Security · Snowflake Native App

Runs in your Snowflake account. Your data stays there.

StreamGen installs as a Snowflake Native App: one service in your own account, behind Snowflake's sign-in. It works on your data as each signed-in person, with no more rights than they have, and connects out only to hosts you approve.

YOUR SNOWFLAKE ACCOUNT Your people in a browser Snowflake sign-in SSO, MFA StreamGen runs in your account StreamGen web app and AI agent Its own database projects, app versions, settings Backups a stage in your account, encrypted by Snowflake Outbound gate only the hosts you approve AS EACH SIGNED-IN PERSON Snowflake Cortex its AI; no model outside Snowflake Your data with that person's own rights AS STREAMGEN Apps it deploys Streamlit and Next.js, in your account; they read only what you grant Scheduled reports Snowflake tasks and Snowflake email AIreadsdeploysruns OUTSIDE YOUR ACCOUNT licence.streamgen.io licence and email · required GitHub import and push · optional api.osv.dev package checks · optional Report destinations Slack, Teams, webhooks
Your people reach StreamGen only through Snowflake's sign-in. Reading your data and calling Cortex happen as the signed-in person, within the rights you allow StreamGen to use. The apps it deploys and the reports it runs use only what you grant to StreamGen. Everything that leaves your account passes one gate, and only to hosts you have approved.

What leaves your account

Your data and the apps StreamGen builds never leave it. StreamGen's AI is Snowflake Cortex, in your account. This is the full list of what goes out:

licence.streamgen.io
Your licence key and your Snowflake account name, once a day. StreamGen's own emails (deploy requests, reviews, the nightly app check): recipient, subject and text. A message someone sends to StreamGen support from inside StreamGen, with their name and email, the workspace name, the StreamGen version, the page they were on, your Snowflake account name and licence.
Required
GitHub
Code someone chooses to import from GitHub or push to it.
Optional
api.osv.dev
Names and versions of the packages your apps use, to look up known vulnerabilities.
Optional
Report destinations
A report someone scheduled, to the Slack, Teams or webhook address they chose.
Per report

Each host is a connection Snowflake asks you to approve. StreamGen can't add one on its own.

Who StreamGen acts as

  • Everyone signs in with their Snowflake login. StreamGen has no passwords of its own and never asks for Snowflake credentials or keys.
  • It reads data and calls Cortex as the signed-in person: never more than they may do, and only the kinds of access you allow it to use.
  • The apps it deploys and the reports it runs read only what you grant to StreamGen itself. An admin can grant it from inside StreamGen, within their own rights.

Where its data lives

  • StreamGen's own database and files are on storage in your account.
  • They are copied continuously to a stage in your account, encrypted by Snowflake.
  • Its keys are Snowflake secrets created at install, never part of the app itself.

What it runs on

  • One small compute pool for StreamGen and an extra-small warehouse that suspends after a minute.
  • One extra-small node per running Streamlit app (3 at most, unless you raise it). Idle apps stop, and the pool suspends when none run.
  • All of it in your Snowflake bill, like anything else you run. You can suspend StreamGen any time.

Checked by Snowflake, and by StreamGen

Snowflake scans every Native App release offered to other accounts for security issues, and reviews an app before it appears on the Snowflake Marketplace. StreamGen passed that review and is on the Marketplace. StreamGen in turn checks the apps it manages, every night: the packages they use against known vulnerabilities, and their code for what Snowflake doesn't look at, what the app does in the viewer's browser (HTML built from data, forms and scripts going to other sites). Questions from your security team: get in touch.

How StreamGen is built and kept up to date

  • Every change runs the automated tests (about 1,100, with a security regression test for every issue found in our own reviews), a code security scan and a scan of all dependencies for known vulnerabilities and committed secrets.
  • The containers are built on SUSE's hardened minimal base image (BCI Micro), with no package manager and nothing running as root.
  • Every release is scanned for known vulnerabilities and malware, and refused while a high or critical finding has a fix available.
  • The containers are rebuilt and scanned every week, and updates to the base image and dependencies arrive automatically, so a fix is picked up even when StreamGen itself hasn't changed.
Critical
fixed release within 7 days
High
fixed release within 30 days
Medium
fixed release within 90 days

For known vulnerabilities (CVEs) in components StreamGen ships, counted from the day a fix is available. A vulnerability reported in StreamGen itself follows the times below.

Reporting a security issue

Found a vulnerability in StreamGen, or think something is wrong? Email john@streamgen.io. You get a reply from a person, and we keep you informed until it is fixed.

Critical
first response within 4 hours
contained or fixed within 72 hours
High
first response within 1 business day
fixed within 7 days
Medium
first response within 3 business days
fixed within 30 days

Critical: customer data exposed or at risk, or a vulnerability being exploited. Affected customers are told as soon as there is something they need to know or do; personal data breaches are reported to the Croatian data protection authority within 72 hours where the law requires it.

Get it on the Snowflake Marketplace How installing works Other ways to run StreamGen