What is Snowflake's Tri-Secret Secure model and when is it used?

Tri-Secret Secure is Snowflake's highest tier of data protection. It ensures that data can only be decrypted when two independent keys are simultaneously present: Snowflake's own master key and a Customer-Managed Key (CMK) held in the customer's own cloud KMS (AWS KMS or Azure Key Vault). Neither party can decrypt the data alone.

In the standard key model, Snowflake holds all key hierarchy tiers. In Tri-Secret Secure, the account master key is wrapped not just by Snowflake's root key but also by the customer's CMK. Snowflake must call the customer's KMS every time it needs to access encrypted data. If the customer revokes the CMK, all data in that account becomes immediately inaccessible — even to Snowflake engineers. This gives customers provable data sovereignty.

Use cases: financial institutions with regulatory mandates, government agencies, healthcare organizations requiring proof they can revoke Snowflake's access at any time. Requires Business Critical or Virtual Private Snowflake edition plus a Tri-Secret Secure subscription add-on.

Operational risk: if the customer loses or deletes the CMK without a backup, all data is permanently lost. The customer bears full responsibility for CMK lifecycle management.

-- Conceptual setup: link an Azure Key Vault key to the Snowflake account
-- (actual steps involve Snowflake Support + Azure Key Vault configuration)
ALTER ACCOUNT SET HSM_MASTER_KEY_ID = 'https://myvault.vault.azure.net/keys/mykey/version';

-- Verify Tri-Secret Secure is active
SHOW PARAMETERS LIKE 'TRI_SECRET_SECURE' IN ACCOUNT;