Security & Plans
Everything an account admin, security reviewer, or procurement gatekeeper needs to approve a RosterGuard install, in one read: what the app can access, where data flows, what compute costs, what the plans include, what happens at uninstall, and which terms apply.
Privileges
At install: none. Installation requires no account-level privileges. The app makes no external calls and reads nothing in your account until a roster is explicitly bound.
After install:
Read-only SELECT on one roster table or view
When an admin connects a roster (Snowflake's grant dialog opens; you pick the table)
That single object only — revocable and reconnectable at any time
EXECUTE TASK + EXECUTE MANAGED TASK
Only if you enable the optional monthly schedule
Opt-in, off by default; disable the toggle to suspend
Manual (on-demand) screening never requires account-level privileges. There is nothing ACCOUNTADMIN-flavored anywhere in the privilege model.
Data flow
Egress: none. No external access integrations, no containers — the app makes no network calls of any kind.
The screening engine, review queue, dispositions, and run history all run and live inside your Snowflake account.
The app ships its reference data with it (curated OIG LEIE, NPPES deactivations, PECOS presence, opt-out, Order & Referring, and revalidation — see What It Checks); reference data updates arrive with app updates, not through any network call the app makes.
The only thing the app reads in your account is the one roster object you bind.
Compute behavior
On-demand screens run on your warehouse. A 2,500-provider roster completes in minutes; nothing is left running afterward.
Scheduled screens (optional) run as a serverless task inside your account on your chosen day each month. Compute is billed to your account only when a screen runs; no warehouse is left running.
The 1,000-NPI trial row cap is enforced server-side — not by the UI, so there is no client-side limit to misconfigure or work around.
Plans
Standard
$7,500/yr
Up to 2,500 providers; all six checks; review queue with append-only audit trail; CSV and HTML exports
Pro
$15,000/yr
Up to 10,000 providers; multi-roster support; on-demand re-screens; quarterly methodology attestation letter
Network-scale / OEM: per-provider-screened terms for organizations screening third-party networks, and embedded or OEM use of screening outputs in your own product, are available — contact us.
Trial: the full application — every match strength, every check, exports included — capped server-side at 1,000 providers over a 30-day trial, plus a bundled 120-provider synthetic demo roster (10 planted matches: 2 Strong, 4 Likely, 4 Possible).
Uninstall & data retention
Audit exports (CSV audit log, HTML evidence pack) are files you already hold — they need nothing from us.
The review queue, dispositions, and run history live in your account, survive app upgrades, and stay readable if a trial expires. We never hold your audit trail hostage.
Uninstalling the app removes the application and its objects; the grant you made on your roster table simply ceases to have a grantee.
Legal terms
RosterGuard is offered under the Snowflake Standard Agreement for Marketplace Products — no custom terms, so legal review can approve from the standard agreement. Internal use of screening outputs (queries, exports, audit artifacts) is covered. Redistribution of outputs, or embedding them in a customer-facing product, requires a separate conversation — contact us before building on that assumption.
Support
Contact: notifications@dataplex-consulting.com — monitored inbox; security questions get a human reply
Provider: Dataplex Consulting — the same provider behind the NPPES, CMS, and FDA datasets in the Data Catalog.
RosterGuard docs: Overview · Quickstart · Using the App · Understanding Matches · What It Checks
Last updated