Your data never leaves Snowflake
Data Shepherd installs as a Snowflake Native App and runs entirely inside your own account. Rules execute on your own Snowflake compute. Raw data, rows and query results are never copied out - there is zero data egress by design.
Security starts with where the work runs.
Most monitoring tools ask you to ship data to them. Data Shepherd does the opposite: the monitoring runs next to your data, so the data never has to travel to be watched.
Runs inside your account
Installed from the Snowflake Marketplace as a Native App. Rules run on your own Snowflake compute - there is no separate environment that holds your data.
Zero data egress
Your rows, query results and table samples are never copied outside your Snowflake account. There is no connector reaching in and no pipeline reaching out.
Governed by your controls
The network policies, encryption and access controls that already protect your Snowflake account apply to Data Shepherd too - because it runs there.
What stays, and what moves.
The honest distinction is between your data and the small amount of information needed to tell you something is wrong. The first never leaves. The second only moves when you ask it to.
Your data stays in Snowflake
Rows, column values, query results and samples are read in place to run a check and are not extracted, copied or retained outside your account.
Results stay in your account
Data Shepherd stores the outcome of each rule - a status, counts and, for many rules, example values from the columns they check, such as duplicated or out-of-range entries. All of it sits in the app's own tables inside your account, and none of it is visible to us.
Alerts move only when you configure them
Email and webhook alerts go out through Snowflake's own notification service, to the channels you set up. An alert names the table, the rule, the column and the number of affected rows - not the rows themselves. The app makes no outbound network call of its own.
No second access model to manage.
Data Shepherd uses the permission system you already run. There is no parallel set of users, keys or roles to provision, review or revoke.
You install it
The app is installed into your account by a role you choose. You decide which tables it can read by connecting them - nothing is assumed.
Read-only, table by table
The app's only access to your data is SELECT on the tables you connect. No rule writes to, updates or deletes a row, and you can disconnect any table at any time.
Scoped to what it needs
Beyond those tables, the app asks for two task privileges that serve its own scheduling task, and nothing else. It declares no external network access and stores no credential, token or webhook URL.
Everything is logged
Rule changes, runs, alerts and acknowledgements are recorded in tables you can query. The app's queries also appear in your Snowflake query history, although Snowflake hides the query text of a packaged app.
Reporting a security issue.
If you believe you have found a security vulnerability in Data Shepherd, please tell us. We welcome reports from customers and researchers, and we will not pursue action against anyone acting in good faith.
How to reach us
Email security@datashepherd.app with enough detail to reproduce the issue. Please give us reasonable time to investigate and fix a problem before disclosing it publicly, and do not include real customer data or production secrets in your report. We will acknowledge your report and keep you updated as we work through it.
For anything that is not a security issue, use our contact page.