One copy of the data,
shown to each by role
We set up and look after Snowflake accounts, with a role for each job, a warehouse for each workload that pauses when no one is querying, and sensitive columns masked by policy, so each team works from the same data, and sees what it may.
Thanks, we’ll be in touch soon.
{{ heroStatus }}
You’re in good company
A few of the companies we’ve worked with.
When each team copies the data out
Snowflake is a cloud data platform. An organization holds one or more accounts, and an account holds the databases and their tables, the users, the roles that decide what each user may do, and the warehouses: clusters of compute that run the queries. The tables sit in storage, and each warehouse is compute of its own that reads them, so two teams can each have a warehouse on the same tables.
Teams often copy what they need out of it anyway, into extracts, spreadsheets and databases of their own. Each copy starts to drift from the source the day it’s made, and each carries its own access, outside the account’s roles.
The copies aren’t needed for a team to work on its own. Inside an account, a team’s warehouse reads the same tables everyone else does. Between accounts, a share lets another account read the data without it being copied or moved.
So the real work is one copy of the data, with roles and policies that decide who sees what, and a warehouse for each team’s work.
What we build
Each account set up with a role for each job and a warehouse for each workload, and each change tried on a clone before it reaches the people who use the data.
Accounts set up for how you work
Databases for each stage, a role for each job and a warehouse for each workload, all written down as code, so an account can be set up again from what’s written.
Data loaded from the systems you run
Loads from your databases, apps and files on a schedule, or with Snowpipe as each file arrives, and every load checked before its tables are used.
Moved from the warehouse you have now
Moved table by table, each result compared with the old system’s before the old one is turned off.
Models your analysts can rely on
Raw data turned into tested tables, each with an owner and a description, so an analyst can tell where a figure comes from.
Each person sees what they may
Roles, masking policies and row access policies, so by role a column shows in full, in part or not at all, and a row shows or doesn’t. Both kinds of policy need Enterprise Edition or higher.
Services that sign in without passwords
Each service user moved to key pairs, OAuth or another method that needs no password, and each person who signs in with one given a second factor or single sign-on.
Warehouses sized to their work
Each warehouse sized to what it runs, paused when no one is querying, tagged with its team, and watched by resource monitors and budgets.
Tried on a clone first
A clone of production for each test, made without copying its data, and tables seen as they were before a change with Time Travel, within its retention period.
AI where it helps
Snowflake Cortex AI functions called in SQL where they answer a real question, with access to them granted by role, as for the rest of the account.
- Pipelines, lakes and reporting across tools:Data Engineering
- Machine learning in production:Data Platforms & MLOps
- A security review of what you run:Application Security
- Developers in your own team:Developers for your team
One table, and what each role sees
A masking policy is written once and set on a column. Each time someone queries the table, it decides by their role whether they see the value in full, in part or not at all, and the data stored in the table doesn’t change.
A row access policy does the same for rows: it decides which rows a role’s query returns. Both kinds of policy need Enterprise Edition or higher.
So one table can serve the front desk, the accounts team and the analysts, without a copy for each.
So we write the rules with you, from who needs what, and test them with each role before they’re on.
Press a hidden value to see why it’s hidden, then ask as the other role.
| Booking | ZIP code | Amount | |
|---|---|---|---|
| {{ rd0.id }} | |||
| {{ rd1.id }} | |||
| {{ rd2.id }} |
{{ rdLine }}
{{ rdSay }}
Changes on a schedule, tried before they’re on
Snowflake releases its updates to every account itself, on its own schedule. Changes to how existing features behave come grouped in bundles, a new one about once a month, each one listed in the behavior change log before it’s on by default.
Each bundle starts off by default for a testing period, when an account can turn it on to try it. Then it’s on by default, while an account can still turn it off. Then it’s on for every account, and the choice is gone.
Sign-in is changing too. The last phase of the sign-in changes, dated August to October 2026 in Snowflake documentation and rolled out account by account, asks every person who signs in with a password for a second factor, and blocks passwords for every service user.
So we try each bundle in a test account during its testing period, and move each service to a stronger sign-in before the date its account is given.
Start with who sees what, and what each warehouse uses
The review covers the roles, and who holds the account’s top roles; how people and services sign in, and which still use a password alone; the warehouses, their sizes, when they pause and who uses each; resource monitors and budgets; which columns hold sensitive data, and the masking and row access policies on them; shares, and who reads them; network policies; how data arrives, and which loads fail; the models and their tests; access history, for who reads what, where the edition includes it; clones and Time Travel in use; and the bundles still ahead.
The first step is one of these, each tried in a test account or on a clone first: services moved from passwords to key pairs or OAuth; one team’s warehouse set to pause when idle, with a monitor on it; a masking policy for one sensitive column, tested with each role; one data source loaded on a schedule, with checks; or the next bundle, tried during its testing period.
What you receive is a written review and a proposal for that first step.
Questions worth asking
Is this the right platform for us?
For a few small reports, a simpler database often does the job, and we’ll say so. It helps most when many teams share the same data, and each needs compute of its own and its own view of the data.
Can you take over an account someone else set up?
Yes. The review above comes first; then we change one part at a time, each change tried on a clone or in a test account first.
How do we keep its costs in hand?
With each warehouse sized to its work, set to pause when idle and tagged with its team, and with resource monitors and budgets that send a notice as use nears the limit you set. A resource monitor can also suspend the warehouses it watches.
What do the sign-in changes mean for us?
Every person who signs in with a password needs a second factor, and service users can’t use passwords at all, as the last phase reaches each account. We find each service that still uses a password, move it to key pairs or OAuth, and test each connection before the old way is turned off.
Can different teams see different parts of the same table?
Yes, with masking policies for columns and row access policies for rows, set by role, in Enterprise Edition or higher. We write the rules from who needs what, and test each one with every role before it’s on.
Can you move us from the warehouse we use now?
Yes, table by table, with each result compared with the old system’s before the old one is turned off.
Where does AI fit in?
Where it answers a real question: Snowflake Cortex AI functions, called in SQL, with access to them granted by role, as for the rest of the account.
What does it cost to work with you?
That depends on which part of the account you’d like changed first. Before any work starts, you get a written proposal with the scope, the price or rate, and how you pay.
Can we hire developers for our own team?
Yes. Within 48 hours of your request, we introduce developers for Snowflake accounts, in your time zone, and you meet them before choosing who joins.
Snowflake, Snowpipe, Snowflake Cortex AI and the other Snowflake product and feature names on this page are registered trademarks or trademarks of Snowflake Inc. in the United States and other countries. Webair is independent of Snowflake Inc., and isn’t sponsored by, endorsed by or affiliated with it.
Let’s build it better
Tell us how your teams reach the data today, and what each warehouse runs, and we’ll suggest where to begin, in a short call.
Thanks, we’ll be in touch soon.
{{ ctaStatus }}