Last Updated: April 1, 2023
This Snowflake U.S. Government Commercial Compliance Addendum (this “U.S. Government Commercial Compliance Addendum”) between Snowflake Inc. (“Snowflake”) and the undersigned Customer (“Customer” and, together with Snowflake, the “Parties”) takes effect as of the earlier of the date the Order Form or other agreement that references this U.S. Government Commercial Compliance Addendum (“Ordering Document”) becomes binding or first use of the Snowflake U.S. Government-Authorized Commercial Service (“Effective Date”). This U.S. Government Commercial Compliance Addendum supplements and amends the agreement by and between Customer and Snowflake governing Customer’s use of the Service (including the Ordering Document and any other agreements referenced in either document, the “Base Agreement”). This U.S. Government Commercial Compliance Addendum only applies to direct transactions with Snowflake. If you purchased or intend to purchase the Snowflake U.S. Government-Authorized Commercial Service through a Snowflake authorized reseller, please contact your reseller for instructions to access and use the Snowflake U.S. Government-Authorized Commercial Service. Unless otherwise defined in this U.S. Government Commercial Compliance Addendum, all capitalized terms used and not defined herein will have the meanings ascribed to them in the Base Agreement.
For good and valuable consideration, the sufficiency of which both Parties acknowledge, the Parties hereby agree as follows:
1. New Defined Terms. The following new defined terms are added to the Agreement:
a. “Agreement” means the Base Agreement and this U.S. Government Commercial Compliance Addendum.
b. “Classified Data” means data that has been (i) classified by the U.S. government as “Confidential,” “Secret,” or “Top Secret” as defined in Executive Order 13526, Section 1.2a, or (ii) otherwise deemed by the U.S. government to require special clearance for use, access, or maintenance.
c. “Criminal Justice Information” or “CJI” has the meaning used in the Criminal Justice Information Services Security Policy.
d. “DFARS 7010” means Defense Federal Acquisition Regulation Supplement 252.239-7010.
e. “DFARS 7012” means Defense Federal Acquisition Regulation Supplement 252.204-7012.
f. “Federal Tax Information” or “FTI” has the meaning used in Internal Revenue Service Publication 1075.
g. “FedRAMP” means the Federal Risk and Authorization Management Program.
h. “ITAR” means the International Traffic in Arms Regulations (22 C.F.R. Subpart M).
i. “Snowflake U.S. Government-Authorized Commercial Service” means the Service when used within a U.S. Government-Authorized Commercial Region in accordance with this U.S. Government Commercial Compliance Addendum.
j. “State Authorizing Programs” means any U.S. state or state-sponsored independent cloud computing risk and authorization management program (e.g., StateRAMP and TX-RAMP) that has authorized the Service when hosted in a U.S. Government-Authorized Commercial Region as detailed in the Documentation.
k. “U.S. Commercial Government Covered Accounts” means Customer’s Accounts when hosted in any U.S. Government-Authorized Commercial Region.
l. “U.S. Government Commercially Prohibited Workloads” is defined in Section 4(b) of this U.S. Government Commercial Compliance Addendum.
m. “U.S. Government-Authorized Commercial Regions” means the Snowflake regions outside of the U.S. SnowGov Region that are expressly designated by Snowflake as U.S. government authorized (e.g., FedRAMP and/or State Authorizing Programs), as set forth in the Documentation.
n. “U.S. Government” means an agency of the federal government of the United States of America, or any government of any state thereunder, including federal and state public educational institutions. If the Customer is a state government, an agency of a state government, or a state public educational institution, then references to federal law or regulations shall be replaced with a reference to the corresponding state law or regulation if such exists.
2. Applicability. This U.S. Government Commercial Compliance Addendum applies to Customer’s U.S. Commercial Government Covered Accounts.
3. Snowflake Obligations.
a. In accordance with this U.S. Government Commercial Compliance Addendum and subject to the assignment of responsibilities hereunder and in the Base Agreement and Documentation, Snowflake will maintain a security program for the Snowflake U.S. Government-Authorized Commercial Service consistent with the applicable requirements of the specific U.S. government authorization(s) (e.g., FedRAMP and/or State Authorizing Programs) listed for the U.S. Government-Authorized Commercial Regions in the Documentation.
b. Snowflake has obtained U.S. government authorizations (e.g., FedRAMP and/or State Authorizing Programs) for the Snowflake U.S. Government-Authorized Commercial Service, as further detailed in the Documentation. For so long as Customer is using the Snowflake U.S. Government-Authorized Commercial Service pursuant to this U.S. Government Commercial Compliance Addendum, Snowflake will use commercially reasonable efforts to:
i. Maintain its U.S. government authorizations in effect as of the Effective Date (or successor or equivalent authorizations, as reasonably determined by Snowflake) at the current or higher authorization level; and
ii. Provide at least the same level of protection as required by its U.S. government authorizations in effect as of the Effective Date (or successor or equivalent authorizations, as reasonably determined by Snowflake).
c. For clarity, where security controls or other requirements are under the control of Customer (e.g., configurations of U.S. Commercial Government Covered Accounts and User access thereto), Customer is responsible for implementing and maintaining those controls to meet applicable requirements.
4. Customer Obligations:
a. Customer Assessment. Notwithstanding any provision to the contrary herein, for U.S. Commercial Government Covered Accounts, Customer is responsible for:
i. Reviewing the Documentation and understanding the Snowflake U.S. Government-Authorized Commercial Service. The Documentation explains how the Snowflake U.S. Government-Authorized Commercial Service operates, including the availability and operation of certain Service features. For example, certain Usage Data may leave the U.S. Government-Authorized Commercial Regions.
ii. Assessing and selecting the appropriate U.S. Government-Authorized Commercial Region.
iii. Appropriately configuring U.S. Commercial Government Covered Accounts. As described in the Documentation, Customer may have the ability to turn off Service features when using the Snowflake U.S. Government-Authorized Commercial Service. Disabling or turning off such features may impact the functionality and/or performance of the Service.
iv. Otherwise complying with applicable law.
b. Workloads. Notwithstanding any provision to the contrary in the Base Agreement, but expressly subject to this U.S. Government Commercial Compliance Addendum:
i. Customer may upload Customer Data that is subject to the U.S. government authorizations detailed in the Documentation as supported by the U.S. Government-Authorized Commercial Regions (e.g., FedRAMP and/or State Authorizing Programs) into its U.S. Commercial Government Covered Accounts;
ii. Customer may not upload Customer Data that (i) is subject to ITAR, DFARS 7010, or DFARS 7012; (ii) qualifies as Classified Data, CJI, or FTI; or (iii) is otherwise prohibited by Section 9.3 of the Security Addendum (“U.S. Government Commercially Prohibited Workloads”) into its U.S. Commercial Government Covered Account(s); and
iii. Customer will be solely responsible for sanitization costs incurred by Snowflake and its subcontractors, without application of any limitation of liability or damages caps in the Base Agreement, if Customer introduces U.S. Government Commercially Prohibited Workloads into its U.S. Commercial Government Covered Accounts or uses the Snowflake U.S. Government-Authorized Commercial Service in connection with U.S. Government Commercially Prohibited Workloads in violation of the Agreement.
c. Commercial Product. If Customer is the U.S. Government, Customer hereby agrees that the Snowflake U.S. Government-Authorized Commercial Service qualifies as a “commercial product” as defined by FAR 2.101 or the state law corollary.
d. Government Communications. Snowflake shall provide all communications required hereunder or under its U.S. government authorizations (e.g., FedRAMP and/or State Authorizing Programs) to Customer. Customer will comply with the third-party communication requirements applicable to Customer Data or Customer’s U.S. Commercial Government Covered Accounts, including notice and correspondence to third party government entities. For clarity, nothing hereunder requires or prevents Snowflake from communicating with any third party.
5. U.S. Government Customers
a. Indemnification. Notwithstanding anything to the contrary in the Base Agreement, if Customer is the U.S. Government:
i. If written approval of the Attorney General is required for Customer to accept the indemnification procedures set forth in the Base Agreement, Snowflake will, upon such approval, defend, indemnify, and hold harmless the Customer as set forth in the indemnification section(s) of the Base Agreement.
ii. To the extent that any indemnity or limitation of liability obligation is unlawful, it shall not apply. Customer agrees that it is solely responsible for all risks arising from or relating to any Customer Data, Customer Materials, Reader Accounts or any Customer-offered product or service used in connection with the Service, and hereby represents and warrants that any Customer Data, Customer Materials, Reader Accounts or any Customer-offered product or service used in connection with the Service will not violate the Agreement or applicable law; infringe or misappropriate any third-party rights; or cause harm to any third party or Snowflake.
b. Disputes. Notwithstanding anything to the contrary in the Base Agreement, if Customer is the U.S. Government and the Parties fail to reach agreement on any request for equitable adjustment, claim, appeal, or action arising under or relating to the Agreement, including unresolved payment disputes under the Base Agreement, the dispute shall be addressed and resolved in accordance with applicable law.
c. Governing Law. Notwithstanding anything to the contrary in the Base Agreement, if Customer is the U.S. Federal Government or an agency thereof, this Agreement will be governed by the federal laws of the United States and jurisdiction and venue for actions related to the subject matter hereof will be the United States federal courts; and if the Customer is a U.S. State Government or an agency thereof, this Agreement will be governed by the laws of that State.
6. Miscellaneous.
a. Term. This U.S. Government Commercial Compliance Addendum is effective as of the Effective Date and will remain in effect for so long as Customer is using Commercial Government Covered Accounts, unless terminated earlier in accordance with the Agreement or applicable law. This U.S.Government Commercial Compliance Addendum and Customer’s access to and use of the Snowflake U.S. Government-Authorized Commercial Service may be immediately terminated by Snowflake if Customer ceases to meet any applicable eligibility requirements for the Snowflake U.S. Government-Authorized Commercial Service or breaches the terms of this U.S. Government Commercial Compliance Addendum.
b. Assignment. Notwithstanding anything to the contrary in the Base Agreement, neither Party may assign this U.S. Government Commercial Compliance Addendum without advance written consent of the other Party; except that Snowflake may assign this U.S. Government Commercial Compliance Addendum, without Customer’s consent (i) in connection with a merger, reorganization, acquisition, or other transfer of all or substantially all of Snowflake’s assets or voting securities to a successor; and (ii) to a Snowflake Affiliate.
c. Confidentiality. Notwithstanding any provision to the contrary, Snowflake may disclose Customer Confidential Information as required by law or regulation, and to comply with and maintain its authorizations and certifications, including, without limitation, its U.S. government authorizations. If Snowflake is so required to disclose Customer Confidential Information, then Snowflake shall, to the extent permitted, provide Customer with advance written notification and cooperate in any effort to obtain confidential treatment of such Confidential Information.
d. Severability; Interpretation. If a court of competent jurisdiction holds any provision of this U.S. Government Commercial Compliance Addendum to be unenforceable or invalid, that provision will be limited to the minimum extent necessary so that this U.S. Government Commercial Compliance Addendum will otherwise remain in effect. Section headings are inserted for convenience only and shall not affect the construction of this U.S. Government Commercial Compliance Addendum.
e. Entire Agreement; Conflict. This U.S. Government Commercial Compliance Addendum together with the Base Agreement (as may be amended in accordance with their terms) are the complete and exclusive statement of the mutual understanding of the Parties and supersede and cancel all previous written and oral agreements and communications relating to the subject matter of this U.S. Government Commercial Compliance Addendum. Except as specifically set forth in this U.S. Government Commercial Compliance Addendum, all terms and conditions of the Base Agreement remain in full force and effect. In the event of any conflict between this U.S. Government Commercial Compliance Addendum and the Base Agreement, this U.S. Government Commercial Compliance Addendum will control with respect to the subject matter herein.