Transcend Docs
Integrations

Snowflake Integration

Learn how to connect Snowflake to Transcend using Programmatic Access Tokens (PAT) or OAuth, configure permissions and network policies, and enable Structured Discovery, DSR Automation, and Preference Management.

Overview

Transcend's Snowflake integration enables comprehensive data privacy automation across your Snowflake data warehouse through Structured Discovery, DSR Automation, and Preference Management.

Connect your Snowflake data warehouse to Transcend to:

  • Discover and classify personal data automatically across your schemas
  • Automate Data Subject Requests (DSRs) by executing SQL queries to fulfill access, erasure, and other privacy requests
  • Sync user preferences to ensure consent choices are consistently honored across your data warehouse

This integration uses the ODBC framework and supports both OAuth and Programmatic Access Token (PAT) authentication methods.

Note: Snowflake deprecated username & password authentication in November 2025. Use OAuth or PAT authentication instead.

Prerequisites

Before connecting, ensure you have:

  • Snowflake Account Access: Administrative access to create users and security integrations
  • User Permissions: A user with access to a default warehouse and relevant databases/schemas
  • Network Access: Transcend's IPs allowlisted in your Snowflake account (if using network policies)

Required Permissions

Your Snowflake user needs:

  • A default_warehouse assigned with sufficient compute resources
  • A role with permission to access that warehouse
  • For Structured Discovery: USAGE on databases/schemas and SELECT on tables
  • For DSR Automation: Additional DELETE or UPDATE permissions for privacy requests

Connecting Your Snowflake Integration

Snowflake Authentication Deprecation

Important: Snowflake deprecated username & password authentication in November 2025. Use OAuth or Programmatic Access Tokens (PAT) for all new and existing Transcend Snowflake integrations.

Step 1: Add the Integration

  1. In the Transcend Admin Dashboard, go to Infrastructure > Integrations.
  2. Click + Add Integration to open the integration catalog.
  3. Search for Snowflake and click the Snowflake tile.
  4. Click + Add to create a new Snowflake integration.
  5. Provide a descriptive title and assign an owner.
  6. Click Continue to Connection Details.

Step 2: Choose Authentication Method

In the integration, click Connect → Connection Details and select your authentication method:

  • PAT (Programmatic Access Token) – Recommended for automated services.
  • OAuth – Recommended for interactive use.

Authentication Method 1: Programmatic Access Token (PAT)

PATs are ideal for service-style, non-interactive connections.

Note: PATs expire (default 15 days, maximum 365 days). You'll need to refresh them periodically.

1. Create a service user with warehouse access

Run in Snowflake:

CREATE OR REPLACE USER TRANSCEND_USER 
  DEFAULT_ROLE = BASIC 
  DEFAULT_WAREHOUSE = COMPUTE_WH;

GRANT ROLE BASIC TO USER TRANSCEND_USER;
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO USER TRANSCEND_USER;
ALTER USER TRANSCEND_USER SET TYPE = 'SERVICE';

Ensure the assigned role has USAGE and SELECT (and, if needed, UPDATE/DELETE) on the relevant databases and schemas.

2. Create and assign a network policy

Allowlist Transcend's IPs using a Snowflake network policy:

CREATE OR REPLACE NETWORK POLICY TRANSCEND_ACCESS_POLICY 
  ALLOWED_IP_LIST=(
    '34.252.15.52/32', '99.81.28.239/32', '52.215.231.215/32', 
    '63.34.48.255/32', '34.249.254.13/32', '54.75.178.77/32'
  );

ALTER USER TRANSCEND_USER SET NETWORK_POLICY = TRANSCEND_ACCESS_POLICY;

For self-hosted Sombra, include your Sombra cluster's IP addresses instead of, or in addition to, the above.

Also ensure:

  1. Transcend's backend IPs are allowlisted (see the Sombra networking docs for your region and deployment model).
  2. Sombra IPs are allowlisted, whether you use multi-tenant Transcend-hosted Sombra or self-hosted Sombra.

3. Generate a PAT

  1. Confirm no authentication policy blocks PAT generation (see Snowflake's authentication policy requirements).
  2. In Snowflake, go to Admin > Users & Roles > Programmatic Access Tokens.
  3. Click Generate New Token for TRANSCEND_USER (or your chosen service user).
  4. Copy and store the token securely; you will not be able to view it again.

4. Connect in Transcend (PAT)

In the Snowflake integration connection form, fill in:

  • Account Identifier – As shown in Snowflake (see Snowflake docs for how to find it).
  • Username – Your service user, e.g. TRANSCEND_USER.
  • Programmatic Access Token – The PAT you generated.
  • Warehouse – The warehouse name, e.g. COMPUTE_WH.

Click Connect to establish the connection.

Authentication Method 2: OAuth

OAuth is best for interactive, user-based access and supports refresh tokens.

Note: OAuth requires periodic re-authentication. Refresh tokens expire based on your configuration (default 90 days).

Requirements

You will need two Snowflake users:

  • An admin user with the ACCOUNTADMIN role to create the security integration.
  • A non-admin user with database access, but without ACCOUNTADMIN, SECURITYADMIN, GLOBALORGADMIN, or ORGADMIN roles.

1. Create a security integration (as admin)

Run as an ACCOUNTADMIN user:

CREATE OR REPLACE SECURITY INTEGRATION "TRANSCEND_OAUTH"
  ENABLED = TRUE
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://api.transcend.io/integration/snowflake/cb'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;

For US Region: Use https://api.us.transcend.io/integration/snowflake/cb

2. Retrieve client credentials:

WITH INTEGRATION_SECRETS AS (
  SELECT parse_json(system$show_oauth_client_secrets('TRANSCEND_OAUTH')) AS SECRETS
)
SELECT 
  SECRETS:"OAUTH_CLIENT_ID"::STRING AS CLIENT_ID,
  SECRETS:"OAUTH_CLIENT_SECRET"::STRING AS CLIENT_SECRET
FROM INTEGRATION_SECRETS;

3. Set up a non-admin user:

Ensure this user has:

  • Access to relevant databases/schemas
  • A default warehouse assigned
  • Required permissions (see Required Permissions)
  • No admin roles that block OAuth

Grant permissions for Structured Discovery:

GRANT USAGE ON DATABASE <database_name> TO ROLE <role_name>;
GRANT USAGE ON SCHEMA <schema_name> TO ROLE <role_name>;
GRANT SELECT ON ALL TABLES IN SCHEMA <schema_name> TO ROLE <role_name>;
GRANT SELECT ON FUTURE TABLES IN SCHEMA <schema_name> TO ROLE <role_name>;

4. Create and Assign a Network Policy

Follow Snowflake's network policy requirements to allowlist these IPs:

CREATE OR REPLACE NETWORK POLICY TRANSCEND_ACCESS_POLICY 
  ALLOWED_IP_LIST=(
    '34.252.15.52/32', '99.81.28.239/32', '52.215.231.215/32', 
    '63.34.48.255/32', '34.249.254.13/32', '54.75.178.77/32'
  );

ALTER USER TRANSCEND_USER SET NETWORK_POLICY = TRANSCEND_ACCESS_POLICY;

For self-hosted Sombra, include your Sombra cluster's IP addresses instead.

Please ensure that:

  1. Transcend’s backend IPs are allowlisted. See Configure a load balancer.
  2. Sombra IPs are allowlisted, whether you use multi-tenant Sombra or self-hosted Sombra.

Connect in Transcend

  1. Fill out the connection form:
    • Account Identifier: Find yours in Snowflake's account identifier docs
    • Client ID: From the security integration
    • Client Secret: From the security integration
    • Warehouse: Your warehouse name (e.g., COMPUTE_WH)
    • Run Query Async: If selected, this runs queries asynchronously during DSR processing. See the "Recommendations for Large Queries" section below for more details.
  2. Click Connect with OAuth or Connect.
  3. (For OAuth) Log in using your non-admin user (from step 3 above)

Troubleshooting OAuth Errors:

  • "Invalid consent request": Check user has proper role assignment and doesn't have blocked admin roles
  • "Unexpected error": Verify IP addresses are allowlisted in your network policy

Next Steps

After connecting your Snowflake integration:

1. Enable Structured Discovery

Navigate to the Structured Discovery tab to automatically scan and classify personal data:

  1. Choose a Scan Type:
    • Discovery Scan: Extract schemas for DSR/Preference Management
    • Discovery + Classification Scan: Identify and categorize sensitive data
    • Classification Scan: Re-classify data with stable schemas
  2. Enable Recurring Scans and set frequency
  3. Click Save to start scanning

Learn more about Structured Discovery →

2. Configure DSR Automation

Set up automatic fulfillment of Data Subject Requests:

  1. Go to Manage Datapoints to review discovered tables
  2. Assign data categories to columns
  3. Configure SQL queries for Access, Erasure, and other request types
  4. Test with a sample request
  5. Enable DSR Automation Live Mode

Learn more about DSR Automation →

3. Set Up Preference Management (Optional)

Sync user consent preferences into Snowflake tables to ensure preferences are honored across your data warehouse.

Learn more about Preference Management →

Recommendations for Large Queries

It's highly recommended to enable asynchronous query execution to prevent OOM and timeout issues if you anticipate large amounts of data to be queried during Data Subject Request execution. When "Run Query Async" is enabled via the connection form, we process data subject requests using Snowflake SDK's asynchronous and pagination capabilities. This has proven to be more reliable than the synchronous ODBC method.

Note: When "Run Query Aysnc" is disabled, we automatically apply the column constraints "default_varchar_size" and "default_binary_size" to prevent OOM issues, as recommended by Snowflake documentation. This means VARCHAR and BINARY data are automatically truncated if over 260kb.

Additional Resources

Need help? Contact your Transcend representative or email support@transcend.io

Salesforce Integration Set Up for DSR Automation

Previous Page

Tableau Integrations

Next Page

On this page

OverviewPrerequisitesRequired PermissionsConnecting Your Snowflake IntegrationStep 1: Add the IntegrationStep 2: Choose Authentication MethodAuthentication Method 1: Programmatic Access Token (PAT)1. Create a service user with warehouse access2. Create and assign a network policy3. Generate a PAT4. Connect in Transcend (PAT)Authentication Method 2: OAuthRequirements1. Create a security integration (as admin)Connect in TranscendNext Steps1. Enable Structured Discovery2. Configure DSR Automation3. Set Up Preference Management (Optional)Recommendations for Large QueriesAdditional Resources