Security and Privacy

Omnata Sync is delivered as a Snowflake Native Application.

This means that each customer has a dedicated instance of the application, running within the controlled boundary of their Snowflake account. You can read an overview of the security advantages that the Native Applications Framework offers here.

Installation

The Omnata Sync Engine is installed by user with the Snowflake ACCOUNTADMIN role, from the Snowflake Marketplace. This creates a special type of database in your Snowflake account, known as an "application". It contains all of the application code required to configure, schedule and observe data sync tasks.

In addition to this, plugin applications are installed from the Marketplace, which contain the application code that communicates with a particular application. The Sync Engine uses these plugins to read data from and/or write data to the application.

In both cases, these applications start with no privileges to access any tables or other objects within the Snowflake account. These are granted as part of the configuration process, for example if you wanted to sync a Leads table to Salesforce, you would first grant select privileges on it to the Sync Engine application.

Installing an application does not give the application provider (Omnata) any access into your Snowflake account.

After a consumer installs an application in their account, Omnata is made aware via records in the LISTING_EVENTS_DAILY shared table. This provides us with contact details of the person who installed the app, and we will send an automated welcome email. Note that this process does not provide us with any access to your Snowflake account, it is simply a feed of admin contact information.

Configuration

Omnata Sync includes an administration User Interface built with Streamlit, and this runs on a warehouse chosen by the end user.

Network access

In order to sync data with external systems, three features are used by the Sync Engine:

• Network rules are used to permit communication with specific domains

• Secrets are used to securely store credentials within the Snowflake account

• External access integrations are used to tie network rules and secrets together and collectively permit API calls to be made to applications. External Access Integrations require the ACCOUNTADMIN role to configure, and can not be directly created by the application.

Data Storage

All configuration data, sync run history and record data are stored as Snowflake tables inside the native application instance. Omnata do not have access to this information.

These tables are equivalent to any other regular table in the customer's Snowflake account in terms of how data is encrypted and secured.

Support

Omnata's application code logs messages and trace events to the local event table, if configured. The customer can query these logs to see error messages logged by background processes, as well as other debugging information.

In order to diagnose the cause of problems, Omnata may ask the consumer to enable event sharing. This is optional and can be revoked at any time.

Application Upgrades

Omnata can deploy new versions of the Sync Engine and plugins, by publishing new versions and assigning them to accounts via release directives. Again, this does not give us any form of access into the consumer's account. The upgrade process is managed by Snowflake, we only have visibility of whether or not the upgrade process succeeded, and any error messages.

Architecture diagram