Merge pull request #48 from DataRecce/feature/drc-1988-doc-update-customer-onboarding-prerequisite-doc

docs(DRC-1988): add Snowflake key pair security documentation

Author: popcornylu

docs/5-data-diffing/connect-to-warehouse.md

@@ -13,6 +13,10 @@ If you use Recce Cloud, here are the warehouse connection settings. We currently
 
 Others are coming in future releases
 
+### Security
+
+Recce Cloud protects all warehouse connection config (such as passwords, tokens, and private keys) using envelope encryption with AWS KMS. Credentials are encrypted at rest using AES-256, with encryption keys managed by AWS KMS. Decrypted credentials exist only in memory during connection establishment and are never written to disk. AWS KMS keys rotate automatically every 365 days to maintain security best practices.
+
 ### Snowflake
 We support two authentication methods for Snowflake: