Salesforce Encryption
Customer and opportunity data stay useful in Salesforce, without giving the CRM the last encryption key.
Hold the key to your warehouse
Snowflake Tri-Secret Secure combines Snowflake's key with a customer-managed key you hold. With DuoKey XKS, that key also stays outside AWS.
Snowflake cannot decrypt alone
The composite master key needs your customer-managed key.
Key outside AWS too
Back the CMK with an AWS KMS External Key Store held by DuoKey.
Revocable
Withdraw the key and Snowflake can no longer read the data.
Three keys, one decision.
Tri-Secret Secure joins a Snowflake-maintained key and your customer-managed key into a composite master key for the account.
- The composite key wraps every key in the account hierarchy.
- Available for Snowflake Business Critical accounts.
A composite master key.
The composite key wraps table master keys, which derive the file keys that encrypt the data. Without your part, the hierarchy cannot be unlocked.
- No change to queries or pipelines.
- Activation through the Snowflake CMK registration flow.
Revoke, and the warehouse goes dark.
Disable or withdraw the customer-managed key and Snowflake loses the ability to decrypt the account's data.
- An exit and incident lever you control.
- Restore by making the key available again.
The CMK outside AWS, with XKS.
On AWS, the CMK lives in AWS KMS. Backing it with an XKS key store keeps the actual key material with DuoKey, protected with MPC.
- AWS cannot use the key without DuoKey.
- Policy and audit in the same Cockpit.
Snowflake
Tri-Secret Secure
AWS KMS
DuoKey XKS
XKS proxy
MPC key nodes
Audit trail
How the pieces fit.
Snowflake keeps running on AWS, AWS KMS keeps answering Snowflake, and the key behind it stays with DuoKey.
- Snowflake Business Critical with Tri-Secret Secure.
- AWS KMS External Key Store backed by DuoKey MPC.
Key features
Tri-Secret Secure
Composite master key with your customer-managed key.
XKS integration
AWS KMS External Key Store backed by DuoKey.
MPC technology
Distributed key security and high availability.
Central management
Policy and audit controls in the Cockpit.
Revocation
Cut off decryption by withdrawing the key.
No pipeline change
Queries, loads and shares keep working.
Get started
Enable Tri-Secret Secure on a Business Critical account and connect your key.
Proof in practice
Where teams deploy this
Trust
Assurance and customer programmes
Customer programmes
Analytics in Snowflake. The key with you.
See Tri-Secret Secure with a customer-managed key Snowflake and AWS cannot use alone.
Products
Related products
View product