Trust & Security

Your data stays in your Snowflake.

Refyner connects to the Snowflake account you own. Your prep and scheduling run as pushdown inside your warehouse – the data is read, transformed, and written within your environment. Refyner orchestrates the work and stores configuration and metadata; it is not a copy of your data.

Data residency by design

Your raw business data stays inside your Snowflake. Refyner pushes work down to your warehouse rather than extracting data into ours.

Least-privilege access

Refyner connects with a scoped Snowflake role you control and can revoke at any time. You decide which databases and schemas are in scope.

Control plane only

Refyner stores dataflow definitions, schedules, run logs and metadata – the instructions, not your customers' records.

Our posture

Certifications & controls

Where Refyner's own application infrastructure is concerned, here's where we stand today and what's on the roadmap.

Cyber Essentials (UK)
Certified
Application hosting
Microsoft Azure · East US 2
Encryption in transit & at rest
TLS 1.2+ / AES-256
Multi-factor authentication
On all accounts
Backup & recovery
Daily, Azure-managed point-in-time restore
Uptime target (paid plans)
99.5% monthly
Guaranteed SLA & service credits
On purchased add-on
Third-party penetration testing
On roadmap
SOC 2 Type II
On roadmap
ISO 27001
On roadmap

Azure's certifications cover the underlying infrastructure only and don't substitute for Refyner's own controls. Specific certification target dates are confirmed during procurement.

AI assistance · coming soon

How AI features will handle your data

AI authoring assistance is a forthcoming feature. We are setting out the data posture now, before release, because it is the part a security review looks at hardest.

What is sent

  • Schema and structural metadata (table and column names, types)
  • Only the sample rows you explicitly approve, when you ask for AI help on specific data

Your full datasets are never sent to an external model.

Our commitments

  • Runs on Microsoft Azure OpenAI inside our own Azure tenancy
  • Covered by Microsoft's enterprise terms as a sub-processor
  • Prompts and content are not used to train foundation models
Deployment choice

Cloud, or inside your own walls

Refyner Cloud

We host and run the Refyner control plane on Azure. Your data still stays in your Snowflake; only dataflow configuration and metadata sit with us.

Refyner Self-Hosted

The entire control plane deploys inside your own cloud or VPC. Nothing – including metadata – leaves your boundary. Suited to data-residency and compliance requirements.

Sub-processors

For Refyner Cloud, we rely on a small set of sub-processors to operate the service. Your warehouse data is not shared with them; they support the control plane only.

  • Microsoft – application hosting on Azure (East US 2), and Microsoft 365 services
  • Microsoft Azure OpenAI – AI authoring assistance, in our own Azure tenancy (schema + approved samples only)
  • Cloudflare – website hosting and cookieless website analytics for refyner.com
  • Microsoft Clarity – product usage analytics
  • Amplitude – product usage analytics
  • Calendly – demo and meeting scheduling
  • Payment, email and error-monitoring providers – billing, transactional email, and reliability

The current sub-processor list, and our commitment to give 30 days’ notice of changes, is maintained in our Data Processing Agreement. Self-hosted deployments do not use Refyner-operated sub-processors for your data.

Reporting a vulnerability

If you believe you've found a security issue, please contact security@refyner.com. We'll acknowledge and work with you on a responsible disclosure.

Need our security questionnaire or DPA?

Our Data Processing Agreement is published at refyner.com/dpa.html. We also keep a pre-filled security questionnaire ready on request – reach out and we’ll send it over.

Request security pack