Snowflake Integration Overview
ALTR connects to a Snowflake account through a dedicated service user and Snowflake’s own policy framework — there is no proxy or agent to install between Snowflake and data consumers. Once connected, ALTR discovers schema, applies policy when a column or tag is connected, enforces access and detokenization in real time, and captures Database Activity Monitoring.
To set up the service user and required objects this integration depends on, see Connecting a Snowflake Account.
Schema Discovery
Section titled “Schema Discovery”ALTR discovers Snowflake schema on demand using Snowflake SHOW statements (for example, SHOW DATABASES, SHOW TABLES) rather than a cached snapshot — when you browse databases, schemas, tables, or columns in ALTR, ALTR queries Snowflake directly for the current object list.
Tag and Column Connections
Section titled “Tag and Column Connections”Connecting a Snowflake column or object tag to ALTR creates the Snowflake objects needed to enforce policy on it. ALTR supports four protection types — default masking, native masking, tokenization, and Format-Preserving Encryption (FPE) — and tag connections support all four; column connections support every type except native masking, which is the only one that skips the external-function call.
For the full protection-type list and how each is enforced, see Data Masking on Snowflake.
Real-Time Policy Enforcement and Detokenization
Section titled “Real-Time Policy Enforcement and Detokenization”When a Snowflake user queries a column or tag connected via an external-function protection type (default masking, tokenization, or FPE), Snowflake calls ALTR’s cloud through the external function integration for a real-time policy decision, which determines the masking type Snowflake applies to the result. Native masking policies evaluate entirely inside Snowflake, with no external call at query time.
Detokenization and FPE decryption on Snowflake both begin with the same external-function call used for the masking decision, which determines whether detokenization or decryption applies and whether the user receives an unmasked value at all. For detokenization, an additional external-function call then replaces the tokens with their real values. For FPE, an additional external-function call retrieves the decryption key, and decryption itself runs locally in a Snowflake UDF, not as part of the masking-decision call. Native masking does not support tokenization or FPE, since both require an external-function call.
Access Management Policy grants and Row Access Policy objects are applied to Snowflake independently of column/tag connection type. See Access Management Policy on Snowflake and Row Access Policy on Snowflake.
Database Activity Monitoring
Section titled “Database Activity Monitoring”Database Activity Monitoring on Snowflake captures SELECT queries against columns and tags connected through an external-function protection type (default masking, tokenization, or FPE). DDL statements, DML other than SELECT (INSERT, UPDATE, DELETE), DCL statements (GRANT, REVOKE), and queries that only touch non-connected columns are not captured. Columns or tags using native masking do not generate Database Activity Monitoring records, since there is no external function call to notify ALTR’s cloud that the column was queried.
For tag-based policies, audit records identify which tag and policy were evaluated; they do not include which specific column was accessed. Column-based policies include column schema location, but no tag information.
For what Database Activity Monitoring covers generally and how it surfaces in the dashboard and reports, see Query Log. For the OLTP sidecar’s capture model, see the OLTP data source.
Classification
Section titled “Classification”Classification always executes against Snowflake using the ALTR service user. ALTR-hosted classification jobs sample data from the connected Snowflake account and run classification in ALTR’s platform. In-Warehouse classification runs all classification activity locally in your Snowflake account, using your own warehouse compute. For classifier rule types and how classification jobs work, see Data Classification.
Object Tagging
Section titled “Object Tagging”ALTR also applies its own object tag, ALTR_GOVERNED, to the databases and warehouses it can see, at Snowflake’s request, so that ALTR-protected objects are identifiable in the Snowflake account. This tag is for visibility only — it has no bearing on policy enforcement and has no user-facing configuration.