Snowflake Sub-Processors

This document is Snowflake's Sub-processor and Affiliates disclosure page, governing the engagement of third-party data processors and Snowflake-affiliated entities authorized to process Customer Data in connection with Snowflake's cloud data platform services, with Standard Contractual Clauses (SCCs) serving as the stated transfer mechanism for all listed entities. The document states that customers with an executed Data Processing Agreement (DPA) may object to a new Third-Party Sub-processor by notifying privacy@snowflake.com within twenty-eight days of Snowflake's notice of such new sub-processor, with objections handled as described in the applicable DPA. The document identifies three primary cloud infrastructure sub-processors (Amazon Web Services, Microsoft Azure, and Google Cloud Platform) as customer-selected for hosting and infrastructure, with Cloudflare listed as an optional sub-processor for R2 cloud storage in connection with the Egress Cost Optimizer feature, and AWS additionally engaged for specific feature-level functions including Data Clean Rooms, native app security scanning, and cross-region inference for the Cortex feature. This disclosure engages the EU General Data Protection Regulation (GDPR), specifically the requirements of Commission Decision (EU) 2021/914 SCCs including Clause 14(c) third-country assessment obligations, as well as the UK International Data Transfer Addendum issued under the Data Protection Act 2018; customers in EU, EEA, and UK jurisdictions face heightened compliance obligations when evaluating cross-region data flows, particularly for Cortex cross-region inference functionality which routes data across AWS, Azure, and GCP regions. Compliance teams should note that Clause 14(c) assessments for applicable third countries are available only upon request to privacy@snowflake.com, requiring affirmative action by customers to obtain transfer impact documentation necessary for their own GDPR accountability obligations.