Trust & Security
Snowstone works with some of the most sensitive information a company holds, and treats its protection as the first priority. Every review is designed so that the client stays in control of its data, from the first connection to the final deletion.
- Read-only access
- Read-only permissions approved by the client's IT contact
- Isolated per client
- One private cloud machine per client
- Never used for training
- Zero-data-retention agreements with Anthropic and OpenAI
- Deleted after the engagement
- Formal retention and disposal procedures
See every security control in the Snowstone Trust Center, or email security@cerenovus.ai for a security review.
The commitments behind every review
Each commitment describes how Snowstone works, and the client agreement sets the exact terms of each engagement.
You decide what Snowstone reads
Snowstone reads only the sources the client approves. The client can limit any source to a channel, folder, or field, leave out any mailbox, team, or system, and turn on automatic filters that remove sensitive files and email.
Scope agreed with management before any agreement is signed
Nothing is ever written back
Every connection is read-only. Snowstone does not write to, change, or send from client systems, and setup needs no network or firewall changes.
Read-only permissions approved by the client's IT contact
Each client's data stays separate
Each client gets its own private cloud machine behind a firewall, and no two clients share an environment. Clients with stricter rules can run Snowstone in their own cloud or on their own servers.
One private cloud machine per client
Never used to train AI models
Model providers process data under zero-data-retention agreements and never keep it. Client data is never used to train any model. Clients can also run local models on their own infrastructure.
Zero-data-retention agreements with Anthropic and OpenAI
Kept only as long as the engagement
Data stays only for the length of the engagement and is securely deleted when it ends, or at any point on request. A cold-storage backup is kept only if the client asks for one.
Formal retention and disposal procedures
Findings about systems, not people
Snowstone studies how work moves between teams. Findings describe processes, roles, boundaries, incentives, and systems, never the performance of named individuals. Staff review only a minimal amount of underlying data directly.
Final results checked by hand for quality
What happens to client data, from agreement to deletion
Client data enters a dedicated, read-only environment, stays there while Snowstone works, and is deleted when the engagement ends.
Agree
Management and Snowstone agree the scope. Snowstone signs the client's NDA and a data processing agreement before any data is shared.
Connect
The client's IT contact approves each read-only connection. Sign-in runs through Microsoft Entra ID.
Analyze
Analysis runs on the client's dedicated machine. Data is encrypted in transit, and model providers keep nothing.
Deliver
Staff check the final results for quality. Each finding links to the record behind it.
Delete
Data is securely deleted at the end of the engagement, or earlier on request.
How the environment is protected
Snowstone runs its security program on a defined set of controls, grouped below by area. Each one is listed in the Snowstone Trust Center.
Infrastructure
- Network firewalls configured against unauthorized access
- Intrusion detection with continuous monitoring
- Central log management
- Infrastructure monitoring with threshold alerts
- Hardening standards reviewed at least once a year
Access
- Privileged access to keys, production systems, databases, and firewalls limited to staff with a business need
- Unique credentials or keys for every system, application, and production sign-in
- Sign-in through Microsoft Entra ID
- Passwords configured according to a written policy
Data
- Data encrypted in transit over public networks
- Data classification policy
- Formal retention and disposal procedures
- Certificate of destruction for every device destroyed
Secure development
- Changes reviewed, tested, and approved before production
- Only authorized staff can deploy to production
- Formal development life cycle
- Documented vulnerability management and system monitoring
Resilience and response
- Documented security and privacy incident response
- Incidents logged, tracked, resolved, and communicated to affected parties
- Business continuity and disaster recovery plans
- Control self-assessments at least once a year
Governance and risk
- Risk assessments at least once a year, including fraud risk
- Documented risk management program with mitigation plans
- Security policies reviewed at least once a year
- Security roles and responsibilities formally assigned
- Vendor management with an annual review of critical vendors
Where Snowstone stands today
Snowstone reports certification work as in progress until each audit is complete.
- NDA and data processing agreement
- Signed with every client before any data is shared.
- Model provider agreements
- Zero-data-retention terms with model providers, including Anthropic and OpenAI.
- Insurance
- Coverage for damages from data leakage, available where applicable.
- SOC 2 Type II
- An independent auditor's report on how security controls operate over time.
- ISO 27001
- The international standard for managing information security.
- GDPR
- The EU's data protection rules. Data processing agreements are available during onboarding.
Common questions from security teams
Review levels, setup steps, and hosting options are described on Inside Snowstone.
01Who at Snowstone can see client data?
+
Analysis runs on the client's dedicated machine. Snowstone staff review the final results by hand for quality, and only a minimal amount of underlying data is reviewed directly. Privileged access is limited to authorized staff with a business need.
02Can Snowstone run in our own cloud or on our servers?
+
Yes. The standard setup is a private Snowstone cloud machine for each client, which is the fastest start. Snowstone can also run inside the client's own cloud account or on its own servers, with more setup work.
03What happens if there is a security incident?
+
Snowstone has documented security and privacy incident response policies. Incidents are logged, tracked, resolved, and communicated to affected parties according to those policies.
04How much work is setup for our IT team?
+
Setup needs at least one IT contact and a call with Snowstone, and usually one to four hours of client IT time, depending on how many sources are connected. No network or firewall changes are needed.
05How do we start a security review?
+
Email security@cerenovus.ai. The full list of controls is published in the Snowstone Trust Center, and the client agreement sets the exact scope and terms of each engagement.
Last updated October 2026 · Security contact: security@cerenovus.ai · To report a security concern, email the same address.
Put company-wide analysis behind your next decision.
Snowstone reads the company's data and ranks every fix by what it is worth.