3.6 Snowflake Editions & Compliance Architecture (PCI DSS, PII & PHI)

Why Editions Are an Architecture Decision

The edition determines per-credit and storage prices and which security, governance, and continuity features exist. Because editions are chosen per account, architects often mix them inside one organization: a Business Critical account for regulated data, Enterprise accounts for general analytics, and sometimes Standard for sandboxes (Section 1.1).

Feature-to-Edition Map (Exam Essentials)

Features available in every edition include Snowpark, Streamlit in Snowflake, dynamic tables, external and Iceberg tables, schema detection and evolution, external functions and external access, clustering with automatic maintenance, and resource monitors.

Exam Trap: "Replication requires Business Critical" is only half true. Database and share replication work in all editions; replicating other account objects (users, roles, warehouses, network policies, integrations) and failover/failback require Business Critical.

Compliance Scenarios

Personal Data (PII)

PII rules (for example GDPR or state privacy laws) are met with governance design more than with an edition switch:

• Classify data to find PII, then protect it with tag-based masking, row access policies, and projection or aggregation policies (Enterprise).
• Keep regional data in accounts deployed in the required cloud region; replicate only what policy permits.
• Use ACCESS_HISTORY (Enterprise) to prove who read which columns, and Time Travel retention settings plus deletion processes to honor retention limits.

Protected Health Information (PHI)

• Snowflake supports PHI subject to HIPAA and HITRUST CSF only on Business Critical Edition or higher.
• A signed business associate agreement (BAA) between the customer and Snowflake must be in place before any PHI is stored.
• Typical architecture: a dedicated Business Critical account for clinical data, private connectivity, Tri-Secret Secure if the organization wants control of a key, and shares or replication to other accounts only for de-identified data.

Payment Card Data (PCI DSS)

• PCI DSS support is a Business Critical capability.
• Reduce scope: tokenize card numbers before loading (External Tokenization, Section 3.4) so most accounts and roles never touch real card data.
• Isolate the cardholder-data environment in its own account, restrict inbound access with private connectivity and network policies, and restrict unloading with PREVENT_UNLOAD_TO_INLINE_URL and storage-integration-only stages (Section 8.4).

Government and Regulated Regions

• Business Critical supports public-sector workloads such as FedRAMP and ITAR (in the appropriate government regions) and IRAP Protected data in specified Asia Pacific regions.
• Organizations that mix government and commercial regions ("hybrid organizations") should place the organization account in the regulated region, because organization-level features can move metadata between regions.

Virtual Private Snowflake (VPS)

VPS includes everything in Business Critical but runs in a completely separate Snowflake environment with its own metadata store and compute pool; it shares no hardware with accounts outside the VPS and encrypts internal traffic between its components. It suits institutions whose risk policies prohibit multi-tenant infrastructure.

Designing for Cost and Compliance Together

Organization
├── prod_phi      (Business Critical, AWS us-east-1)  PHI, BAA signed, PrivateLink, Tri-Secret Secure
├── prod_general  (Enterprise, AWS us-east-1)         De-identified analytics via secure share
└── dev_sandbox   (Standard or Enterprise)            Synthetic or masked data only

Only the account that must meet the regulation pays Business Critical prices, and data leaves it only through controls the architect chooses (secure views, aggregation policies, de-identification pipelines).

Mapping Requirements to Snowflake Controls

Compliance questions on the exam usually hide a requirement inside a scenario. This table translates common requirement phrases into the Snowflake capability and minimum edition:

Two recurring reasoning patterns:

1. Pick the lowest edition that satisfies every stated requirement. If a scenario needs masking and 30-day Time Travel but nothing from Business Critical, Enterprise is the correct, cheaper answer.
2. Isolate regulated workloads in their own account. Because edition is per account, a single Business Critical account can host regulated data while other accounts in the organization stay on Enterprise or Standard, connected through secure shares or replication of de-identified data.