No egress by design. The app reads Snowflake's own ACCOUNT_USAGE metadata views to analyze cost and usage. It does not read your tables, and it has no network path out of your account to send anything anywhere.
Runs in your account
Deployed via the Snowflake Native App framework as a Streamlit-in-Snowflake app. Compute runs on your warehouse, in your region, under your governance.
Read-only access
A single privilege grant gives the app read access to ACCOUNT_USAGE cost views — and nothing else.
No third-party servers
No provider-hosted backend, no data warehouse of ours, no external API calls carrying your data. Nothing to breach outside your own account.
Auditable actions
One-click optimizations only ever emit a fixed, allowlisted set of SQL statements — you can review exactly what runs before it runs.
The access it needs — and why
Installation is a one-line grant. It scopes the app to Snowflake's shared metadata database, which is where credit, warehouse, and storage history live:
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE
TO APPLICATION SNOWFLAKE_COST_ANALYZER;With that grant the app reads a small set of usage views, including:
SNOWFLAKE.ACCOUNT_USAGE.METERING_HISTORY— overall credit consumption by serviceSNOWFLAKE.ACCOUNT_USAGE.WAREHOUSE_METERING_HISTORY— per-warehouse credit usageSNOWFLAKE.ACCOUNT_USAGE.STORAGE_USAGE— account-level storage metricsSNOWFLAKE.ACCOUNT_USAGE.DATABASE_STORAGE_USAGE_HISTORY— per-database storage breakdown
These are metadata about usage and cost. The app does not query, sample, or copy the data in your tables.
How one-click Apply stays safe
Where the app can act on a finding — for example setting an auto-suspend timeout on an idle warehouse — it never runs arbitrary SQL. Every action is generated from a fixed, reviewable template and passes through an allowlist before execution, so the set of statements the app can run is bounded and predictable. You see the exact statement before applying it.
Where logs and traces go
The app's logs and traces are written to your own account's event table, configured through the Native App framework — they stay inside your Snowflake environment and are never shipped to us. In local mode, logs are written only to your machine.
Local mode
The same codebase can run locally against CSV exports or a direct connection you configure. In that mode it uses your credentials on your machine, and no data is sent to any provider service. The Native App mode above is the recommended, most locked-down way to run it.
Security review? Send this page to your security team, and reach us at sales@tungsten74.co.uk for architecture diagrams, questionnaires, or a walkthrough.