How does Snowflake encrypt data at rest and in transit?

Snowflake enforces encryption universally — it cannot be disabled. Every byte of customer data is always encrypted, both when stored in cloud object storage and when moving across networks.

Encryption at rest uses AES-256-GCM in a four-tier hierarchical key model:

• File keys encrypt individual micro-partition files.
• Table keys encrypt the file keys for a given table.
• Account master keys encrypt the table keys for an account.
• Root keys (Snowflake-held) encrypt the account master keys.

Key rotation happens automatically every 12 months per Snowflake's key management policy. Customers can also request on-demand rekeying via ALTER TABLE ... REKEYING = TRUE (Enterprise+) to force immediate rotation of table-level keys. The Tri-Secret Secure model (Business Critical+) adds a customer-managed key on top of this hierarchy.

Encryption in transit uses TLS 1.2 or higher for all connections: between client drivers (JDBC, ODBC, Python) and the Snowflake service endpoint, and between Snowflake's internal services and cloud object storage. Certificate pinning and OCSP validation are used to prevent man-in-the-middle attacks.

Customers in regulated industries should note that Snowflake's encryption is not customer-managed by default; for that, they need Business Critical edition and Tri-Secret Secure.