Access governance for Databricks
Databricks scatters access across nested groups, service principals, and grants in every workspace. Mortar resolves who can really reach each catalog, schema, and table - and tells you when it changes. Answers that used to take days take seconds.
Invite-only during our design-partner program · No agents · EU-hosted
main.finance.salaries14 principalsWorks with the stack you already run
Why not just use what you have
The Account Console shows one workspace at a time. INFORMATION_SCHEMA shows one metastore. Neither expands nested groups. So the real answer lives in a spreadsheet someone rebuilds every quarter.
| Account Console | INFORMATION_SCHEMA | Spreadsheet export | Mortar | |
|---|---|---|---|---|
| Spans every workspace and account | ||||
| Resolves nested group membership | ||||
| Flags redundant & over-privileged grants | ||||
| Detects drift over time | ||||
| Answers on demand, in seconds |
Why we built this
Every team on Databricks eventually hits the same wall: nobody can answer “who can actually reach this table?” Grants nest through groups, span workspaces, and drift every week. Unity Catalog shows you one object at a time - it was never meant to give you the estate-wide, resolved answer an auditor actually asks for.
And a platform can't credibly audit itself. Access governance is a control, and a control has to be independent of the thing it's checking. That's the gap Mortar fills: an outside lens that resolves effective access across every group path, watches it for drift, and judges what's dangerous - without ever holding god-mode over your estate.
So we built it the way a security team would want it built. The scanner is read-only by construction. Every change executes under a real person's identity, never a shared service principal. The aim is trust you can verify from your own logs - not trust you're asked to extend.
Independent by design - because the tool that grades your access shouldn't be the one that grants it.
How it works
Point Mortar at Databricks with a read-only service principal. No agents, nothing to deploy in your cloud.
Mortar resolves every grant, group, and principal across your workspaces and accounts in minutes.
See effective access, get alerted on drift, prove compliance, and expire access automatically.
What you get
Who can really reach every catalog, schema, and table - through nested groups and service principals, across every workspace and account. One map, not a quarter of spreadsheet archaeology.
Snapshot and diff every membership and permission change, attribute it to who made it (with a SQL warehouse connected), and post it to Slack - before it becomes an audit finding.
Policy-as-code over your real grants. Certification campaigns with audit-ready PDF evidence. A clean, queryable audit trail your assessor can actually use.
Time-boxed, just-in-time access approved in one click and revoked automatically - so standing over-permission stops piling up between reviews.
Always on
Mortar scores your access posture on every scan and trends it over time, so over-permissioning and drift show up as a falling line - not as a surprise in your next audit.
Where teams use it
Run quarterly Unity Catalog reviews without the spreadsheet. Certify or revoke per group, with signed evidence the reviewer's name lands on.
See everything a departing employee can still reach across every workspace before you offboard them - and compare a new hire against a peer to spot exactly what they're missing, or shouldn't have.
SOC 2, HIPAA, PCI: prove who had access to what, and when. Turn the access-control evidence request into a one-click export.
Built to be trusted
Every tool that can fix access holds a powerful credential over the estate it audits - and becomes the richest target in it. Mortar is architected so that's structurally impossible, and you can verify each claim from your own tenant.
The identity that scans your estate cannot write - Mortar's write path won't accept its token at all. Structural, not a permission setting.
Approvals execute under the approver's own Databricks identity by default. An optional executor (off unless you enable it) acts only for verified group managers - every use attributed to the human and counted on the trust page.
Grant structure and membership - never the contents of your tables. Hosted in Frankfurt; credentials encrypted at rest and revocable by you at any time.
A tamper-evident audit trail with one-click integrity verification, and an in-product trust page that proves all of this from your own data.
Running a vendor security review? Read the security overview → or request the full pack.
Why work with us now
A platform vendor can't give any one team roadmap influence. We can. Design partners don't buy finished software - they shape it.
We build against your real access-review workflow, not a queue behind a thousand enterprise tickets.
Something missing for how your team governs Databricks? That is the conversation we want, and the reason to start early.
White-glove onboarding and hands-on help wiring Mortar into your estate, from the people who built it.
A fixed-price, one-week access audit of your Databricks estate - independent evidence and reviewer sign-off, read-only. $2,500, and the fee credits toward year one if you go on to a subscription.
Pricing
No feature ladder, no per-seat math, no workspace caps. The 14-day trial is the full product.
Founding price, locked three years · unlimited workspaces
14-day full-product trial once you're in
Once the founding seats are full, or for regulated & multi-account estates
Pricing scoped to your estate
Questions
Discovery is read-only, through a service principal that structurally cannot write. The only writes are access changes you explicitly approve - by default they execute under the approver's own identity, so your Databricks audit log names the person. An optional executor service principal (off by default) can act for verified group managers; every use is attributed to the approving human and counted on the in-product trust page.
A read-only service principal for scanning - account and workspace SCIM plus Unity Catalog reads. An optional SQL warehouse unlocks usage and lineage features (last-used grants, drift attribution).
Azure, AWS, and GCP Databricks. The engine is developed and live-tested against Azure Databricks with Unity Catalog.
Mortar is hosted in the EU (Frankfurt) and stores access metadata - groups, grants, principals - not the contents of your tables. The Databricks credentials you connect are encrypted at rest, and you can rotate or revoke them at any time.
No. There are no agents and nothing to install in your environment. Mortar reads the Databricks REST APIs and system tables you already have.
Those show one workspace or metastore at a time and don't expand nested group membership. Mortar resolves effective access across your whole account, flags over-permissioning, and watches it for drift.
We're onboarding a handful of design partners on Databricks Unity Catalog. Request access and we'll get you connected.