Organisation hierarchy
Group workspaces by business unit or region, apply policy at any level, and let a domain owner administer their own branch without seeing the rest.
Northlane for enterprise
Governed data operations at 40,000 tables and 900 engineers
Single-tenant deployment, your own KMS keys, SCIM-driven access and an audit stream your risk team can query. Enterprise rollouts land in a scheduled window, not a support ticket.
- Single-tenant VPC
- SOC 2 Type II · ISO 27001
- 99.99% uptime SLA
- Named solutions architect
app.northlane.io/org/policy
Running inside regulated estates
- Halden Bank
- Verity Health
- Northwind Freight
- Copperline Energy
- Meridian Rail
- Ferro Group
- Arcadia Care
- Lumen Retail
Enterprise controls
The controls your review board asks for, already in production
Everything below runs today on Enterprise workspaces. Each control maps to a SOC 2 criterion and to a clause in the security addendum attached to your order form.
Isolation and residency
Provisioned per organisation at contract start. The region is fixed for the life of the workspace.
Single-tenant deployment
A dedicated VPC, dedicated warehouse credentials and a dedicated metadata store. No customer shares a compute node at query time.
Customer-managed keys
Bring your own KMS key. Revoking it halts processing within 60 seconds and leaves stored metadata unreadable.
Regional pinning
Pin the organisation to eu-west-1, eu-central-1, us-east-1 or ap-southeast-2. Neither metadata nor derived lineage crosses that boundary.
Identity, audit and evidence
Enforced across the whole organisation once your identity provider is connected, not workspace by workspace.
SAML and SCIM
Any SAML 2.0 or OIDC provider with SCIM 2.0 push. A leaver in your directory loses Northlane access inside 60 seconds.
Audit stream to your SIEM
Every read, permission change and export, retained 400 days and streamed to Splunk, Chronicle or an S3 bucket you own.
Evidence on request
SOC 2 Type II report, ISO 27001 certificate, penetration test summary and the sub-processor register, released under NDA.
Descriptions summarise the Enterprise production environment as of this quarter. The SOC 2 Type II report and the security addendum on your order form are the governing documents; nothing on this page amends a signed agreement.
Administration and scale
Run two hundred teams on one control plane without a spreadsheet of exceptions
Policy applies at the organisation level, ownership is delegated down, and quotas stop one backfill from starving everybody else.
Delegated administration
Nine built-in roles plus custom roles scoped to a workspace, a project or a single column. Every grant is approved, signed and retained.
Quotas and cost guardrails
Per-team warehouse credit budgets with hard stops. A runaway backfill is queued and flagged to its owner rather than billed.
Change management
Policy edits go through review, land in the audit stream, and can be rolled back to any state in the last 400 days.
Enterprise
Private networking
PrivateLink, VPC peering or an IP-allowlisted egress gateway. Your warehouse never needs a public endpoint.
Migration tooling
Import existing dbt projects, Airflow DAGs and third-party monitors, then run both systems side by side until you sign off the cutover.
See the migration guide
See the full capability list
Every capability above is included in the Enterprise licence — none of it is a paid add-on.
Deployment
Three ways to run it, one way to govern it
Every deployment model shares the same control plane, the same policy engine and the same audit stream. What changes is where the metadata store sits and who holds the keys — so procurement and platform can pick independently of the feature set.
- Northlane Cloud Multi-tenant, region-pinned, provisioned in an afternoon. Schema and object-storage isolation per tenant, enforced at the connection layer.
- Single-tenant A dedicated VPC in the region you choose, with your own KMS key and a maintenance window you approve before every upgrade.
- Your own account Northlane deployed into your AWS or Azure subscription via Terraform. Metadata never leaves your network boundary.
Enterprise rollouts, last twelve months
- 34 days Contract to first governed pipeline Median across 26 enterprise rollouts, two of them single-tenant builds.
- 0 Downtime windows required Connection changes and platform upgrades land without pausing pipelines.
- 99.99% Contractual uptime, met every quarter since 2023 Measured on the control-plane API and the alerting path, published monthly.
Business or Enterprise
What actually changes when you move up
Everything in Business carries over. The rows below are the only differences, and most of them are about isolation, identity and the commercial terms rather than features.
| Capability | Business $549 / month, billed annually Compare all plans | 500+ seats Enterprise Annual, volume-tiered Talk to sales |
|---|---|---|
| Isolation and residency | ||
| Deployment model | Multi-tenant cloud | Single-tenant VPC or your own account |
| Data residency | Limited US and EU regions only | Included |
| Customer-managed encryption keys Bring your own KMS key | Not included | Included |
| Private networking PrivateLink, VPC peering or an egress gateway | Limited By request | Included |
| Identity and governance | ||
| SSO (SAML 2.0, OIDC) | Included | Included |
| SCIM provisioning | Not included | Included |
| Custom roles and column-level policy | Limited Workspace scope only | Included |
| Audit log export The 400-day retention window is fixed on both plans and cannot be shortened | In-app export | Streamed to your SIEM Splunk, Chronicle or an S3 bucket you own; archive length negotiable |
| Organisation hierarchy and delegated admin | Not included | Included |
| Support and commercial terms | ||
| First-response SLA | 4 hours | 1 hour, 24/7 |
| Named solutions architect | Not included | Included |
| Uptime commitment | 99.9% | 99.99% With service credits |
| Security review support | Limited Standard questionnaire only | Included Custom questionnaires and review calls |
| Contracting | Standard order form | Negotiated MSA and DPA |
Business
$549 / month, billed annually
Isolation and residency
- Deployment model
- Multi-tenant cloud
- Data residency
- Limited US and EU regions only
- Customer-managed encryption keys Bring your own KMS key
- Not included
- Private networking PrivateLink, VPC peering or an egress gateway
- Limited By request
Identity and governance
- SSO (SAML 2.0, OIDC)
- Included
- SCIM provisioning
- Not included
- Custom roles and column-level policy
- Limited Workspace scope only
- Audit log export The 400-day retention window is fixed on both plans and cannot be shortened
- In-app export
- Organisation hierarchy and delegated admin
- Not included
Support and commercial terms
- First-response SLA
- 4 hours
- Named solutions architect
- Not included
- Uptime commitment
- 99.9%
- Security review support
- Limited Standard questionnaire only
- Contracting
- Standard order form
Enterprise
500+ seatsAnnual, volume-tiered
Isolation and residency
- Deployment model
- Single-tenant VPC or your own account
- Data residency
- Included
- Customer-managed encryption keys Bring your own KMS key
- Included
- Private networking PrivateLink, VPC peering or an egress gateway
- Included
Identity and governance
- SSO (SAML 2.0, OIDC)
- Included
- SCIM provisioning
- Included
- Custom roles and column-level policy
- Included
- Audit log export The 400-day retention window is fixed on both plans and cannot be shortened
- Streamed to your SIEM Splunk, Chronicle or an S3 bucket you own; archive length negotiable
- Organisation hierarchy and delegated admin
- Included
Support and commercial terms
- First-response SLA
- 1 hour, 24/7
- Named solutions architect
- Included
- Uptime commitment
- 99.99% With service credits
- Security review support
- Included Custom questionnaires and review calls
- Contracting
- Negotiated MSA and DPA
A half-filled mark means the capability is available with a limit. The note under the mark says what the limit is.
Enterprise proof
Three regulated estates, migrated without a freeze window
Each rollout below crossed at least two regions and a formal security review. The numbers are the customer's own, measured 90 days after cutover.
Halden Bank
40,000 tables under policy
Banking 9,400 employees
Eleven regional warehouses moved onto one policy engine in a single-tenant deployment, with the regulator briefed before the first sync ran.
- 40,000 tables under column-level policy
- 11 to 1 governance tools consolidated
- 6 weeks contract to production
Healthcare 18,000 employees
PHI pinned to three regions
Residency rules that used to live in a spreadsheet are now enforced by the platform, with an audit stream the compliance office queries directly.
Verity Health
Read the story about Verity Health
Logistics 6,200 employees
$1.9m warehouse spend recovered
Per-team credit budgets replaced a quarterly cost review, and the finance team stopped chasing owners for unattributed compute.
Northwind Freight
Read the story about Northwind Freight
Contact sales
Bring us your security questionnaire and your migration deadline
Enterprise conversations start with an architecture review, not a pitch. Send the warehouses in scope, the regions you need and the date your review board meets. You get back a deployment plan, a written migration estimate and the evidence pack.
First reply in under 4 business hours
Tell us what you are running
Warehouses, regions, headcount and the deadline. That is enough for us to scope it properly.
We use these details to answer your request. No sequences, no resale.
Or reach the team directly
- Enterprise sales enterprise@northlane.io
- Security review Request the evidence pack
- Existing customers Your named architect, or support@northlane.io