One Snowflake, A number of Vaults: A Resolution to Information Residency

Information residency necessities, which govern the place delicate knowledge could be saved or processed within the cloud (or in an on-prem server) are a standard function of many trendy knowledge safety legal guidelines. Due to knowledge residency necessities, the placement of delicate knowledge has vital regulatory compliance implications in nations and areas around the globe.

On this put up, we’ll take a look at the challenges of managing knowledge residency with Snowflake. We’ll begin by analyzing how Snowflake Cloud Areas handle knowledge residency challenges, and take into account the compliance implications of this method — particularly when loading knowledge from cloud storage. Then, we’ll take a look at the way to simplify knowledge residency compliance utilizing a number of regional knowledge privateness vaults.

Let’s start with a deeper dive into knowledge residency, and the way it impacts compliance.

If you work with personally identifiable info (PII), the place you retailer and course of this info has a direct affect in your authorized compliance necessities. Some jurisdictions have rules that govern the safety and privateness of their residents’ PII, proscribing how and the place it’s utilized by companies and different organizations.

For instance, the non-public knowledge (i.e., PII) of European Union residents can’t be transferred exterior the EU with out acceptable safeguards.

The legal guidelines of every jurisdiction affect the way you transmit, handle, course of, and retailer delicate knowledge in that jurisdiction. As a result of knowledge residency dictates the place (geographically ) knowledge is saved within the cloud, knowledge residency turns into a important concern in cloud environments that deal with delicate knowledge.

Cloud service suppliers have knowledge facilities positioned in a number of areas around the globe. When companies join cloud providers and configure storage areas and different tooling, they choose particular areas the place their knowledge is saved.

For a lot of companies, the number of areas and places for knowledge storage is an afterthought.

However, treating this resolution as an afterthought is a pricey mistake that may come again to hang-out you when you’re dealing with delicate knowledge. That’s as a result of selecting storage areas is a weighty resolution that may have a long-term affect on compliance, and on your online business operations.

Snowflake Cloud Areas allow you to select the geographic location the place your Snowflake knowledge is saved throughout the info facilities offered by the Snowflake-supported public cloud suppliers — AWS, GCP, and Azure. Every cloud supplier provides a set of areas throughout the globe, with particular geographic knowledge middle places in every cloud supplier area.

If your organization makes use of Snowflake Cloud Areas, you might have your alternative of suppliers, in addition to areas the place your knowledge could be saved. If you create an account to deploy and arrange Snowflake, whichever area you choose turns into the first location for knowledge storage and for knowledge processing assets.

At first look, it’d seem to be Snowflake Cloud Areas supplies a easy, efficient answer to your knowledge residency and compliance considerations. However for world firms who want world analytics, it isn’t that straightforward. That’s as a result of, as famous within the Snowflake Cloud Areas documentation:

Every Snowflake account is hosted in a single area. When you want to use Snowflake throughout a number of areas, you could preserve a Snowflake account in every of the specified areas.

Which means that for every area the place your online business operates that has knowledge residency necessities, you’ll want a special Snowflake account hosted in that area. Compliance turns into more and more complicated as you scale globally to increasingly more areas around the globe. With this method, working world analytics operations throughout totally different accounts to get a complete view of your online business is usually a large and ongoing problem.

As a substitute of managing a number of Snowflake accounts with a number of Snowflake cases distributed in varied areas around the globe, you’d reasonably preserve a Snowflake occasion in a single area to help world knowledge operations. Nevertheless, you continue to want to think about the necessity to honor knowledge residency necessities for delicate knowledge so you possibly can uphold your compliance obligations and safeguard buyer belief.

For instance, when you accumulate the non-public knowledge (PII) of consumers positioned within the EU, however your Snowflake occasion is positioned some place else, then you should suppose by way of the privateness and compliance affect of storing and processing that knowledge.

Snowflake additionally lets companies load knowledge from cloud storage providers like AWS S3, Google Cloud Storage, Microsoft Azure — no matter which cloud platform hosts the companies’ Snowflake account. This may current further challenges when working to make sure knowledge residency compliance.

For instance, let’s say that your organization collects PII from each US and EU clients utilizing its web site. And, let’s say that this delicate knowledge is then saved in a Google Cloud Storage bucket that’s positioned within the AUSTRALIA-SOUTHEAST1 (Sydney) area.

How does transmitting this PII knowledge to Australia, after which storing it in Australia, have an effect on your compliance with rules just like the EU’s GDPR?

The reply is: doing this possible places you out of compliance with GDPR. This is only one instance of how the placement the place delicate knowledge is saved — and the place it’s processed and replicated — complicates the compliance necessities confronted by companies that deal with delicate PII.

Companies that deal with PII should guarantee regulatory compliance by aligning their alternative of cloud storage areas with the info residency necessities of markets the place they function.

And past compliance points, companies must also take into account knowledge switch prices. Transferring knowledge between cloud storage areas can incur vital further prices, particularly if your organization is regularly transferring massive volumes of knowledge. So, we not solely have compliance considerations with cross-border transfers of PII, we even have a price concern.

So, to briefly recap our drawback:

• Nations and areas have their very own legal guidelines and rules that govern the way to deal with their residents’ delicate knowledge (PII).
• The geographic location the place your online business shops and processes delicate knowledge impacts whether or not you’re compliant with the knowledge residency necessities of the markets the place you use.
• When you use Snowflake to carry out analytics on PII, then the complexity of assembly your compliance obligations will depend upon the placement of your Snowflake account.
• When you load PII knowledge into Snowflake from cloud storage, then your compliance obligations are additionally impacted by the placement of your cloud storage.

So, how can we meet knowledge residency necessities, help world analytics operations, and take away the operational overhead of managing a number of Snowflake accounts and cases?

We are able to clear up our knowledge residency issues and defend delicate knowledge with a number of knowledge privateness vaults.

A knowledge privateness vault isolates, protects, and governs entry to delicate buyer knowledge. Delicate knowledge is saved within the vault, whereas opaque tokens that function references to this knowledge are saved in conventional cloud storage or utilized in knowledge warehouses. An information privateness vault can retailer delicate knowledge in a particular geographic location, and tightly controls entry to this knowledge. Different methods solely have entry to non-sensitive tokenized knowledge.

Within the instance structure proven under, a telephone quantity is collected by a entrance finish utility. Ideally, we should always de-identify (i.e., tokenize) this delicate info as early within the knowledge lifecycle as potential. An information privateness vault lets us do exactly that.

This telephone quantity, together with another PII, is saved securely within the vault, which is remoted exterior of your organization’s present infrastructure. Any downstream providers — the applying database, knowledge warehouse, analytics, any logs, and many others. — retailer solely a token illustration of the info, and are faraway from the scope of compliance:

As a result of no delicate knowledge is saved exterior the info privateness vault, your compliance scope is restricted to simply the vault. This removes the compliance burden out of your Snowflake occasion.

To fulfill knowledge residency necessities, we will prolong this method by utilizing a number of regional knowledge privateness vaults positioned close to clients whose knowledge is topic to those necessities. With delicate knowledge saved in these knowledge privateness vaults, Snowflake accommodates solely de-identified, tokenized knowledge. It now not issues when you function a single world occasion of Snowflake or a number of Snowflake accounts throughout totally different areas as a result of knowledge residency considerations now not apply to your Snowflake cases.

Compliance with knowledge residency necessities now relies upon solely on the place your knowledge privateness vaults are positioned. You now not want to fret about knowledge residency for all of the totally different components of your knowledge tech stack, together with cloud storage and Snowflake. All delicate knowledge goes into your knowledge privateness vaults, and these vaults turn into the one element of your structure topic to knowledge residency necessities.

With Skyflow Information Privateness Vault you possibly can host your vaults in all kinds of areas around the globe. You can too route delicate knowledge to a knowledge privateness vault positioned in a particular area for storage.

For instance, take into account how the applying structure proven under helps knowledge residency necessities from a number of areas:

1. Your organization’s e-commerce website collects buyer PII each time a buyer locations an order.
2. On the consumer aspect, the web site detects the purchasers’ location.
3. Detecting that the client is within the EU, the client-side code makes use of Skyflow’s API to ship the PII knowledge to your organization’s knowledge privateness vault in Frankfurt, Germany.
   Observe: For patrons based mostly within the US, the PII knowledge is as an alternative routed to the info privateness vault within the US (on this case, Virginia).
4. This EU-based buyer’s delicate PII is saved within the EU-based knowledge privateness vault, and Skyflow’s API responds with tokenized knowledge.
5. The client-side code sends the client order request, now with tokenized knowledge, to the server.
6. The server processes the order, storing the info (now de-identified and tokenized) in cloud storage within the “Oregon, US” area.
7. On the finish of the week, your organization’s Snowflake occasion in Tokyo, Japan, masses the info (already de-identified and tokenized) from cloud storage to carry out analytics.

Through the use of a number of vaults positioned in several areas around the globe, you possibly can simply handle all your delicate knowledge to satisfy varied knowledge residency compliance obligations throughout every of your world markets.

The info privateness vault architectural sample vastly simplifies the challenges of knowledge residency and compliance. Moreover, by de-scoping Snowflake from the compliance burden of knowledge residency, world analytics executes as regular — inside a single Snowflake occasion.

Compliance rules and their knowledge residency necessities require that companies uphold stringent requirements for knowledge localization, safety, privateness, and safety to cut back their danger of breaches, penalties, and reputational harm. Nevertheless, companies with clients (and knowledge) positioned in quite a lot of world areas face the added problem of managing a number of rules throughout jurisdictions.

Utilizing knowledge privateness vaults lets companies simplify their world compliance obligations round knowledge residency as they relate to Snowflake and cloud storage.

Utilizing an information privateness vault, firms can isolate and safe all delicate knowledge in a number of knowledge privateness vaults, eradicating Snowflake and cloud storage from their compliance footprint. On the similar time, by leveraging knowledge privateness vaults in several areas, firms may help make sure that delicate knowledge is saved and transmitted based on the legal guidelines and rules of every particular area the place they function.