Is this your company? Buyers are checking iManage LLC here. Claim imanage.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
iManage LLC
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
iManage LLC is SOC 2 Type II compliant. iManage LLC also holds ISO 27001, ISO 27701, ISO 27017, ISO 27018, and CSA STAR.
About
iManage is a comprehensive document and email management platform/document management system which is tailored for legal firms and professional business in mind. It offers a centralised repository for storing, organising, and accessing critical documents, contracts, and communications.
Compliance & infrastructure
Hosting
AWSAzure
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health informationCustomer Defined
Subprocessors
17- AAmazon Web Services, Inc. · Data Center Provider (Closing Folders – data storage only – no access to data)Australia, Canada, European Union, United Kingdom, and United States
- CCentersquare · Data Center Provider (Multiple iManage Cloud Services – data storage only – no aUnited States and United Kingdom
- NNEXTDC Limited · Data Center Provider (Multiple iManage Cloud Services – data storage only – no aAustralia
- iiManage Canada Technologies ULC · Customer Support (All iManage Cloud Services and Software)171 East Liberty Street, Suite 300 Toronto, ON M6K 3P6
- iiManage EMEA Limited · Customer Support (All iManage Cloud Services and Software)Suite 1, 3rd Floor, 11-12 St. James’s Square London, United Kingdom, SW1Y 4LB
- iiManage LLC · Customer Support (All iManage Cloud Services and Software)71 South Wacker Drive, 4th Floor Chicago, IL 60606
- NNetRight Singapore Holdings PTE Ltd. · Customer Support (All iManage Cloud Services and Software)4 Battery Road, #25-01, Bank of China Building, Singapore 49908
- AAmazon Web Services, Inc. (Bedrock) · Advanced Signature Detection (Closing Folders)See the Data Processing table in the description.
- NNetRight Spain Holdings S.L. · Customer Support (All iManage Cloud Services and Software)Cl Tuset 23-25 P.1 08006 Barcelona
- NNetRight Technologies Private Limited · Customer Support (All iManage Cloud Services and Software)Infinix Pearl, 17/2, 2nd floor, Industrial Layout, Jakkasandra, 3rd Block Koramangala, Bangalore 560034
- BBeamer · Customer Notifications (Multiple iManage Cloud Services)United States
- MMessageBird (Pusher) · Communications Integration Platform (Closing Folders)Netherlands
Show all 17 subprocessorsShow fewer
- MMicrosoft Corporation · Microsoft 365 Apps and Services, (Multiple iManage Cloud Services), Document IntCustomer Chosen Region
- MMixPanel · Visualization of User Analytics (Multiple iManage Cloud Services and Software)European Union
- MMongoDB, Inc. · (Multiple iManage Cloud Services and Software, including relevant integrations wUnited States
- TTwilio (Segment, SendGrid) · Cloud Communications, Email Service, User Analytics (Multiple iManage Cloud ServSegment: United States and European Union SendGrid: Customer chosen hosting region
- ZZendesk, Inc. · Customer Support Tickets (Multiple iManage Cloud Services and Software)Unites States
Compliance leadership
The person who leads iManage LLC's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. iManage LLC's penetration test vendor isn't listed yet.
Claim this profile to add it.
Recent updates
Claude Mythos Cybersecurity AI StatusJun 2026
A recently publicized AI-driven cyber threat known as Claude Mythos has received significant attention in the cybersecurity community, and we have been actively monitoring developments. At this time, we have identified no exposure to the reported attack vectors associated with Claude Mythos. iManage is actively tracking developments related to Claude Mythos and incorporates this monitoring into our broader security program. Our approach includes, but is not limited to, the following: _Proactive Threat Detection_ We monitor emerging threats and vulnerabilities through dedicated threat intelligence sources and automated security monitoring. Critical and high-severity issues are promptly reviewed and escalated to the appropriate engineering and security teams for assessment. _Regular Security Testing_ _We conduct regular penetration testing of our applications and infrastructure and maintain a private bug bounty program to support ongoing vulnerability identification and responsible disclosure. _Structured Remediation_ When security issues are identified through automated scanning, penetration testing, threat intelligence, or external reporting, our security and engineering teams collaborate to assess, prioritize, and remediate them according to established severity-based response timelines. Remediation activities undergo validation before closure. _Continuous Improvement_ We…
The updated Security Policy Manager Pen Test Q1-2025 - Executive Summary v1.3 report is now available.Dec 2025
The Security Policy Manager Application Penetration Test Executive Summary Report has been updated to v1.3 and is now available in the Resources section.
React2Shell Vulnerability (CVE-2025-55182) StatusDec 2025
A high-profile vulnerability, React2Shell (CVE-2025-55182), has been in the news recently, and we have been monitoring it. Based on our investigation, none of our products is vulnerable. - iManage does not use React server-components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) versions 19.0, 19.1.0, 19.1.1, or 19.2.0. - iManage does not use Next.js versions 15.x or 16.x. https://nvd.nist.gov/vuln/detail/CVE-2025-55182
The Share Pen Test Q1-2025 Application Penetration Test Executive Summary Report is now available.Dec 2025
The Share Q1-2025 Application Penetration Test Executive Summary Report is now available in the Resources section.
The updated Business Continuity Management Policy is now available.Oct 2025
The Business Continuity Management Policy has been updated to version 4 and is now available on the Resources page under the Business Continuity section.
This listing is partial
6/11 details · 55%SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is iManage LLC SOC 2 compliant?
iManage LLC is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is iManage LLC ISO 27001 certified?
According to iManage LLC's public trust center, iManage LLC is ISO 27001 certified. On SOC2C this listing is Listed.
Is iManage LLC ISO 27701 certified?
According to iManage LLC's public trust center, iManage LLC is ISO 27701 certified. On SOC2C this listing is Listed.
Is iManage LLC ISO 27017 certified?
According to iManage LLC's public trust center, iManage LLC is ISO 27017 certified. On SOC2C this listing is Listed.
Is iManage LLC ISO 27018 certified?
According to iManage LLC's public trust center, iManage LLC is ISO 27018 certified. On SOC2C this listing is Listed.
Is iManage LLC CSA STAR certified?
According to iManage LLC's public trust center, iManage LLC is CSA STAR certified. On SOC2C this listing is Listed.
Is iManage LLC SOC 2 Type I or Type II?
iManage LLC is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use iManage LLC's SOC 2 for a vendor risk assessment?
Yes. iManage LLC's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is iManage LLC penetration tested?
iManage LLC hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is iManage LLC secure?
Security isn't a single yes/no, but iManage LLC is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 27018, CSA STAR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does iManage LLC have a bug bounty or vulnerability disclosure program?
iManage LLC hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@imanage.com or via a /security page (iManage LLC lists a security contact).
Who are iManage LLC's subprocessors?
iManage LLC lists 17 subprocessors on its trust center, including Amazon Web Services, Inc., Centersquare, NEXTDC Limited, iManage Canada Technologies ULC, iManage EMEA Limited. Buyers use this for fourth-party risk review.
Where does iManage LLC host or store data?
iManage LLC hosts on AWS, Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.
Where is iManage LLC's trust center or security page?
iManage LLC's trust center is at https://compliance.imanage.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
What Standards and compliance framework does iManage operate under, and what certifications have been achieved?
iManage has implemented a robust security and compliance program based on the ISO framework that supports a wide array of international regulations and standards. Our certifications and Audit reports include: - ISO Certifications: ISO 27001, ISO 27017, ISO 27018, ISO 27701, and ISO 22301 - CSA STAR Level 2 (Gold Level) Certification - SOC Reports: SOC 2 Type 2 (covering all Trust Principles: Security, Availability, Confidentiality, Integrity, and Privacy), SOC 2+ (which incorporates select NIST SP 800-171 controls), and SOC 3 Our Information Security Management System (ISMS) is based on ISO 27001:2022 and is designed to implement and maintain comprehensive administrative, technical, and process controls to mitigate security and privacy risks to Customer data and our information assets. Our Business Continuity Management system is based on and certified to ISO 22301:2019. Copies of our ISO and CSA STAR certifications, SOC 2 Report, and ISO 27001 Statement of Applicability (SoA) are available on the Resources page under Certifications and SOC 2 Report.
Does iManage have a Privacy Program?
Yes, the iManage Privacy Information Management System (PIMS) is modeled on the "Generally Accepted Privacy Principles" (GAPP) published by the AICPA and the Chartered Professional Accountants of Canada. The program is implemented companywide and efficiently organizes our privacy policies and procedures. Key aspects include: Privacy Certifications: Our Cloud services are audited and certified to ISO 27018:2019 and ISO 27701:2019, and they meet the SOC 2 trust service principles for confidentiality and privacy. Security and Business Continuity: In addition to privacy standards, our Cloud services adhere to ISO 27001/27002 and ISO 27017:2015, and are SOC 2 audited. Moreover, all ISO 27xxx-scoped systems are ISO 22301:2019 certified for Business Continuity. Regulatory Compliance: iManage ensures compliance with a broad spectrum of regulatory requirements, including but not limited to APEC Privacy Recognition for Processors (APEC PRP), the Australia Privacy Act 1988 and the Australian Privacy Principles, Brazil’s LGPD, CCPA/CPRA, Canada’s PIPEDA, the EU GDPR, HIPAA, Singapore’s Personal Data Protection Act, Switzerland’s Federal Act on Data Protection, UK GDPR, and the Virginia Consumer Data Protection Act. For privacy-specific inquiries, please email privacy@imanage.com. Our External Privacy Policy is available here. Copies of Privacy Program documentation are available on the Resources page under Data Privacy.
Can iManage's SOC 2 report, or other Confidential documents, be shared with third parties?
All Confidential information, such as SOC 2 reports or Penetration Test Executive Summary reports, requires an NDA to be in place before it can be shared with a third party. For existing Customers, confidentiality language will be covered under your current contract (the Cloud Services Agreement or the Software License Agreement). Customers may present Confidential information during meetings or audits; however, the receiving party must not record or retain any copies of the Confidential information. If disclosure to a third party is required, an NDA with iManage is necessary. An NDA with iManage can be completed using our automated process at https://ironcladapp.com/public-launch/659c1ec2a03c98a303b362c. Our ISO and CSA STAR certifications, as well as our Data Sheets, are public documents and may be shared freely.
Does iManage produce a SOC 1 (ISAE 3402) or SAS 70 report?
No, iManage is a management-owned LLC and does not produce a SOC 1 (ISAE 3402) report on organizational controls affecting our enterprise’s financial statements. Our financial auditor is Grant Thornton.
What is the iManage Cloud Trust Center, and how do I access it?
The iManage Cloud Trust Center provides improved visibility into the status of the services within your iManage Cloud production account. Registered iManage Customers can view their account status via the iManage Help Center. For further details, please refer to the Introduction Page: Service Update – iManage Cloud Trust Center. Registered iManage Help Center users may access the Trust Center at https://cloudimanage-global.statushub.io/.
Is there a compliance program or set of policies and procedures that address internal and external Fraud Detection and Fraud Prevention?
iManage does not process financial transactions as part of the scoped services. Internal accounting practices and external audits are in place to address financial fraud against iManage corporate accounts.
What are iManage’s regulatory compliance obligations?
iManage’s regulatory compliance obligations are defined within the Cloud Services Agreement (CSA). iManage complies with all applicable laws and regulations in every location where our services are provided. However, Customers are responsible for ensuring that their use of cloud services adheres to any additional laws or regulatory obligations specific to their industry or data. iManage does not determine whether data stored in our cloud is subject to other specific legal requirements.
What is iManage’s approach to Environmental, Social, and Corporate Governance (ESG)?
iManage has established a formal ESG program, which is led by the CFO, Chief People Officer (CPO), and General Counsel (GC). This program addresses global challenges through a focused framework and includes initiatives to monitor and reduce environmental impact (e.g., water consumption, paper and electronics recycling). For comprehensive details, please consult the iManage ESG Report 2024, available for download via the iManage Compliance Portal at https://compliance.imanage.com or through our homepage at https://imanage.com.
Does iManage have a policy on Modern Slavery?
In response to the Modern Slavery Act 2015, iManage has issued a modern slavery statement, which can be found here: https://imanage.com/about/slavery-and-human-trafficking/.
How does iManage address Diversity, Equity, and Inclusion (DEI)?
iManage is committed to fostering an inclusive environment, as detailed in our Diversity, Equity & Inclusion vision and strategy report. This report can be accessed and downloaded from the iManage Compliance Portal at https://compliance.imanage.com or via our homepage at https://imanage.com.
What types of insurance coverage does iManage maintain?
iManage maintains industry-standard insurance coverage, including: - Commercial General Liability - Automobile Liability - Umbrella Liability - Workers' Compensation and Employers' Liability - Cyber/Errors & Omissions (E&O) coverage, which includes Tech E&O, Network Security, Privacy Liability, Privacy Regulatory, Event Response Costs, Network Business Interruption, and Data Restoration, among others. A Certificate of Insurance (COI) is available for review on the Resources Page under Insurance.
How does iManage handle security or privacy incidents?
iManage notifies impacted Customers as soon as an issue is identified or suspected and no later than 48 hours after confirmation of an incident. iManage also collaborates with Customers to contain, assess, and remediate the issue. Updates are also provided at appropriate intervals, and forensic data is made available if warranted.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public