SNOWFLAKE PROFESSIONAL SERVICES SUBCONTRACTOR SECURITY AGREEMENT

Last Updated: September 1, 2026

This Snowflake Professional Services Subcontractor Security Agreement (“Security Agreement”), effective as of the last date it is signed below, is entered into in connection with all agreements (“Agreements”) by and between Snowflake Inc. (“Snowflake”) and the party specified above (“Vendor”). Snowflake and Vendor agree that notwithstanding anything to the contrary in the Agreements, including an integration clause, this Security Agreement is hereby incorporated into and made an essential part of the Agreements. In the event of any conflict between the terms of the Agreements (including its security provisions, addenda, appendices, exhibits or other attachments) and this Security Agreement, this Security Agreement shall govern. All capitalized terms not defined in this Security Agreement shall have the meaning set forth in the Agreements.

For purposes of this Security Agreement: the word “including” means “including, without limitation”; “Malicious Code” means (a) any harmful, malicious, or hidden code, programs, procedures, routines, or mechanisms, including malware, Trojan horses, viruses, worms, time bombs, time locks, devices, traps, access codes, or drop dead, or trap door devices, or (b) computer instructions, circuitry, or other technological means designed to disrupt, damage, or interfere with Snowflake’s authorized use of the Vendor Services or Snowflake’s computers and communications facilities or equipment accessing the Vendor Services; “Snowflake Data” means all data or information of any type (including all software, data, text, audio, video, or images) that Vendor develops, accesses, processes, or stores in connection with the Vendor Services, including Customer Data and other Confidential Information of Snowflake’s Customers; “Snowflake Systems” means any infrastructure, networks, systems, or applications owned, controlled or managed by Snowflake or a Snowflake Customer (including those licensed by Snowflake or the Snowflake Customer) that access, transmit, process, or store Snowflake Data; “Vendor Personnel” means the employees and contractors providing Vendor Services through a Statement of Work (“SOW”) that involves accessing or using Vendor Systems; “Vendor Service(s)” means the services (including all deliverables, products, applications, software, solutions, and tools) being developed for or provided to Snowflake under the Agreements; and “Vendor Systems” means the infrastructure, systems, and applications that access or support the Vendor Services or that access, process, or store Snowflake Data.

1.     Security Program & Certifications.

1.1.   Vendor shall maintain a comprehensive, written security program (“Vendor Security Program”) that aligns with industry standards with management-approved written policies, procedures, and controls governing physical, organizational, administrative, and technical safeguards, to protect Vendor Services, Vendor Systems, and Snowflake Data.

1.2.   Vendor shall establish and maintain a privacy program (“Vendor Privacy Program”) to ensure management controls and common controls are in place for meeting applicable privacy requirements and managing privacy risks.

1.3.   Vendor shall establish and maintain a supply chain risk management program (“Vendor Supply Chain Risk Management Program”) to ensure Vendor has a systematic approach for managing cyber supply chain risk exposures, threats, and vulnerabilities throughout the supply chain and developing risk response strategies to the risks presented by its suppliers, the supplied products and services, or the supply chain.

1.4.   Vendor shall comply with (i) all applicable legal and regulatory requirements in connection with Vendor Services and data processed in connection therewith; (ii) security and privacy best practices in related industries, including financial services, information technology and healthcare industries; and (iii) any further information security or privacy requirements included in a Statement of Work. 

1.5.   Vendor shall designate one or more knowledgeable management (or higher) level privacy and data security personnel responsible for carrying out the Vendor Privacy Program, Vendor Security Program and Vendor Supply Chain Risk Management Program.

1.6.   The Vendor Security Program, Vendor Privacy Program, and Vendor Supply Chain Risk Management Program shall include documented processes for the identification of internal and external security and privacy risks to Vendor Services and Vendor Systems, as well as data processed in connection therewith, and maintain at minimum annual assessments of the sufficiency of safeguards to mitigate or remediate those risks. Upon request, Vendor shall provide written documentation, including policies and procedures, to Snowflake evidencing Vendor’s compliance with the commitments in this Security Agreement.

1.7.   The Vendor Security Program shall be assessed by independent third-party auditors (“Auditors”) as described in one or more of the below audits and/or certifications ("Third-Party Audits"), on at least an annual basis. Third-Party Audits, and any underlying reports from the Auditors, shall be made available to Snowflake and its customers, upon request.

o   ISO 27001

o   SOC 2 Type II

o   PCI-DSS Service Provider Level 1 Certification

o   HITRUST CSF Certification

o   Other industry standard security assessments or a waiver of this requirement in 1.7, each only as expressly approved in writing by Snowflake.

1.8.   Vendor acknowledges that Snowflake Data may include personal data, health information, financial account and credit card information, ‘special categories of data’ (as defined under GDPR), and other highly regulated and/or sensitive data which is subject to varying laws, regulations, and heightened security requirements including, but not limited to, PCI-DSS, GDPR, CCPA, ITAR, HIPAA, and FedRAMP.

2.     System, Network, and Endpoint Security

2.1.   Unless expressly approved in advance in writing by Snowflake, Vendor shall not transmit, or cause to be transmitted, any Snowflake Data to any infrastructure, networks, systems, or applications other than Snowflake Systems.

2.2.   Vendor Personnel shall only use Secure Endpoints (as defined below) to provide Vendor Services, including for all (a) access to Snowflake Systems, Snowflake Data or Vendor Systems and (b) processing or storage of Snowflake Data. “Secure Endpoints” means endpoints (including laptops) that: (1) utilize security controls that include (i) disk encryption, (ii) industry standard endpoint detection and response (EDR) tools to monitor and alert for suspicious activities and Malicious Code, (iii) up-to-date, continuously monitoring host-based intrusion detection software, (iv) host-based firewall software, (vi) technical restrictions preventing use of USB drives, and (2) are configured to ensure (i) automatic activation of a password protected screensaver/lock-out after no more than 10 minutes of inactivity, (ii) vulnerability scanning, patching, and management in accordance with this Security Agreement, (iii) ability to remotely and securely wipe all data stored thereon, (iv) password and authentication controls and requirements that meet or exceed PCI-DSS standards, and (v) for applications falling under 1(ii) and 1(iii), daily updates of signatures, real-time scans and weekly full scans, as well as automatic updates.

2.3.   Vendor must use Snowflake-approved devices and mechanisms to access Snowflake Data, Snowflake Systems, or any other Snowflake environment. Vendor shall not, and shall ensure Vendor Personnel do not use any personal devices in connection with Vendor Services or Snowflake Data (e.g., personal mobile phones, laptops, etc.).

2.4.   Vendor Personnel must each use unique credentials when logging on to Vendor Systems, Snowflake System(s), including VDI, and such credentials may not be shared.

2.5.   Vendor shall ensure that all vulnerabilities on Vendor Systems are prioritized and remediated based on their potential impact to Snowflake Data, Snowflake Systems, and Vendor Systems. In any case, upon becoming aware of a vulnerability (including by notice from Snowflake, or industry knowledge or publication), Vendor shall remediate private and public “critical” and “high”’ vulnerabilities to Snowflake’s satisfaction within thirty (30) calendar days, and “medium” vulnerabilities to Snowflake’s satisfaction within ninety (90) calendar days or Snowflake may terminate the Agreement for material breach upon notice to Vendor without any cure period. Vendor shall use the National Vulnerability Database’s (NVD) Common Vulnerability Scoring System (CVSS) (NVD Site), or if not applicable, an equivalent industry standard, to assess whether a vulnerability is “critical”, “high”, or “medium”.

2.6.   If Vendor becomes aware of a “medium”, “high” or “critical” vulnerability (assessed as set forth in Section 2.5) in a Vendor System then, in each such case Vendor shall (a) notify Snowflake without undue delay, and in any case within 72 hours, after becoming aware of the vulnerability and provide Snowflake with the cooperation described in Section 6.2.2 below.

2.7.   All Vendor Systems shall be hardened using industry standard (or better) practices, including by changing default passwords, removing unnecessary software, disabling or removing unnecessary services, and regular patching as described in this Security Agreement.

2.8.   Upon the earlier of Snowflake’s request or termination of the Agreement, Vendor shall return all Snowflake Data to Snowflake and then securely and permanently delete all Snowflake Data in Vendor’s possession within thirty (30) days. Prior to decommissioning (including ‘end-of-lifing’), or releasing from Vendor’s control, any storage device or media used in Vendor Services or containing Snowflake Data, such storage media shall be physically destroyed, degaussed or overwritten in accordance with NIST Special Publication 800-88 unless the parties agree otherwise in a Statement of Work. Notwithstanding anything to the contrary herein, to the extent and for so long as Vendor retains Snowflake Data, Vendor’s obligations with respect to such Snowflake Data shall survive until the Snowflake Data is destroyed in accordance with this Section.

2.9.   Vendor shall preserve and maintain tamper proof security event logs for Vendor Systems and Secure Endpoints for at least one year and provide the logs to Snowflake upon request.

3.     Encryption

3.1.   Encryption of Snowflake Data. Vendor must encrypt all Snowflake Data at-rest using AES 256-bit (or better) encryption, and in-transit using Transport Layer Security (TLS) 1.2 (or better) with industry-standard ciphers.

4.     Administrative Controls

4.1.   Personnel Security. Vendor shall conduct industry standard background screening on all Vendor Personnel in accordance with Snowflake’s policies. Vendor shall not assign any Vendor Personnel who has an unfavorable or non-standard background screening result to provide Vendor Services or otherwise provide such Vendor Personnel with access to Snowflake Data or Snowflake Systems.

4.2.   Personnel Training. Vendor shall maintain a documented security and privacy awareness training program for Vendor Personnel, including onboarding and annual (or more frequent) security and privacy training. Such training shall address applicable data protection responsibilities and shall be mandatory for Vendor Personnel. Vendor shall confirm that all applicable Vendor Personnel have completed such training, upon Snowflake’s request.

4.3.   Personnel Agreements. Vendor shall require Vendor Personnel to sign confidentiality agreements and an acceptable use policy, that includes acknowledging responsibility for reporting Security Incidents (as defined below) and that governs Vendor Personnel use of systems in connection with Vendor Services.

4.4.   Jurisdictional/Nationality Access Restrictions. Where Snowflake requires that Vendor Personnel only access Snowflake Data from a particular jurisdiction (e.g., the United States or European Union), or that certain Snowflake Data only be accessed by persons of a certain nationality (e.g., United States persons or citizens), Vendor shall comply with such restrictions. In no event will Vendor (a) provide Vendor Services or access Snowflake Data or Snowflake Systems from (i) the Crimea region of the Ukraine, Cuba, Iran, North Korea, Sudan, Syria, or (ii) any other country or region that becomes subject after the effective date of this Security Agreement to a comprehensive embargo or other restriction that prohibits such access or (b) use Vendor Personnel who are prohibited from accessing export controlled technology.

4.5.   Personnel Access Reviews & Separation. Vendor shall review the access privileges of Vendor Personnel to Vendor Systems, Snowflake Systems, and Snowflake Data at least quarterly, and remove access privileges for Vendor Personnel upon such personnel no longer needing the access privileges. Vendor shall immediately, and in any case within 24 hours, remove access privileges for all separated Vendor Personnel. If Snowflake has granted any Vendor Personnel access privileges to Snowflake Systems or Snowflake Data, Vendor shall promptly notify Snowflake if any such Vendor Personnel are separated or no longer need such access privileges.

4.6.   Change Management. Vendor shall maintain a documented industry standard change management program for Vendor Systems and shall use commercially reasonable efforts to provide advanced notice to Snowflake of material changes to the security measures for Vendor Systems used in Vendor Services or in connection with Snowflake Data.  Such advanced notice shall be given with enough time to allow Snowflake the opportunity to assess risks related to such change. Notwithstanding the foregoing, no such changes or notification shall relieve or diminish Vendor’s responsibilities under this Security Agreement.  

4.7.   Third Party Risk Management. Where Snowflake has expressly agreed in writing that Vendor may use permitted subcontractors for access to Snowflake Systems or access to, or processing or storage of Snowflake Data, Vendor shall require that such subcontractor complies with Vendor’s obligations under this Security Agreement. Vendor shall have a process in place to perform regular security assessments on third party tools and provide the assessment result to Snowflake upon request.

5.     Incident Detection & Response

5.1.   Security Incident Reporting. If Vendor becomes aware of any accidental, unauthorized, or unlawful destruction, loss, alteration, use, or disclosure of, or access to Snowflake Data, Snowflake Systems, or Vendor Systems (“Security Incident”), then Vendor shall notify Snowflake thereof via email to security@snowflake.com, without undue delay, and in any case within 24 hours, after becoming aware of the Security Incident. 

5.2.   Investigation. If a Security Incident occurs, Vendor shall immediately, at its sole cost, use best efforts to contain, mitigate, investigate, and remediate the Security Incident. Any logs, reports, or other documentation possibly relevant to the Security Incident, shall be preserved for at least one year, and provided to Snowflake upon its request.

5.3.   Communication and Cooperation. Vendor’s initial notification of a Security Incident shall include as comprehensive an accounting of the incident as is possible at the time of notification, including the nature and consequences of the Security Incident, impacted systems/devices, the measures taken and proposed to be taken by Vendor to contain, mitigate, investigate, and remediate the Security Incident, the status of Vendor’s investigation, a contact person with phone number and email from which additional information may be obtained, and the categories and approximate number of data records concerned. Vendor shall use best efforts to provide the above and any additional information to Snowflake in a timely manner as it becomes known to Vendor.

6.     Snowflake Rights

6.1.   Penetration Testing. If Vendor Systems are used to (a) access Snowflake Systems or Snowflake Data or (b) process or store Snowflake Data, then Snowflake, or its appropriately qualified third-party representative, may conduct penetration tests (“Pen Tests”) of the Vendor Systems upon reasonable notice to Vendor. If any such Pen Test reveals “critical”, “high”, or “medium” vulnerabilities, then unless Vendor remediates those vulnerabilities in the timeframes set forth in Section 2.5 to Snowflake’s satisfaction, Snowflake may terminate the Agreement for material breach upon notice to Vendor without any cure period.

6.2.   Audit Rights.

6.2.1.   At no additional cost to Snowflake, Vendor shall provide Snowflake, or its qualified third-party representative, access to Vendor Personnel, and to reasonably requested documentation, logs, and data evidencing Vendor’s compliance with its obligations under this Security Agreement and other access as reasonably necessary to allow Snowflake to review Vendor’s security and privacy controls and supporting practices and procedures.

6.2.2.   If the audit specified above reveals that Vendor does not meet any of the requirements of this Security Agreement or the Agreement, or where Snowflake identifies a vulnerability or security risk, then Vendor will reasonably cooperate with Snowflake in the resolution of such vulnerability or risk and will provide evidence of such remediation efforts to Snowflake within the timeframe specified by Snowflake. If Snowflake determines, in its reasonable discretion, that Vendor does not or cannot sufficiently remediate such security risk or a violation of this Security Agreement, Snowflake may terminate the Agreement upon notice to Vendor.

7.     Additional Requirements

7.1.   The parties acknowledge and agree that they will comply with additional requirements as are set forth in the applicable Statement(s) of Work, including commitments required to be flowed-down by Snowflake to Vendor as a result of Snowflake’s commitments to a particular Customer.