The system of record for how data changes in regulated enterprises

    The system of trust for data transformations

    Guarantee data integrity and auditability across every pipeline.

    Predictive mapping proposed by our Semantic Match Engine, approved by named SMEs, and recorded in a ULID‑keyed, SHA‑256 hash‑chained ledger — built for regulators in healthcare, life sciences, and federal.

    Problem

    87% of AI projects never ship in regulated industries — the mapping beneath is an unsigned decision.

    Magellan's fix

    Every mapping signed, version‑pinned, and chained — audit prep becomes a deterministic export.

    Semantic Match Engine
    hr_v3.2.0 → workforce_v1.4.0
    Ready
    employee_idstaffIdentifier99%
    hire_datestartDate97%
    department_codedivisionCode94%
    job_titlepositionTitle92%
    salary_amountcompensation.base88%
    Matching 0 of 5 fields…
    Audit & Trust Ledger
    SHA‑256 · ULID
    1. 01JQ8X4N2K…draft.createl.cahlander
    2. 01JQ8X4P9R…match.proposesemantic-engine
    3. 01JQ8X4QM2…review.signs.patel · SME
    4. 01JQ8X4S8V…publish v1.4.0a.nguyen · steward
    Building hash chain…

    We say predictive mapping — not "AI‑powered."

    Our Semantic Match Engine proposes candidate mappings. A named SME approves them with an electronic signature. Every decision lands in a tamper‑evident ledger. That distinction is why regulators, auditors, and review boards trust the output.

    Why this matters

    Plain‑language: why provenance, lineage, and audit trails matter

    Every important decision an organization makes — a diagnosis, a payment, a hire, a forecast, a regulatory filing — is built on data that traveled through many hands and many systems before it got there. Magellan exists so that journey is never a mystery.

    Data provenance

    Where did this number come from?

    When a board sees a revenue figure, a doctor sees a lab result, or a regulator sees a risk score, somebody has to be able to point at the original source. Without provenance, you're trusting a number nobody can vouch for.

    Data lineage

    What happened to it on the way here?

    Data is rarely used the way it was captured. It gets joined, filtered, renamed, rounded, and reshaped across dozens of systems. Lineage is the receipt for every one of those steps — so a wrong answer can be traced back to the exact transformation that broke it.

    Audit trail

    Who changed what, when, and why?

    Mappings and rules change constantly. An audit trail turns those changes from tribal knowledge ("ask Dave, he set that up in 2019") into a permanent, tamper‑evident record that holds up in front of an auditor, a regulator, or a judge.

    Tamper‑evident ledger

    Can anyone quietly rewrite the history?

    A log you can edit isn't evidence — it's a suggestion. A hash‑chained ledger means any attempt to alter past records breaks the chain and is instantly detectable. That's the difference between "we think this is what happened" and "we can prove this is what happened."

    Role‑separated governance

    Did the right people sign off?

    The person who proposes a mapping shouldn't be the same person who approves it, and neither should be able to silently overwrite the audit record. Separation of duties is how regulated industries prevent both honest mistakes and quiet fraud.

    Why it matters

    What goes wrong without it?

    Failed audits. HIPAA fines up to $1.5M per violation category. SOX restatements. Months of forensic work to answer a single GDPR erasure request. AI models trained on data nobody can explain. Every one of these starts the same way: nobody could prove where the data came from or what was done to it.

    The bottom line: Spreadsheets, tribal knowledge, and ETL scripts can move data around. They can't prove what happened. Magellan turns every mapping decision and every transformation into a ULID‑keyed, hash‑chained record — so when somebody asks "how do you know?", the answer takes seconds, not weeks.

    See it in action

    A tamper‑evident ledger you can try right now

    Try editing a past entry. The SHA‑256 chain breaks and every downstream block lights up red.

    Live Demo

    Verify the chain in your browser

    Four sample ledger entries, hashed with SHA‑256 in the Web Crypto API. Toggle a row to tamper with its content and watch every downstream hash fail.

    Computing SHA‑256…

      Hashes computed with crypto.subtle.digest("SHA-256") · chain link = SHA‑256(ulid|ts|actor|role|action|prevHash)

      Transformation debt

      Every undocumented mapping is a payment you have not made yet

      Technical debt usually means old code. In data work it means something narrower and more expensive: transformation logic that exists only as a script and a memory. It does not show up in a dependency report. It shows up the day a source schema changes and nobody can say which of the last four mappings was the right one — or who decided.

      The re-mapping tax

      Every new target system re-opens every past mapping decision. A source schema that has been remapped four times is four sets of choices nobody can reconstruct, and the fifth target pays for all of them. Mappings pin the exact source and target schema versions they were built against, so a decision made once stays valid — and a decision that has to change is recorded as a change, not a silent edit.

      Logic you cannot find

      Transformation logic normally lives in scripts, stored procedures, and the memory of whoever wrote it. When that person leaves, the only way to learn what a field means is to reverse-engineer it from output. In Magellan the mapping is the artifact: versioned, diffable, and readable without running anything.

      Drift nobody noticed

      A column changes meaning, a code set gains a value, a unit shifts from pounds to kilograms. Nothing fails loudly, so the mapping quietly keeps producing plausible numbers. Because every version carries a ULID and a recorded decision, drift becomes something you can ask a question about instead of something you discover in an incident review.

      What it turns into

      Debt is the cost. A trustworthy history is the return.

      Stopping the accumulation is only half of it. The other half is that the decisions you already made become evidence — attributable to a named person, pinned to the exact schema versions in force, and reproducible years later after both schemas have moved on. Each entry is ULID-keyed and SHA-256 hash-chained, so altering a past record breaks the chain. That is what makes the record usable to somebody who has to sign something: HIPAA §164.312(b), 21 CFR Part 11 §11.10(e), or the CMMC L2 §3.3 AU-family controls.

      Without a governed record

      • Mapping logic in scripts and spreadsheets, owned by whoever wrote it
      • Approval asserted in an email thread or a wiki page
      • Rejections and overrides discarded, so the record shows only the winner
      • History stored in a table your own team can edit
      • Proving a past decision takes weeks of forensic work

      With a versioned, hash-chained record

      • Mapping is a versioned artifact, pinned to the exact schema versions it used
      • Approval is an entry in the ledger, signed under a named role
      • Rejections are kept with their reasons, so judgment is visible
      • History is hash-chained and sealed to WORM storage with fixed retention
      • Proving a past decision is running one verifier script

      The order is not decorative. Every schema version a mapping pins must be Approved & Published before that mapping version can enter approval — so the sequence itself is part of the evidence, not a process someone promises to follow.

      Hold the thing itself

      A sample evidence pack, with nothing held back

      Eleven ledger entries covering one mapping version from spreadsheet import to published and sealed record: both schema approvals, the Semantic Match Engine's suggestions, the three rejected links with their reasons, the release signature, and the WORM seal. The tenants, people, and identifiers are synthetic. The cryptography is not — every hash was computed from the payloads printed in the pack, and the verifier re-derives them without Magellan running.

      Run it yourself

      $ python3 verify_chain.py \
          magellan_sample_evidence_pack.json
      
      [PASS] #01 SchemaIngested ... [PASS] #11 WormHeadFlushed
      [PASS] partition last_hash == final entry
      [PASS] WORM head == recomputed chain head
      
      RESULT: CHAIN INTACT

      Standard library only — no API keys, no network, no database. Run it with --tamper and it changes one character inside one payload, then reports the chain broken from that entry onward.

      Metadata as Code

      Mappings are first‑class, versioned assets — not buried in ETL scripts.

      Magellan treats every schema, mapping, and decision as code: ULID‑keyed, semantically versioned, peer‑reviewed, and committed to a tamper‑evident ledger. The same artifact that runs your transformations also satisfies your auditors.

      Mapping Spreadsheetcustomer_onboarding.xlsx
      Source Schema — HRISv1.0.0
      Customer Onboarding Source Schema — HRIS
      Source Schema — CRMv1.0.0
      Customer Onboarding Source Schema — CRM
      Mappingv1.0.0
      Customer Onboarding
      Target Schemav1.0.0
      Customer Onboarding Target Schema
      One spreadsheet import projects a versioned mapping together with the source schema(s) and target schema(s) it references — atomically. A mapping can reference more than one schema on either side. At the moment of import, every artifact is stamped with the same version (v1.0.0 on first import). After import, schemas and the mapping version independently — the mapping pins the specific schema versions it was authored against.

      Versioned by design

      Schemas and mappings share a single semantic version at import. Every change is diffable, reviewable, and reversible.

      Part 11, HIPAA & CMMC ready

      Electronic signatures, role‑separated approvals, and SHA‑256 hash‑chained audit trails — one Audit & Trust Ledger that satisfies 21 CFR Part 11 §11.10(e), HIPAA §164.312(b), and CMMC L2 §3.3 AU‑2/AU‑3/AU‑9/AU‑11 in FedRAMP moderate environments.

      Auditor‑grade evidence

      Every mapping decision is signed, timestamped, and chained. Reproduce any prior state on demand — no spreadsheets, no tribal knowledge.

      See It In Action

      Watch the Highlight Reel

      A quick look at how Magellan transforms metadata management — featuring our Semantic Match API with live confidence scoring.

      The Control Layer

      Every control an auditor will ask for

      Magellan is the audit‑ready mapping and metadata control layer — every schema ingested, every mapping decision, and every transformation written to a ULID‑keyed, hash‑chained Audit & Trust Ledger with role‑separated governance built for HIPAA §164.312(b), 21 CFR Part 11, and CMMC L2 §3.3 AU‑family controls (AU‑2, AU‑3, AU‑9, AU‑11).

      1

      Import & Discover

      Bring in any schema, from any source

      2

      Map & Transform

      Shape your data from source to target

      Source‑to‑Target Mapping

      Every draft, edit, and field‑level change writes MappingDrafted or MappingRevised to the ledger — including the actor's role at the moment of the action. There is no silent overwrite, no lost authorship, no after‑the‑fact reconstruction.

      Predictive Mapping

      Every Semantic Match suggestion is replayable from the ledger. SemanticSuggestionReturned and SemanticSuggestionAccepted entries record the model identifier, threshold profile version, confidence, and accepting actor — enough to reconstruct any decision under HIPAA §164.312(b), 21 CFR Part 11 §11.10(e), and CMMC L2 §3.3 AU‑3 (Content of Audit Records).

      Entity Enrichment

      Annotations are first‑class versioned properties of the MetaModel. Every enrichment writes EntityAnnotated to the ledger, so the parent‑context, abbreviation, and domain vocabulary that a Semantic Match suggestion depended on can be replayed exactly as it was at the moment of decision.

      Visual Rules for Targets

      Every rule definition and edit writes RuleDefined or RuleRevised to the ledger. Because the rule lives next to the mapping it governs, an auditor can reproduce the exact transformation logic that was active at any historical point.

      Impact Analysis

      Impact reports are derived from the same hash‑chained ledger that drives lineage. Every report writes an ImpactAnalysisRun entry pinned to the ledger ULID it was computed against — so a stakeholder review is reproducible months later.

      Service Integration

      Every push or pull through a web service writes ArtifactExported or ArtifactImported to the ledger, stamped with the source ULID. ETL platforms downstream can prove which Magellan version their generated code was derived from.

      3

      Visualize & Explore

      See your data from every angle

      4

      Govern & Integrate

      Control, trust, and automate your data

      Data Provenance

      Provenance is the audit ledger. Every change writes an entry with the actor's role at time of action, a SHA‑256 hash of the canonical payload, and the prior chain hash — so the provenance an auditor sees cannot have been silently rewritten.

      Draft & Publish Workflow

      Every state transition is a ledger entry. DraftSaved, ApprovalRequested, ApprovalGranted, ApproverReleaseSigned — the workflow state machine and the audit trail are the same artifact, satisfying 21 CFR Part 11 §11.200's two‑component signature requirement.

      Schema & Map Version Control

      Versions are derived from the ledger, not the other way round. SchemaVersionPublished and MappingVersionPublished entries are the canonical source of every semantic version increment — patch, minor, or major — and the diff between them is a hash‑checkable subsection of the chain.

      Governance Built In

      Classification labels (PII, PHI, confidential) live in the ledger, not in a sidecar table that policy could quietly bypass. ClassificationApplied and PolicyEnforced entries make compliance posture replayable, not just visible on a dashboard.

      RBAC through Lines of Business

      Seven roles, mapped to two Postgres database roles. Every grant, revoke, and role-at-time-of-action stamp is a ledger entry — so HIPAA §164.308(a)(2), 21 CFR Part 11 §11.10(j), and CMMC L2 §3.3 AC‑5/AU‑9 accountability is enforced by the data structure, not by application discipline.

      Hierarchical Access Groups

      Group membership and SSO assertions are ledger‑stamped. AccessGroupChanged and SsoAssertionRecorded entries make it possible to prove which group an actor belonged to — and which IdP authenticated them — at the moment of any historical action.

      CI/CD & Automation

      CI/CD pulls signed specs, not raw mappings. ReleasePromoted entries close the chain for each environment promotion, and every promotion carries the ULID of the ApproverReleaseSigned entry it was authorized by.

      CMMC L2 §3.3 · Audit & Accountability

      How the ledger satisfies AU-2, AU-3, AU-9, and AU-11

      Magellan does not claim CMMC certification — it produces the AU-family evidence a prime contractor's assessor needs. Each control below pairs the plain-language requirement with a concrete Magellan example and the exact ledger artifact you hand the assessor.

      CMMC §3.3 AU-2

      Event Logging

      Control
      Identify the types of events the system must log and keep that event catalog under review.
      Magellan example
      Magellan publishes a fixed event catalog: SchemaImported, MappingProposed, SemanticSuggestionReturned, SemanticSuggestionAccepted, SemanticSuggestionRejected, ThresholdProfileUpdated, RoleAssigned, ActorAuthenticated. Every catalog change is itself a ledger entry, so the catalog under review is the catalog enforced.
      Evidence the assessor pulls
      ledger.event_catalog view + audit_ledger entries WHERE event_type = 'EventCatalogUpdated'

      CMMC §3.3 AU-3

      Content of Audit Records

      Control
      Each audit record must capture what happened, when, where, the source, the outcome, and the identity of the user or process responsible.
      Magellan example
      A SemanticSuggestionAccepted entry carries: a ULID (millisecond-precise, lexicographically sortable), source/target schema versions and attribute paths, candidate set with confidence scores, model identifier (google/gemini-2.5-flash), API version, active threshold-profile version, the authenticated actor, and that actor's role-at-time-of-action. Sufficient to replay the decision four years later.
      Evidence the assessor pulls
      audit_ledger row → JSON columns: ulid, event_type, payload, actor_id, actor_role_at_time, occurred_at, prev_hash, this_hash

      CMMC §3.3 AU-9

      Protection of Audit Information

      Control
      Audit information and audit tools must be protected from unauthorized access, modification, and deletion.
      Magellan example
      The ledger lives in a dedicated Postgres role with INSERT-only privileges. Append-only is enforced twice — by REVOKE UPDATE, DELETE at the role level and by a BEFORE UPDATE OR DELETE trigger that raises an exception. Each row binds the SHA-256 of the prior row, so a retroactive edit breaks the chain on verification. The chain head is mirrored to a WORM secondary sink (S3 Object Lock); on conflict, the WORM head wins and the divergence is treated as an incident.
      Evidence the assessor pulls
      Hash-chain verification report (SELECT verify_chain(start_ulid, end_ulid)) + S3 Object Lock retention policy + Postgres role grants

      CMMC §3.3 AU-11

      Audit Record Retention

      Control
      Audit records must be retained for a defined period consistent with records-retention policy to support after-the-fact investigations and meet regulatory requirements.
      Magellan example
      Magellan's ledger is append-only by design — entries are never overwritten or pruned. Retention windows are configurable per tenant to align with the strictest applicable regime (HIPAA 6-year minimum, 21 CFR Part 11 record-lifetime, DoD CUI per contract). The configured retention is itself a ledger entry, so the retention policy in force at time-of-decision is auditable.
      Evidence the assessor pulls
      tenant_retention_policy table + audit_ledger entries WHERE event_type = 'RetentionPolicyUpdated' + WORM sink lifecycle rules

      Evidence-to-control mapping

      Every artifact below is produced by the running Magellan deployment — no separate audit-prep workstream. The CMMC L2 §3.3 controls each artifact satisfies are listed alongside.

      Ledger artifactSatisfies
      Event catalog (ledger.event_catalog view)AU-2
      Audit ledger row (ULID + payload + actor + role-at-time)AU-3
      Hash-chain verification report (verify_chain RPC)AU-9
      WORM sink (S3 Object Lock) chain-head mirrorAU-9, AU-11
      Postgres role grants (INSERT-only audit role)AU-9
      Tenant retention policy + RetentionPolicyUpdated entriesAU-11

      The same chain also satisfies HIPAA §164.312(b) and 21 CFR Part 11 §11.10(e). One ledger, three regimes.

      Schema Formats

      Bring any schema, from any source

      Every ingested schema is normalized into Magellan's unified MetaModel and stamped with a SchemaIngested ledger entry — so the same Semantic Match, lineage edge derivation, and ULID‑keyed audit trail apply whether the source was Avro, JDBC, or a proprietary Erwin XML.

      Don't see your format? Magellan ships a documented ImportAdapter interface — implement parse(): MetaModel and the format inherits the same MetaModel projection, Semantic Match, and ledger writes as the built‑in adapters.

      Mapping Import

      Start with what you already have

      Most teams already maintain source‑to‑target mappings in spreadsheets. Magellan lets you import them directly — preserving your existing work while unlocking Semantic Match suggestions, lineage derivation, and the ULID‑keyed audit trail.

      Integration

      Hand your ETL stack a hash‑chained, audit‑ready spec

      Magellan emits the governed mapping artifacts your existing ETL/ELT tools already accept — every export carries the ULID and ledger entry it was generated from, so the transformation that runs in Informatica, dbt, or Glue is the one an auditor can trace back to a signed decision.

      Magellan

      Governed Metadata

      Machine‑Readable Output

      YAML · JSON · XML · API

      Your ETL/ELT Tools

      Execute & Deploy

      Quick Start

      Open Informatica Cloud Mapping Designer

      Five steps to reach the Mappings area in Informatica Intelligent Data Management Cloud (IDMC), where Magellan-emitted PowerCenter XML and IDMC mapping specs are imported.

      Why Magellan: Mapping Designer is a developer surface. In Magellan the subject-matter expert proposes, reviews, and approves the semantic match — the PowerCenter XML or IICS task is emitted from the signed decision.

      1. 1

        Sign in to IDMC

        Open your regional pod — dm-us.informaticacloud.com (US), dm-em.informaticacloud.com (EMEA), or dm-ap.informaticacloud.com (APAC). Use your IDMC org credentials or SSO.

      2. 2

        Open the My Services launcher

        From the IDMC home page, click the service tile launcher in the upper-left and select Data Integration.

      3. 3

        Switch to the Explore view

        In Data Integration, click Explore in the left navigation. This is the project/folder browser where all assets — mappings, mapping tasks, taskflows — live.

      4. 4

        Filter by Mappings

        Choose your project and folder, then set the Asset Type filter to Mappings. You'll see every mapping in that folder, including any imported from a Magellan ApproverReleaseSigned export.

      5. 5

        Open the Mapping Designer

        Click an existing mapping to open the Mapping Designer canvas, or click New ▸ Mappings ▸ Mapping to create one. The canvas is where source, transformation, and target objects from a Magellan-emitted spec are wired together.

      Reference: Informatica Mapping Designer documentation

      6 months2 weeks

      Time to a regulated, ready‑to‑use dataset

      Typical time to prepare a regulated dataset for downstream use, before vs. after Magellan. Mapping, terminology binding, and audit evidence collapse into one versioned artifact — proposed by the Semantic Match Engine, approved by named SMEs, and recorded in a tamper‑evident ledger.

      For investors

      The three questions every investor asks

      Why this market, why now — and exactly what makes Magellan defensible to a regulator.

      AI is colliding with regulation. 87% of AI projects never reach production — and in healthcare, life sciences, and federal markets, the blocker isn't the model, it's the unsigned data decisions beneath it. HIPAA, 21 CFR Part 11, FedRAMP, CMMC L2 §3.3, and the EU AI Act are all converging on the same requirement: every transformation must be attributable, version‑pinned, and tamper‑evident.

      The market is spending an estimated $3.1 trillion annually on bad data and 80% of AI project time on data preparation. The audit layer beneath the AI layer is the next required infrastructure purchase — and it doesn't exist as a category yet.

      Get in Touch

      Have questions?

      Reach out to our team — we'd love to hear from you and help you get started with Magellan.