is priced completely differently too. Rather than one platform fee, its Marketplace listing publishes a rate card of seventeen separate per-connector unit prices, which makes it the only vendor here where you can build a bottom-up estimate before you ever speak to sales. Treat it as complementary to a warehouse policy engine, not as an alternative to one.

BigID leads with discovery and classification rather than enforcement, and it is the strongest option here when the honest answer to "where is our regulated data" is that nobody knows. Its correlation approach links records back to an identity across systems, which is what privacy and subject-rights work actually requires. Access control exists but is not the center of gravity. Its BigID Next Marketplace listing carries the highest 12-month list price we have found anywhere in this category, $175,000.00, and the vendor description attached to that very price reads "Please contact BigID for custom pricing." Both facts are true at once. See our BigID comparison for the full pricing table.

Purview is the only platform on this page that publishes exact metered rates you can query from a public API before a sales call, which is a real advantage when you have to build a business case. Sensitivity labels, DLP and access policy are strong inside Microsoft 365 and Azure, and weaker the further you get from them. The trap is naming, because three different products carry the Purview label and the classic Data Catalog is in customer support mode. Microsoft also marks Amazon Redshift as unsupported for lineage entirely. We break the meters down in our guide to Microsoft Purview pricing.

Securiti sells a broad data command center covering discovery, DSPM, privacy operations, consent and access intelligence, and it is a credible single-vendor answer when your driver is a privacy regulation rather than an engineering problem. It overlaps heavily with BigID and increasingly with the AI-governance positioning everyone in this category adopted in 2025 and 2026. If your buying committee is led by a privacy office or general counsel it belongs on the shortlist. If it is led by a data platform team, the warehouse-native tools will fit your workflow far better. On pricing, its AWS Marketplace listing sells a single dimension named Platform Fee at $100,000.00 for 12 months, read on 2 September 2026. The dimension is one Unit and the listing does not define what a Unit entitles you to.

These two are data security posture management rather than access governance, and the distinction matters when you are writing requirements. They connect to your cloud accounts, find sensitive data, build an identity-to-data graph and tell you which combinations are dangerous. What they largely do not do is enforce a policy at query time on a specific column for a specific analyst. Buy DSPM to answer "what is our exposure," buy an access policy engine to answer "who may see this row." A surprising number of stalled projects come from buying the first and having written requirements for the second. Both publish real rate cards, read on 2 September 2026: Cyera lists three packages at $50,000, $100,000 and $250,000 against stated ceilings of 25TB, 100TB and 250TB, and Sentra lists four tiers at $50,000, $100,000, $250,000 and $500,000 without stating any entitlement. We break both down in our comparison of data classification tools.

Netwrix is the pragmatic mid-market answer to the same problem Varonis solves at the top of the market: stale permissions, over-privileged groups, and access reviews that currently happen in a spreadsheet once a year. It is more approachable and materially cheaper than the enterprise DSPM platforms, and for an organization whose sensitive data genuinely lives on Windows file shares and in Microsoft 365 rather than in a warehouse, it is often the correct purchase. It is not a warehouse policy engine and does not claim to be.

Before you buy anything on this page, check what you already own. Snowflake Horizon includes tagging, classification, row access policies, dynamic masking and column-level lineage at no extra license cost, with lineage requiring Enterprise Edition or higher. For a single-warehouse estate with a manageable number of policies this is genuinely sufficient, and buying a third-party policy engine to sit on top of it is a common and expensive mistake. Add a vendor when policy has to be consistent across two warehouses, or across the warehouse and the file estate, because Horizon stops at the Snowflake boundary.

The same argument applies on the lakehouse side. Unity Catalog covers grants, row filters, column masks, attribute-based access control and lineage across workspaces. It is also where a competitor went: Databricks acquired Okera on 3 May 2023 and folded its access-governance technology into Unity Catalog, so a vendor that appears on older shortlists is now a feature of the platform. The cost nuance most articles miss is that Unity Catalog is not free in the way people repeat, because the governance tier is Premium, and Premium Jobs Compute runs at exactly double the Standard rate per DBU-hour. Our Unity Catalog lineage guide has the meter detail.

Collibra is not an access enforcement engine and is frequently miscast as one on comparison lists. What it provides is the program around the policy: who approved this access rule, against which written policy, reviewed on what date, and the evidence pack an auditor will accept. It acquired Raito in June 2025 specifically to strengthen the access side. Buy it when a regulator holds a named person in your organization accountable, and pair it with one of the enforcement tools above. Its Marketplace listing is $170,000.00 for 12 months, re-verified on 1 September 2026 and unchanged since August. Details on our Collibra comparison.