November 9, 2020 – Security Addendum

Skip to content

ARCHIVE Security Addendum - 2020-11-09

This is an archived version of our Security Addendum from November 9, 2020. View the current version here.

**Last Updated: **November 9, 2020

This Security Addendum is incorporated into and made a part of the written agreement between Snowflake and Customer that references this document (the “Agreement”) and any capitalized terms used but not defined herein shall have the meaning set forth in the Agreement. In the event of any conflict between the terms of the Agreement and this Security Addendum, this Security Addendum shall govern.

Snowflake utilizes infrastructure-as-a-service cloud providers as further described in the Agreement and/or Documentation (each, a “Cloud Provider“) and provides the Service to Customer using a VPC/VNET and storage hosted by the applicable Cloud Provider (the “Cloud Environment“).

Snowflake maintains a comprehensive documented security program based on NIST 800-53 (or industry recognized successor framework), under which Snowflake implements and maintains physical, administrative, and technical safeguards designed to protect the confidentiality, integrity, availability, and security of the Service and Customer Data (the “Security Program”), including, but not limited to, as set forth below. Snowflake regularly tests and evaluates its Security Program, and may review and update its Security Program as well as this Security Addendum, provided, however, that such updates shall be designed to enhance and not materially diminish the Security Program.

1. Snowflake’s Audits & Certifications

• 1.1. The information security management system used to provide the Service shall be assessed by independent third-party auditors as described in the following audits and certifications (“Third-Party Audits“), on at least an annual basis:

• ISO27001

• SOC 2 Type II

• SOC 1 Type II

• For Snowflake’s Business Critical Edition and Virtual Private Snowflake Edition only:

• PCI-DSS Service Provider Level 1 Certification

• FedRAMP Moderate Authorized in certain U.S. Regions (as described in the Documentation)

• HITRUST CSF Certification (where AWS or Microsoft are the Cloud Provider)

• HIPAA Compliance Report for Business Associates (where Google is the Cloud Provider)

• 1.2. Third-Party Audits are made available to Customer as described in Section 9.2.1.

1.3 To the extent Snowflake discontinues a Third-Party Audit, Snowflake will adopt or maintain an equivalent, industry-recognized framework.

2. Hosting Location of Customer Data

• 2.1. Hosting Location. The hosting location of Customer Data is the production Cloud Environment in the Region offered by Snowflake and selected by Customer on an Order Form or as Customer otherwise configures via the services.

** 3. Encryption**

• 3.1. Encryption of Customer Data. Snowflake encrypts Customer Data at-rest using AES 256-bit (or better) encryption. Snowflake uses Transport Layer Security (TLS) 1.2 (or better) for Customer Data in-transit over untrusted networks.

• 3.2. Encryption Key Management. Snowflake’s encryption key management conforms to NIST 800-53 and involves regular rotation of encryption keys. Hardware security modules are used to safeguard top-level encryption keys. Snowflake logically separates encryption keys from Customer Data.

**4. **System & Network Security

• 4.1. Access Controls. All Snowflake personnel access to the Cloud Environment is via a unique user ID and consistent with the principle of least privilege. All such access requires a VPN, with multi-factor authentication and passwords meeting or exceeding PCI-DSS length and complexity requirements.