Yes - customers using the Enterprise edition or higher of Snowflake can make use of external tokenization within a masking policy to only de-tokenize data at query runtime for authorized data. This approach can help ensure that PII is not accidentally exposed, because the data is already masked through the tokenization process before landing in Snowflake.