Open Source Governance
Governance is a word stretched across very different jobs, and the tools filed under it rarely compete directly. Some map where data comes from and who owns it, tracing column-level lineage across warehouses and pipelines. Others run an information security management system, tracking controls and evidence against a standard. A few govern money and membership for open communities. What unites the open source options is that the record of decisions, lineage, and ownership stays in a system you run, harvested from your own infrastructure rather than a hosted catalog that only knows what you remembered to tell it. That matters because governance records usually outlive the tool that captured them.
OpenMetadata
Open-source metadata platform for data cataloging, discovery, governance, lineage, and quality
DataHub
Metadata platform for data discovery, governance, and observability across the data stack
Amundsen
Data discovery and metadata engine for finding tables, dashboards, streams, and other data assets
Open Collective
Online funding platform for open communities to raise money and share finances transparently
Marquez
Metadata service for collecting, aggregating, and visualizing data lineage and provenance
Apache Atlas
Metadata and data governance framework for Hadoop with lineage, audit, and RBAC and ABAC security
Deming
Open source ISMS tool for planning, monitoring, and reporting on ISO 27001 security measures
ISMS Builder
Self-hosted ISMS platform for ISO 27001, NIS2, GDPR, and BSI IT-Grundschutz
Our picks
The right pick depends on whether you are governing data, security, or community funds.
Broadest data catalog: OpenMetadata OpenMetadata connects metadata, lineage, ownership, glossaries, and data quality into one graph, fed by 130+ connectors plus ingestion APIs and SDKs. Column-level lineage with impact analysis means a schema change can be traced to what it breaks. An included MCP server even lets AI assistants query the catalog in natural language.
Real-time lineage across the stack: DataHub Originally built at LinkedIn, DataHub ingests through 80+ connectors and streams updates over Kafka, so the metadata graph stays current instead of going stale between scans. It exposes search, lineage, and ownership through a web UI, GraphQL and REST APIs, SDKs, and a CLI, which suits teams that want to wire governance into their own dashboards.
ISO 27001 control tracking: Deming Deming manages an information security management system aligned to ISO 27001, covering control planning, action plans, a coverage view, and steering-meeting reports. It ships referentials for ISO 27001, ISO 22301, NIS2, DORA, and PCI DSS, and lets administrators import their own from a spreadsheet, so control text is not something you re-key by hand.
Pipeline provenance: Marquez Marquez is the reference implementation of the OpenLineage standard, focused on collecting dataset, job, and run metadata and visualizing how pipelines produce and consume data. As an LF AI and Data Foundation graduated project with a PostgreSQL store and HTTP and GraphQL APIs, it fits teams that want lineage provenance without a full catalog's surface area.
Matching a governance tool to what you are actually governing
The first mistake is assuming these tools are substitutes. A metadata catalog like OpenMetadata or DataHub answers where data came from and who owns it, harvesting schemas and column-level lineage from your warehouses. An ISMS tool like Deming or ISMS Builder answers whether your security controls are in place and evidenced, organized around a standard such as ISO 27001. Open Collective answers where a community's money went. Decide which question is yours before comparing anything, because a catalog will not track control evidence and an ISMS will not draw a lineage graph.
If you landed here for data governance, weigh how metadata gets in and how deep lineage goes. OpenMetadata and DataHub both ship a large connector library and support column-level lineage with impact analysis, so a schema change can be traced to the dashboards it breaks. Amundsen leans toward discovery, ranking search results by how often an asset is queried, while Marquez is narrower: it is the reference implementation of the OpenLineage standard and focuses on job and run provenance. Apache Atlas fits teams already invested in the Hadoop ecosystem, with hooks for Hive, HBase, and Kafka.
For security governance the questions change. Look at which frameworks ship as reusable content and how audit evidence is handled, since re-keying control text by hand is where these projects lose their value. Deming ships referentials for ISO 27001, NIS2, DORA, and others, while ISMS Builder deliberately omits licensed ISO control text you have to import yourself. Either way, confirm the audit log records who accepted a risk and when, and that you can export policies, controls, and evidence, because those records are frequently what an auditor asks for years later.
Related categories
Frequently asked questions
Is data governance the same as security governance here?+
No, and the tools reflect that. Most of the catalog tools here, like OpenMetadata, DataHub, and Amundsen, do data governance: cataloging assets, tracking lineage, and assigning ownership. Deming and ISMS Builder do security governance, managing controls and evidence against standards such as ISO 27001. They rarely overlap, so decide which problem you have before shortlisting, because a catalog cannot run an audit program and an ISMS cannot map your data lineage.
What does column-level lineage give me that table-level does not?+
Column-level lineage traces a single field, not just a table, through the transformations that produce it. That lets you answer impact questions precisely: if this column changes or breaks, which downstream models, reports, and dashboards are affected. OpenMetadata and DataHub both support column-level lineage with impact analysis, which is the difference between a rough dependency sketch and being able to trust what a change will touch before you ship it.
How do metadata catalogs pull information out of my data stack?+
Through connectors and ingestion jobs rather than manual entry. DataHub ships a push or pull framework with connectors for sources such as Snowflake, BigQuery, and dbt, and streams updates over Kafka so the graph stays current. OpenMetadata offers a large connector set plus ingestion APIs and SDKs. The goal is that lineage and schemas are harvested automatically, because any catalog that depends on people remembering to update it drifts out of date quickly.
Which of these suits a Hadoop or Spark data platform?+
Apache Atlas is the natural fit for a Hadoop-centered stack. It ships hooks for Hive, HBase, Impala, Kafka, Sqoop, and Storm to capture metadata from those systems, and pairs role-based and attribute-based access control with Apache Ranger to enforce it at runtime. If your platform is built on cloud warehouses instead, OpenMetadata or DataHub will usually give you broader connector coverage than Atlas for those sources.
What is OpenLineage, and why does Marquez keep coming up?+
OpenLineage is an open standard for describing how datasets are produced and consumed by jobs. Marquez is its reference implementation, so it focuses tightly on collecting job, run, and dataset metadata and visualizing the dependencies between them. If your priority is pipeline provenance - which job produced which dataset, and how often it runs - Marquez is more focused than a full catalog. If you also need search, glossaries, and quality tests, a broader tool fits better.
Can an open source ISMS tool replace a formal ISO 27001 audit?+
No. Tools like Deming and ISMS Builder organize the work an audit inspects: control lists, planning, action plans, coverage views, and evidence. They make the state of your controls visible and reportable, but a certified auditor still judges whether the system meets the standard. Their value is keeping controls, owners, and evidence in one defensible place, so the audit is a review rather than a scramble to reconstruct what happened.
Why is a funding platform listed under governance?+
Open Collective governs money and membership rather than data or security controls. It gives open communities a transparent way to raise, hold, and disburse funds, with public finances members can inspect. It is a different kind of governance from the catalogs and ISMS tools here, and unlike most of them the listing notes no documented self-hosting path, so treat it as a hosted transparency platform rather than something you run on your own infrastructure.