Data Governance and Data Protection
Protecting data
Snowflake encrypts data at rest with AES-256 and in transit with TLS; Tri-Secret Secure adds customer key control. Time Travel (0–90 days, Enterprise and above) lets you query and restore historical data; Fail-safe is a fixed 7-day recovery window available only to Snowflake Support, not to users. Cloning is metadata-only and cheap, but clones carry their own retention.
Governance controls
- Masking policies: column-level, applied at query time, with role exemptions.
- Row access policies: row-level filters, often mapped through a mapping table; can hurt performance and can trigger recursive policy errors.
- Object tagging and tag-based masking; data classification for sensitive data discovery.
- Access History and ACCOUNT_USAGE views for auditing who read which columns.
- Secure views hide the view definition and prevent optimizer leakage.
Traps
- Thinking Fail-safe is user-accessible or configurable.
- Expecting a masking policy to apply to its owner's role by default (the owner is exempt).
- Forgetting that a row access policy on a table blocks direct sharing; expose a secure view instead.
- Confusing Time Travel retention with Fail-safe; dropping a table does not skip Fail-safe.
- Assuming cloning duplicates storage immediately.
Worked example: a table must be shared but hide PII - create a secure view with masking policies on email columns and share the view, not the base table.