August 8, 2024 – Security Addendum

Skip to content

ARCHIVE Security Addendum - 2024-08-08

This is an archived version of our Security Addendum from August 8, 2024. View the current version here.

This Security Addendum1 is incorporated into and made a part of the written agreement between Snowflake and Customer that references this document (the “Agreement”) and any capitalized terms used but not defined herein shall have the meaning set forth in the Agreement. In the event of any conflict between the terms of the Agreement and this Security Addendum, this Security Addendum shall govern.

Snowflake utilizes infrastructure-as-a-service cloud providers as further described in the Agreement and/or Documentation (each, a “Cloud Provider“) and provides the Service to Customer using a VPC/VNET and storage hosted by the applicable Cloud Provider (the “Cloud Environment“).

Snowflake maintains a comprehensive documented security program based on NIST 800-53 (or industry recognized successor framework), under which Snowflake implements and maintains physical, administrative, and technical safeguards designed to protect the confidentiality, integrity, availability, and security of the Service and Customer Data (the “Security Program”), including, but not limited to, as set forth below. Snowflake regularly tests and evaluates its Security Program, and may review and update its Security Program as well as this Security Addendum, provided, however, that such updates shall be designed to enhance and not materially diminish the Security Program.

1. Snowflake’s Audits & Certifications

1.1. The information security management system used to provide the Service shall be assessed by independent third-party auditors as described in the following audits and certifications (“Third-Party Audits“), on at least an annual basis:

• ISO 27001, 27017, 27018, 9001

• SOC 2 Type II

• SOC 1 Type II

• For Snowflake’s Business Critical Edition and Virtual Private Snowflake Edition only:

• PCI-DSS Service Provider Level 1 Certification

• FedRAMP Moderate and FedRAMP High authorizations in certain U.S. Regions (as described in the Documentation)

• U.S. state government authorizations (e.g., StateRAMP or TX-RAMP) (“State Authorizing Programs”) in certain U.S. Regions (as described in the Documentation)

• HITRUST CSF Certification

• IRAP at the Protected Level in certain Australian Regions (as described in the Documentation)

1.2. Third-Party Audits are made available to Customer as described in Section 9.2.1.

1.3. To the extent Snowflake decides to discontinue a Third-Party Audit, Snowflake will adopt or maintain an equivalent, industry-recognized framework.

1.4. Information related to Snowflake-identified controls for which Customer is responsible in connection with FedRAMP, State Authorizing Programs, IRAP, and PCI-DSS is available upon written request by Customer. Customer is responsible for performing an independent assessment of its responsibilities under any of the foregoing.

2. Hosting Location of Customer Data

2.1. Hosting Location. The hosting location of Customer Data is the production Cloud Environment in the Region offered by Snowflake and selected by Customer on an Order Form or as Customer otherwise configures via the services.

** 3. Encryption**

3.1. Encryption of Customer Data. Snowflake encrypts Customer Data at-rest using AES 256-bit (or better) encryption. Snowflake uses Transport Layer Security (TLS) 1.2 (or better) for Customer Data in-transit to/from the Service over untrusted networks.