{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"imanage","name":"iManage","domain":"imanage.com","category":"Legal tech","one_liner":"iManage was founded in 1995 and initially merged with Interwoven in","trust_center_url":"https://compliance.imanage.com/","security_page_url":null,"url":"https://certreports.com/vendors/imanage/security","last_verified_at":"2026-11-02T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"verified_auditor","state_label":"Verified","sentence":"Confirmed by the public SOC 3 report for the period ending 31 Mar 2026, as of 2 Nov 2026.","kind":"type2","status_text":"Evidenced by the public SOC 3 report for the same examination period","issued_at":"2026-07-13","expires_at":null,"period_start":"2025-04-01","period_end":"2026-03-31","auditor":null,"impact_level":null,"as_of":"2026-11-02","under_review":false,"source":"soc3","url":"https://certreports.com/vendors/imanage/soc-2","evidence":[{"source_type":"auditor","source_name":"iManage SOC 3 report (compliance.imanage.com)","url":"https://compliance.imanage.com/doc/trust?rid=6a62186645650742a1fd2edd&r=miy4ux3bhldvo78aoy8ckq&view=true","fetched_at":"2026-10-26 02:00:38.054081+00","content_hash":"334bf6cdafc56371be29413aaa0d1b5e39f87ac6ee09237cb13b22aea251ddd2","wayback_url":null,"quote":"In our opinion, management's assertion that the controls within iManage's Cloud Services system were effective throughout the period April 1, 2025, through March 31, 2026, to provide reasonable assurance that iManage's service commitments and system requirements were achieved based on the applicable trust services criteria is fairly stated, in all material respects.","confidence":0.9}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Vanta) as of 30 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/imanage/iso-27001","evidence":[{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-29 02:04:15.973762+00","content_hash":"3a5801431a451710982edcd7b67fb82784163b1ae0aabd7fb59851ce50849db0","wayback_url":null,"quote":"ISO 27001:2022","confidence":1},{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-27 02:04:15.333588+00","content_hash":"340ff45a11f4fae431c86b700d45d3de4dc2878f447cc8eea866230bd64bd7c3","wayback_url":null,"quote":"ISO 27001:2022","confidence":1},{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-18 23:03:34.167613+00","content_hash":"ec7b43b75546a2b3eb836b868fdf914a361962c576310e5bc2f53cca09583768","wayback_url":null,"quote":"ISO 27001:2022","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"verified_registry","state_label":"Verified","sentence":"Listed in the CSA STAR registry as of 26 Oct 2026.","kind":"level2","status_text":"STAR Level 2 certification","issued_at":"2021-05-02","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-10-26","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/imanage/csa-star","evidence":[{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/imanage","fetched_at":"2026-10-26 05:00:05.217959+00","content_hash":"0c3d16dcbd77d639d256c2f5de5eac7c995deb3d9c8ecb697f3919e064cfa0fd","wayback_url":null,"quote":"imanage: STAR Level 2 certification","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/imanage","fetched_at":"2026-10-19 05:00:04.207159+00","content_hash":"6ebb0150315154b32c59fd3d2a81bb4bc4a9c9dabf7b485b5276104bdf852acb","wayback_url":null,"quote":"imanage: STAR Level 2 certification","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/imanage","fetched_at":"2026-10-12 05:00:04.718981+00","content_hash":"be2cb50e52128b9a1c5b016c9a48d1831b9215e7effe345b5df6a034ef5f2e29","wayback_url":null,"quote":"imanage: STAR Level 2 certification","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/imanage","fetched_at":"2026-10-05 05:00:04.451025+00","content_hash":"3b3fda577efc5eb9a00af6a8040caf609c1fc2a294d846b2dcab0e8c2303b261","wayback_url":null,"quote":"imanage: STAR Level 2 certification","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/imanage","fetched_at":"2026-09-29 03:46:22.312905+00","content_hash":"aadfa82b54b7f12b294435b40c81a3cac63c4874bc052d39b123e12485fa29d0","wayback_url":null,"quote":"imanage: STAR Level 2 certification","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/imanage","fetched_at":"2026-09-17 15:44:42.254747+00","content_hash":"e7f124247f5399c92ba048620a83c0b6cca1f9a2f97419f32566e462a3b1bda7","wayback_url":null,"quote":"imanage: STAR Level 2 certification","confidence":1}]},{"framework":"iso-27701","framework_name":"ISO/IEC 27701","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27701 certificate on its trust centre (Vanta) as of 30 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27701 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/imanage/iso-27701","evidence":[{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-29 02:04:15.973762+00","content_hash":"3a5801431a451710982edcd7b67fb82784163b1ae0aabd7fb59851ce50849db0","wayback_url":null,"quote":"ISO 27701","confidence":1},{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-27 02:04:15.333588+00","content_hash":"340ff45a11f4fae431c86b700d45d3de4dc2878f447cc8eea866230bd64bd7c3","wayback_url":null,"quote":"ISO 27701","confidence":1},{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-18 23:03:34.167613+00","content_hash":"ec7b43b75546a2b3eb836b868fdf914a361962c576310e5bc2f53cca09583768","wayback_url":null,"quote":"ISO 27701","confidence":1}]},{"framework":"soc-3","framework_name":"SOC 3","state":"verified_auditor","state_label":"Verified","sentence":"Confirmed by the public SOC 3 report for the period ending 31 Mar 2026, as of 2 Nov 2026.","kind":"type2","status_text":"Public SOC 3 report on the vendor's trust centre","issued_at":"2026-07-13","expires_at":null,"period_start":"2025-04-01","period_end":"2026-03-31","auditor":null,"impact_level":null,"as_of":"2026-11-02","under_review":false,"source":"soc3","url":"https://certreports.com/vendors/imanage/security","evidence":[{"source_type":"auditor","source_name":"iManage SOC 3 report (compliance.imanage.com)","url":"https://compliance.imanage.com/doc/trust?rid=6a62186645650742a1fd2edd&r=miy4ux3bhldvo78aoy8ckq&view=true","fetched_at":"2026-10-26 02:00:38.054081+00","content_hash":"334bf6cdafc56371be29413aaa0d1b5e39f87ac6ee09237cb13b22aea251ddd2","wayback_url":null,"quote":"In our opinion, management's assertion that the controls within iManage's Cloud Services system were effective throughout the period April 1, 2025, through March 31, 2026, to provide reasonable assurance that iManage's service commitments and system requirements were achieved based on the applicable trust services criteria is fairly stated, in all material respects.","confidence":0.95}]},{"framework":"iso-27017","framework_name":"ISO/IEC 27017","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27017 certificate on its trust centre (Vanta) as of 30 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27017 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/imanage/security","evidence":[{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-29 02:04:15.973762+00","content_hash":"3a5801431a451710982edcd7b67fb82784163b1ae0aabd7fb59851ce50849db0","wayback_url":null,"quote":"ISO 27017","confidence":1},{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-27 02:04:15.333588+00","content_hash":"340ff45a11f4fae431c86b700d45d3de4dc2878f447cc8eea866230bd64bd7c3","wayback_url":null,"quote":"ISO 27017","confidence":1},{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-18 23:03:34.167613+00","content_hash":"ec7b43b75546a2b3eb836b868fdf914a361962c576310e5bc2f53cca09583768","wayback_url":null,"quote":"ISO 27017","confidence":1}]},{"framework":"iso-27018","framework_name":"ISO/IEC 27018","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27018 certificate on its trust centre (Vanta) as of 30 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27018 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/imanage/security","evidence":[{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-29 02:04:15.973762+00","content_hash":"3a5801431a451710982edcd7b67fb82784163b1ae0aabd7fb59851ce50849db0","wayback_url":null,"quote":"ISO 27018","confidence":1},{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-27 02:04:15.333588+00","content_hash":"340ff45a11f4fae431c86b700d45d3de4dc2878f447cc8eea866230bd64bd7c3","wayback_url":null,"quote":"ISO 27018","confidence":1},{"source_type":"trust_center","source_name":"iManage trust centre (Vanta)","url":"https://compliance.imanage.com/","fetched_at":"2026-09-18 23:03:34.167613+00","content_hash":"ec7b43b75546a2b3eb836b868fdf914a361962c576310e5bc2f53cca09583768","wayback_url":null,"quote":"ISO 27018","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 2 Nov 2026.","kind":"listing","status_text":"Active: SW-US Certification, EU-US Certification, UK Extension Certification","issued_at":"2019-10-04","expires_at":"2027-08-10","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-11-02","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/imanage/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/4426","fetched_at":"2026-11-02 05:01:47.435677+00","content_hash":"51aabfaf2334b51bca3aed6ec5ef223794dd4e5c92c8348909fce883d1a49151","wayback_url":null,"quote":"iManage: Active: SW-US Certification, EU-US Certification, UK Extension Certification","confidence":1}]}],"brief":{"summary":"iManage has a SOC 2 Type II report, evidenced by a public SOC 3 report for the period ending 31 Mar 2026 and issued 13 Jul 2026 (SOC 2, as of 29 Sep 2026). The same SOC 3 report is published on the vendor's trust centre (SOC 3, as of 29 Sep 2026). iManage is listed in the CSA STAR registry with a Level 2 certification, issued 2 May 2021 (CSA STAR, as of 17 Sep 2026). iManage is listed as active in the EU-US Data Privacy Framework registry under SW-US, EU-US and UK Extension certifications, issued 4 Oct 2019 and expiring 10 Aug 2027 (EU-US Data Privacy Framework, as of 17 Sep 2026). iManage also states on its trust centre that it holds ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 27017 and ISO/IEC 27018 coverage (ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, as of 29 Sep 2026).","bullets":["SOC 2 Type II report evidenced via public SOC 3, period ending 31 Mar 2026 (SOC 2 / SOC 3, as of 29 Sep 2026).","CSA STAR Level 2 certification, issued 2 May 2021 (CSA STAR, as of 17 Sep 2026); EU-US Data Privacy Framework active, expires 10 Aug 2027 (as of 17 Sep 2026).","ISO/IEC 27001:2022, 27701, 27017 and 27018 stated on trust centre, no registry verification found (as of 29 Sep 2026)."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-29 03:22:03.08645+00"},"legal_docs":[{"kind":"subprocessors","url":"https://compliance.imanage.com/","availability":"public","detail":"17 subprocessors listed on the trust centre","as_of":"2026-09-30"},{"kind":"security_txt","url":"https://compliance.imanage.com/","availability":"public","detail":"Public documents on the trust centre: iManage - ISO27001, ISO27701, ISO27017, ISO27018 - Certificate; iManage - ISO 22301 - Certificate; iManage  SOC 3 Type 2 Report 2026","as_of":"2026-09-18"},{"kind":"privacy","url":"https://imanage.com/about/privacy-notice/","availability":"public","detail":null,"as_of":"2026-09-30"},{"kind":"scc","url":"https://compliance.imanage.com/","availability":"on_request","detail":"Listed on the trust centre as \"iManage Transfer Impact Assessment\"","as_of":"2026-09-30"},{"kind":"ai_policy","url":"https://compliance.imanage.com/","availability":"on_request","detail":"Listed on the trust centre as \"iManage Artificial Intelligence in the Workplace Policy\"","as_of":"2026-09-30"}],"documents":[{"type":"ai_policy","title":"iManage AI Software Development Policy","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"ai_policy","title":"iManage Artificial Intelligence in the Workplace Policy","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"ai_policy","title":"iManage Ethical AI Principles","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"architecture_diagram","title":"iManage Cloud Network Diagram","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"architecture_diagram","title":"iManage Threat Manager Architecture in AKS","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"bridge_letter","title":"iManage SOC 2 Type 2 Bridge Letter August 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"business_continuity","title":"iManage Business Continuity Management System Policy","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"business_continuity","title":"iManage Business Continuity Management System Scope Statement","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"business_continuity","title":"iManage Business Continuity Pandemic Plan","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"business_continuity","title":"iManage Business Continuity Plan","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"business_continuity","title":"iManage Cloud/All products Disaster Recovery Plan","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"business_continuity","title":"iManage Share Disaster Recovery Tests","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"business_continuity","title":"iManage.work Disaster Recovery Tests","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"insurance","title":"iManage - COI Evidence of Liability Insurance","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"iso_certificate","title":"iManage - ISO 22301 - Certificate","availability":"public","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"iso_certificate","title":"iManage - ISO27001","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"iso_certificate","title":"iManage - ISO27001, ISO27701, ISO27017, ISO27018 - Certificate","availability":"public","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"iso_soa","title":"iManage Statement of Applicability","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"Ask iManage Pen Test Q1-2025 Executive Summary","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Ask iManage 2026 Pen Test Executive Summary","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Closing Folders Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Cloud Email Management Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Conflicts & Intake Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Disposition Manager Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Drive Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Elegrity Pen Test Q1-2024 Executive Summary","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage External Network Pen Test Q3-2025 Executive Summary","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Extract Pen Test Q1-2025 Executive Summary","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Insight Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Insight+ Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage MCP Pen Test Executive Summary -2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Mobility Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Records Manager Pen Test  Executive Summary 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Risk & Compliance Pen Test Q1-2025 Executive Summary","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Security Policy Manager Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Threat Manager 2026 Pen Test Executive Summary","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Threat Manager Pen Test Q1-2025 Executive Summary","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Tracker Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Work Cloud Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Work Desktop for Mac Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage Work Desktop for Windows Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage.Work Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iManage.work Pen Test Q1-2025 Executive Summary","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"iMange Share Pen Test Executive Summary - 2026","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"privacy_policy","title":"iManage Cloud Privacy Policy","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"questionnaire","title":"HECVAT v4.03","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"questionnaire","title":"iManage CSA CAIQ v4.0.3","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"scc","title":"iManage Transfer Impact Assessment","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"security_policy","title":"CloudiManage Encryption Datasheet","availability":"public","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"security_policy","title":"iManage Customer-Managed Encryption Keys Data Sheet","availability":"public","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"security_policy","title":"iManage Global Physical Security Policy","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"security_policy","title":"iManage Information Security Management System","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"security_policy","title":"iManage Information Security Policy Manual","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"soc2_report","title":"iManage - 2026 Type 2 SOC 2+ - Report","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"soc3_report","title":"iManage  SOC 3 Type 2 Report 2026","availability":"public","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"vpat","title":"iManage MS Office Integrations VPAT","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"},{"type":"vpat","title":"iManage Work Platform VPAT","availability":"on_request","source_url":"https://compliance.imanage.com/","last_seen":"2026-09-30"}],"statements":[{"topic":"data_location","question":"Who does iManage use as the data center service providers for cloudimanage (CiM)?","answer":"iManage utilizes several data center service providers to support its services: Microsoft Azure: For Microsoft-owned data centers, iManage provides a virtual operating environment in Microsoft Azure to host its Cloud services. iManage manages and monitors the platform on Microsoft infrastructure (routers, servers, switches). Microsoft is responsible for perimeter and physical security, power, and fire/environmental protection. iManage-Owned Data Centers: These are located within co-location facilities provided by Centersquare and NEXTDC. In these facilities, iManage deploys its hardware—including routers, servers, and switches—in a secure cage. Access is limited to authorized iManage employees (with proper identification and pre-approved access). At the same time, the co-location facility ","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=6sdo9ytovmef9qadwfukb7","as_of":"2026-09-30"},{"topic":"data_location","question":"How are data center service providers utilized for imanage.work Customers?","answer":"For imanage.work Customers, iManage employs a similar approach with the following details: iManage-Owned Data Centers: iManage-owned data centers located in co-location facilities (provided by Centersquare or NEXTDC) are used to support services for imanage.work Customers. In these facilities, iManage deploys its hardware in a secure cage. Access is strictly limited to authorized iManage personnel, and the co-location facility providers are responsible solely for the facility’s physical security and related controls. These providers do not have access to iManage systems or Customer data in the iManage Cloud.","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=4jknwadnypn7l8vxx6joul","as_of":"2026-09-30"},{"topic":"encryption","question":"How is encryption key management, including key rotation, handled within the iManage Cloud?","answer":"See the controls below. Key Management : iManage has a documented encryption key management system. Unique Customer Library Encryption Keys (LEKs) are generated for each Customer and managed securely. The Primary Encryption Keys (PEKs) are stored in segregated secure environments (such as Azure Key Vault) to ensure that no single person can access the entire key set. A Customer Managed Encryption Key (CMEK) solution is available for Customers requiring additional control. This solution allows Customers to manage and delete their encryption keys when they exit the environment. Encryption Key Rotation : Each file (including each version and journal copy) is encrypted with a unique File Encryption Key (FEK) that is wrapped with the Customer’s Library Encryption Key and stored in the database.","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=ppzbtpnxv2l64ecsqfk7tu","as_of":"2026-09-30"},{"topic":"encryption","question":"Does iManage have Encryption Key Management Policies or Standards?","answer":"iManage’s encryption key management policies and standards define the lifecycle, rotation, and ownership requirements for encryption keys. iManage-issued keys use automated key policies, while Customers using Customer Managed Encryption Keys (CMEK) would enter their encryption key details via the iManage Control Center. Key management is fully automated, and all encryption keys are stored in separate, secure areas to ensure that no single individual can access all key components.","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=uw4gs1lnzii09cyid6nd9","as_of":"2026-09-30"},{"topic":"encryption","question":"How does iManage protect data at rest using encryption in the Azure Blob Storage (Cloudimanage)?","answer":"The cloudimanage (CiM) Work 10 application encrypts each Customer document (file) when it is created (uploaded) or saved, using a unique, randomly generated file encryption key (FEK) and the Bouncy Castle AES-256 for Java encryption service. The Work 10 encrypted file is then encrypted by Microsoft Azure when it is stored at rest in Azure Blob Storage using the AES-256-GCM server-side encryption key, which is validated to FIPS 140-2 Level 2.","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=oduz5k9ac8dkh1n0or3vmz","as_of":"2026-09-30"},{"topic":"encryption","question":"How does iManage protect data at rest using encryption in On-Premises Deployments?","answer":"iManage does not provide encryption for on-premises solutions as a productized feature; Customers are responsible for implementing their backend encryption solutions.","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=sxek40rf79q3356ain9bx","as_of":"2026-09-30"},{"topic":"encryption","question":"Is iManage email encrypted?","answer":"iManage uses Microsoft Outlook, which uses opportunistic Transport Layer Security (TLS) to encrypt the connection with a recipient’s email provider. However, with TLS, the message might no longer be encrypted after it reaches the recipient’s email provider. In other words, TLS encrypts the connection, not the message. When email is filed into iManage applications using the iManage mail filing system, the data in transit is encrypted with TLS v1.3. After the filing is complete, the email message is stored as an encrypted file, as described above.","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=f5m604j2r43mrdbh6cwsz","as_of":"2026-09-30"},{"topic":"penetration_testing","question":"Does iManage perform penetration testing?","answer":"iManage has annual application and network penetration testing performed by accredited third-party penetration testers (ioSENTRIX, a US-based cybersecurity consulting firm founded in 2017). Our Application Security team also performs ad-hoc application penetration testing as needed.","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=s2nghsp04o3qd1g4bs1a8y","as_of":"2026-09-30"},{"topic":"retention","question":"What is iManage’s policy for data retention after a Customer’s subscription ends or is terminated?","answer":"iManage provides a defined period during which Customer data is retained after subscription termination to facilitate data extraction: Retention Period: Customer data is retained for 90 days after the subscription expires or is terminated, providing sufficient time for data extraction. Post-Retention Deletion: After 90 days, the Customer’s account is disabled, and all Customer data is deleted within 90 days, except where retention is mandated by applicable law. Backup Copies: Data will persist in iManage backup copies for up to 90 days after removal or deletion. Reiteration of Data Destruction: As with our standard processes, data deletion involves removing it from the file system, returning storage to the thin-provisioning pool, and destroying the associated encryption keys. Customers may","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=ibr4ipprat9r4d651iw9y","as_of":"2026-09-30"},{"topic":"retention","question":"How are Customer data retention and return managed within the iManage Cloud?","answer":"Customer data management includes several safeguards and recovery options: Deletion Process: Authorized Customer users can delete files uploaded to the iManage Cloud. Deleted files are moved to a “Trash” folder, preventing immediate permanent loss and allowing Customer administrators to recover them. Backup and Journaling: If files are cleared from the Trash, they may be recoverable from system backups retained for 90 days. Additionally, our Journaling feature captures snapshots of file versions to help prevent accidental overwrites. Contractual Governance: Data retention and return after the subscription ends or is terminated are governed by the terms specified in the Cloud Services Agreement (CSA) or its equivalent.","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=ivruyvhto1muv1444lhsnf","as_of":"2026-09-30"},{"topic":"retention","question":"Who is responsible for records retention in the iManage Cloud, and what is the process?","answer":"Records retention within the iManage Cloud is a shared responsibility: Customer as Data Controller: Customers are responsible for the retention, modification, and disposal of records stored in the iManage Cloud. Service Provision: iManage stores Customer data as part of the subscribed cloud service and retains it until the Cloud Services Agreement expires. Optional Management Tools: For added convenience, iManage offers the optional iManage Records Manager product, which can help Customers manage records retention and disposal. Disaster Recovery Backups: iManage maintains backup copies of data for up to 90 days for disaster recovery purposes. Corporate Records Exception: Please note that the iManage Record Retention policy—part of our Privacy Information Management System (PIMS)—applies on","value":null,"regions":[],"source_url":"https://compliance.imanage.com/faq?s=viytpeu23jnhfkz2fb9k4","as_of":"2026-09-30"}],"security_profile":{"iso42001":null,"trains_on_customer_data":null,"data_residency_regions":[],"pen_test_cadence":"annual","as_of":"2026-09-30"},"regulations_url":"https://certreports.com/api/v1/vendors/imanage/regulations/{regulation}","subprocessors":[{"name":"Amazon Web Services, Inc.","domain":"amazon.com","purpose":"Data Center Provider (Closing Folders – data storage only)","location":"Australia, Canada, European Union, United Kingdom, and United States","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Beamer","domain":"getbeamer.com","purpose":"Customer Notifications and iHelp (Multiple iManage Cloud Services)","location":"United States","vendor_url":"https://certreports.com/vendors/beamer/security"},{"name":"Centersquare","domain":"centersquaredc.com","purpose":"Data Center Provider (Multiple iManage Cloud Services – data storage only)","location":"United States","vendor_url":null},{"name":"Digital Realty (UK) Limited","domain":"digitalrealty.com","purpose":"Data Center Provider (Multiple iManage Cloud Services – data storage only)","location":"United Kingdom","vendor_url":null},{"name":"iManage Canada Technologies ULC","domain":"imanage.com","purpose":"Customer Support and Operational Services (All iManage Cloud Services and Software)","location":"171 East Liberty Street, Suite 300 Toronto, ON M6K 3P6","vendor_url":"https://certreports.com/vendors/imanage/security"},{"name":"iManage EMEA Limited","domain":"imanage.com","purpose":"Customer Support and Operational Services (All iManage Cloud Services and Software)","location":"Suite 1, 3rd Floor, 11-12 St. James’s Square London, United Kingdom, SW1Y 4LB","vendor_url":"https://certreports.com/vendors/imanage/security"},{"name":"iManage LLC","domain":"imanage.com","purpose":"Customer Support and Operational Services(All iManage Cloud Services and Software)","location":"71 South Wacker Drive, 4th Floor Chicago, IL 60606","vendor_url":"https://certreports.com/vendors/imanage/security"},{"name":"MessageBird (Pusher)","domain":"bird.com","purpose":"Communications Integration Platform (Closing Folders)","location":" Netherlands","vendor_url":"https://certreports.com/vendors/bird/security"},{"name":"Microsoft Corporation","domain":"microsoft.com","purpose":"Microsoft 365 Apps and Services, (Multiple iManage Cloud Services)","location":"United States","vendor_url":"https://certreports.com/vendors/microsoft/security"},{"name":"MixPanel","domain":"mixpanel.com","purpose":"Visualization of User Analytics (Multiple iManage Cloud Services and Software)","location":"United States","vendor_url":"https://certreports.com/vendors/mixpanel/security"},{"name":"MongoDB, Inc.","domain":"mongodb.com","purpose":"Atlas Database (Multiple iManage Cloud Services and Software, including relevant integrations with Tracker, Power Automate, eSignature, MCP Server, and Insight+ Curation)","location":"United States","vendor_url":"https://certreports.com/vendors/mongodb/security"},{"name":"NetRight Singapore Holdings PTE Ltd.","domain":"imanage.com","purpose":"Customer Support and Operational Support(All iManage Cloud Services and Software)","location":"4 Battery Road, #25-01, Bank of China Building, Singapore 49908","vendor_url":"https://certreports.com/vendors/imanage/security"},{"name":"NetRight Spain Holdings S.L.","domain":"imanage.com","purpose":"Customer Support and Operational Services (All iManage Cloud Services and Software)","location":"Cl Tuset 23-25 P.1 08006 Barcelona","vendor_url":"https://certreports.com/vendors/imanage/security"},{"name":"NetRight Technologies Private Limited","domain":"imanage.com","purpose":"Customer Support and Operational Services(All iManage Cloud Services and Software)","location":"Infinix Pearl, 17/2, 2nd floor, Industrial Layout, Jakkasandra, 3rd Block Koramangala, Bangalore 560034","vendor_url":"https://certreports.com/vendors/imanage/security"},{"name":"NEXTDC Limited","domain":"nextdc.com","purpose":"Data Center Provider (Multiple iManage Cloud Services – data storage only)","location":"Australia","vendor_url":null},{"name":"Twilio (Segment, SendGrid)","domain":"twilio.com","purpose":"Cloud Communications, Email Service, User Analytics (Multiple iManage Cloud Services and Software)","location":"Segment: United States and European Union  SendGrid: Customer selected region ","vendor_url":"https://certreports.com/vendors/twilio/security"},{"name":"Zendesk, Inc.","domain":"zendesk.com","purpose":"Customer Support Tickets (Multiple iManage Cloud Services and Software)","location":"Unites States","vendor_url":"https://certreports.com/vendors/zendesk/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-02T19:19:18.101Z"}