About the Client
The client is a well-established regional bank with a multi-state presence, offering retail banking, commercial lending, investment services, and digital banking products.
Operating in a highly regulated industry, the bank manages large volumes of sensitive customer and financial data while maintaining strict requirements around privacy, security, governance, and regulatory compliance.
Background
The bank had centralized its analytical and operational data within Snowflake, creating a scalable foundation for reporting, analytics, risk management, compliance, and application development.
As adoption increased, more teams—including Marketing, Compliance, Risk, and Development—required access to shared datasets. Traditional access controls were no longer sufficient to manage sensitive information at the level of granularity the organization required.
Personally Identifiable Information (PII), account information, and other confidential financial data needed to remain protected while still allowing authorized users to access the information required for their roles.
The bank needed a centralized, scalable approach to data access that could protect sensitive fields without creating a growing network of custom views and manually maintained access rules.
The Challenge
Expanding data access introduced several security, governance, and operational challenges.
Administrative Overhead: Maintaining multiple access rules and custom views required significant manual effort and became increasingly difficult to manage as the user base expanded.
Fine-Grained Access Requirements: Different teams needed varying levels of visibility into the same datasets, requiring access controls at the individual column level.
Regulatory Compliance: Requirements associated with GLBA, GDPR, CCPA, and PCI DSS demanded strong protection of sensitive data, consistent policy enforcement, and reliable auditability.
Risk of Over-Privileged Access: Broad permissions could expose sensitive information to users who did not require it for their responsibilities.
Data Duplication & Inconsistency: Creating separate views for different teams resulted in duplicated logic and increased the risk of inconsistent access controls.
Secure Development & Testing: Developers needed realistic, production-like datasets for QA and testing without gaining access to actual customer PII.
The client needed a security model that could provide granular access while remaining manageable, auditable, and scalable.
The Solution
The client partnered with Supply Medium to implement a centralized data security and governance framework within Snowflake, combining sensitive data discovery, persona-based access design, static masking, dynamic masking, automated policy deployment, and comprehensive auditing.
Sensitive Data Discovery & Classification
Snowflake’s data classification capabilities were used to identify and categorize sensitive information across the data environment.
Columns containing information such as SSN, EMAIL, ACCOUNT_NUMBER, and DOB were identified and tagged, creating a consistent foundation for applying security and masking policies.
This reduced reliance on manual identification and helped ensure that sensitive information was governed consistently across datasets.
Persona-Based Access Design
Supply Medium designed visibility rules around defined user personas and Snowflake roles.
Examples included:
MARKETING_ANALYST — Access to customer information required for marketing analysis while restricting unnecessary sensitive financial or identity data.
RISK_MODELER — Controlled access to information required for risk analysis and modeling.
COMPLIANCE_OFFICER — Broader authorized visibility to support regulatory monitoring, investigation, and compliance requirements.
This role-based approach ensured that users could access the information necessary for their responsibilities while minimizing unnecessary exposure.
Static Data Masking for Development & QA
For non-production environments, sensitive PII was permanently tokenized or transformed before being made available to developers and QA teams.
This provided realistic datasets for testing while preventing actual customer information from being exposed outside authorized production workflows.
Development teams could work with production-like data structures and patterns without compromising customer privacy.
Dynamic Data Masking in Production
For production workloads, Snowflake Masking Policies were implemented to dynamically control how sensitive information appeared at query time.
SQL-based policy logic evaluated the user’s role and returned the appropriate representation of each protected field.
Depending on authorization, data could be:
- Fully masked, such as SSNs displayed as
***-**-**** - Partially revealed, such as displaying only selected digits of an account number
- Hashed or transformed, including protected email values
- Returned as null for roles without appropriate authorization
- Fully visible to explicitly authorized users
Because masking occurred dynamically at query time, teams could work from shared datasets without requiring separate physical copies or custom views for every access scenario.
Automated Policy Deployment
Masking policies were associated with Snowflake roles and incorporated into automated CI/CD processes across development, QA, and production environments.
This created a repeatable deployment model and reduced the risk of configuration inconsistencies between environments.
Centralized policy management also simplified future updates as roles, regulatory requirements, and business needs evolved.
Auditability & Compliance Monitoring
Snowflake’s ACCESS_HISTORY and QUERY_HISTORY capabilities were leveraged to provide visibility into how data was accessed and queried.
These audit trails helped compliance and security teams investigate access patterns, validate policy enforcement, and provide supporting evidence during internal and regulatory reviews.
The Outcome
The Snowflake data security framework strengthened protection of sensitive banking information while simplifying access management across the organization.
Consistent Data Protection: Masking policies were applied uniformly across roles and environments, reducing the risk of unauthorized exposure of PII and financial data.
Simplified Compliance: Centralized and automated policy enforcement improved audit readiness and supported the bank’s requirements related to GLBA, GDPR, CCPA, and PCI DSS.
30% Faster Data Provisioning: Developers gained secure access to masked, production-like data while provisioning delays were reduced by approximately 30%.
Reduced Administrative Overhead: Centralized column-level policy management eliminated the need to maintain numerous role-specific custom views.
Safer Development & QA: Teams could test applications and workflows using realistic data without exposing genuine customer PII.
Greater Platform Confidence: Secure, role-appropriate access encouraged broader adoption of Snowflake while giving stakeholders greater confidence in the organization’s data governance practices.