Solutions · Snowflake

A warehouse with no PII in it.

The native Snowflake connector tokenizes before data lands: analysts join, cohort, and share on tokens — detokenization only under policy, only for permitted roles.

Buyer pains

Why this buyer hurts.

PII in every table

Pipelines copy identifiers into raw, staging, and mart layers — each a scope expansion.

Share anxiety

Data shares and clean rooms leak sensitivity the moment a partner gets SELECT.

Cloned sprawl

Zero-copy clones multiply PII across teams and time-travel windows.

How cloakit fixes it

Tokenize in the warehouse pipeline.

The native connector sits in the ingestion path: Snowflake stores tokens, analytics runs unchanged, and any re-identification is a governed, audited vault operation — not a SQL query.

Native Snowflake connector: tokenized ingestion, stable token keys, and policy-gated reverse lookups.

How it runs

The workflow, end to end.

Tokenize in the pipeline

Source and stream ingestion posts identifiers to cloakit first; only tokens land in raw tables.

Analyze unchanged

Joins, cohorts, and shares run on token keys — analysts keep their SQL, minus the liability.

Resolve under policy

Permitted roles detokenize through the vault with actor, purpose, and region logged per call.

Questions

Asked by teams like yours.

Do joins still work?

Yes — deterministic tokens preserve equality, so existing join keys and cohort logic behave identically.

What about Snowflake shares?

Shares expose tokens, not values. Partners analyze shapes; sensitivity never crosses the share boundary.

Can we backfill history?

Yes — run historical columns through the vault once; downstream tables keep working on the resulting tokens.

See it on your own workflow.

Bring one sensitive flow. We will map it to a vault schema live in 30 minutes.

Get a Demo See the API pattern

Ingestion path

Tokens land; PII never does.

Sources post identifiers to cloakit first. The warehouse, shares, and clones hold tokens — re-identification is a governed vault operation, not a SQL query.

%%{init: {'flowchart': {'curve': 'linear'}, 'theme': 'base', 'themeVariables': {'primaryColor': '#ffffff', 'primaryBorderColor': '#2457C5', 'primaryTextColor': '#101828', 'lineColor': '#2457C5', 'fontFamily': 'IBM Plex Sans, sans-serif', 'fontSize': '14px'}}}%% flowchart LR S["Sources + streams"] --> T["Tokenize gate
cloakit"] T --> B["Bronze
tokens only"] B --> M["Marts + shares
joins on token keys"] M --> R{"Re-identify?"} R -- policy allow --> V["Vault resolve + audit"] R -- default --> X["Denied"]

Native connector

Snowflake

The native connector tokenizes on the way in — tables, shares, and clones hold tokens from the first write.

Also connects

Databricks

BigQuery

ClickHouse

DuckDB

Trino

Third-party names and marks are property of their respective owners, listed for compatibility.