Snowflake
Cloud data platform for data warehousing, analytics, and secure data sharing (AI Data Cloud).
| Security & General Standards | |
|---|---|
| SOC 2 Type II | ✓ SOC 2 Type II documented at docs.snowflake.com/en/user-guide/cert-soc-2; report via Compliance Center |
| SOC 3 | ? Not documented on public compliance docs |
| SOC 1 Type II | ✓ SOC 1 Type II documented at docs.snowflake.com/en/user-guide/cert-soc-1 |
| ISO 27001 (Information Security Management) | ✓ ISO/IEC 27001:2013 documented at docs.snowflake.com/en/user-guide/cert-iso-27001 |
| ISO 27017 (Cloud Security) | ✓ ISO 27017:2015 included in SoA per cert-iso-27017 docs |
| ISO 27018 (Cloud Privacy) | ✓ ISO 27018:2019 included in SoA per cert-iso-27018 docs |
| ISO 27701 (Privacy Information Management) | ? Not documented on public compliance docs |
| ISO 42001 (AI Management Systems) | ? Not documented on public compliance docs |
| ISO 9001 (Quality Management) | ✓ Not documented on public compliance docs |
| CSA STAR (Cloud Security Alliance) | ✓ CSA STAR Level 1 self-assessment (CAIQ) per cert-csa-star-level-1 docs |
| HITRUST CSF | ✓ HITRUST CSF via Shared Responsibility and Inheritance Program per cert-hitrust docs |
| BSI C5 (German Cloud Security) | ✓ Regional — Germany section on regulatory compliance docs; explicit C5 attestation not confirmed |
| Privacy & Data Transfer | |
| GDPR (EU) | ✓ GDPR support documented; DPA and Privacy FAQ available via Compliance Center |
| CCPA / CPRA (California) | ~ Privacy questionnaire response mentions CCPA handling but explicit CCPA certification not documented |
| UK GDPR | ✓ Not explicitly documented |
| LGPD (Brazil) | ? Not documented on public compliance docs |
| PIPEDA (Canada) | ? Not documented on public compliance docs |
| DPDP Act (India) | ? Not documented on public compliance docs |
| PIPL (China) | ? Not documented on public compliance docs |
| EU-US Data Privacy Framework | ✓ Privacy and Data Transfer FAQ covers transfers but DPF self-certification not explicitly confirmed on public docs |
| Swiss-US Data Privacy Framework | ✓ Not explicitly documented |
| Global CBPR (APEC) | ? Not documented on public compliance docs |
| Global PRP (APEC) | ? Not documented on public compliance docs |
| Industry & Government | |
| HIPAA (US Healthcare) | ✓ HIPAA support covered under Healthcare and life sciences compliance section; BAA available |
| PCI DSS (Payment Card Industry) | ✓ PCI DSS Level 1 Service Provider (v3.2.1) with annual QSA assessment per cert-pci-dss docs |
| FedRAMP (US Federal) | ✓ FedRAMP Moderate and High authorized per cert-fedramp docs; listed on FedRAMP Marketplace |
| StateRAMP / TX-RAMP (US State) | ✓ Not documented on public compliance docs |
| DORA (EU Finance) | ? Not documented on public compliance docs |
| CJIS (US Law Enforcement) | ✓ Not documented on public compliance docs |
| FINRA (US Broker-Dealers) | ? Not documented on public compliance docs |
| IRAP (Australian Government) | ✓ IRAP listed under Regional — Australia section of regulatory compliance docs |
| Emerging & Strategic | |
| NIST CSF (Cybersecurity Framework) | ? Not explicitly documented |
Data last verified: September 2026
Is this data outdated?
Spotted an error or a recent change in Snowflake's posture? Submit a correction.
Submit a correction →