NRR Audits & Moat Scores: Snowflake, Datadog FY2026 Filings

FY2026 filings transform abstract loyalty claims into auditable line items. Net revenue retention functions as a real-time diagnostic tool, revealing how quickly vendor teams intervene when usage plateaus or integration complexity spikes. Companies that treat renewal windows as operational deadlines consistently outperform those relying on brand inertia or feature roadmaps alone.

When commercial structures tie contract values to gross merchandise volume or layer heavy implementation fees, the pressure on customer success teams intensifies. The resulting friction either accelerates proactive intervention or delays it until cancellation requests surface. Measuring this response time through standardized retention metrics separates genuine platform dependency from temporary lock-in.

The NRR Mechanism

Net revenue retention is not a growth metric; it is an audit of cohort survival and expansion. Filed precisely, NRR measures the revenue from a fixed customer cohort one year later divided by that cohort's starting revenue, excluding new logos entirely. This calculation bundles seat expansion, tier upgrades, and gross churn into a single auditable number that isolates organic behavior from sales acquisition. When a vendor claims a data moat based on proprietary volume, the filing reveals whether that volume actually retains value. The mechanism exposes the difference between holding data and extracting margin.

The decomposition of NRR reveals where the moat claim truly rests. At Datadog's ~112% FY2026 NRR, the math shows gross revenue churn plus downgrades are being offset by roughly 12 points of expansion. This means the reported retention above baseline depends entirely on the expansion side of the ledger, not the data side. If expansion stalls, the moat evaporates because the churn numerator remains unmitigated. The gap between vendors is not defined by how much data they hold, but by their ability to instrument usage signals that trigger expansion before renewal risk materializes.

Data lock-in mechanically appears in gross churn, not expansion. A customer cannot 'un-send' its telemetry to Datadog or its event data to Snowflake, so data gravity should suppress the churn numerator. However, if gross churn exceeds ~5%, this is direct evidence the lock-in is not binding. The myth that "we hold their data, so they can't leave" is falsified by Salesforce's own attrition disclosure, which shows enterprise customers churn out of systems holding their CRM data every year. According to Windows Forum (Aug 28, 2026), enterprise CRM deployments typically include identity mapping, custom objects, approval flows, audit requirements, data-retention rules, API integrations, middleware, analytics, and customer portals. These complex integrations create switching costs, yet Salesforce still experiences attrition, proving that data gravity alone does not prevent churn when operational friction outweighs lock-in benefits.

Threshold logic dictates the compounding effect of NRR performance. At 100% NRR, a vendor replaces exactly what it loses, and growth depends wholly on new logos—a CAC-heavy model vulnerable to market saturation. Each point above 115% compounds efficiency. For example, 120% NRR grows a cohort 20% annually with zero new sales, which explains why Snowflake can guide FY2027 product revenue up double digits on a stable customer count. This compounding advantage rewards vendors that have successfully institutionalized the escalation mechanisms required to sustain expansion.

What the FY2026 Filings Actually Say

Snowflake’s FY2026 Form 10-K anchors its expansion narrative on a dollar-based NRR of approximately 120% among its largest customers, explicitly identifying accounts with over $1 million in trailing product revenue as the primary growth engine. The filing pairs this retention figure directly with the count of $1 million-plus customers, creating a disclosure matrix that forces investors to track cohort concentration rather than aggregate consumption. This pairing matters because it isolates high-signal accounts where usage elasticity maps cleanly to infrastructure scaling. When compute spend tracks data accumulation without friction, the vendor captures expansion automatically. Snowflake’s pricing architecture converts customer data growth into revenue without requiring a sales motion; customers pay for compute on stored data, so their own operational expansion drives vendor margin.

Datadog’s FY2026 Form 10-K reports an NRR of approximately 112%, a figure management attributes to usage-based expansion within cloud monitoring and security workloads. The filing’s footnote clarifies that the dollar-based NRR calculation includes only customers live for a full reporting period, which intentionally excludes early-stage cohorts that distort retention math. This methodological constraint reveals how Datadog instruments risk: host-based pricing scales linearly with infrastructure additions, meaning every new server or container triggers automatic metering. Like Snowflake, Datadog’s model converts customer growth into vendor revenue without a sales call, but the 112% figure sits below the canonical 115% survival threshold, signaling that expansion velocity alone cannot offset underlying churn pressure in mid-tier accounts.

Salesforce’s FY2026 Form 10-K discloses no NRR metric whatsoever. Instead, the company reports an annual attrition rate of approximately 8% for dollar-based subscriptions, making Salesforce the control case where the moat must be inferred from what the organization declines to publish. Under SEC disclosure norms, a publicly traded software vendor rarely withholds a metric that flatters its unit economics. The absence itself functions as a churn-risk data point. This silence dismantles the widespread boardroom belief that holding enterprise CRM data guarantees renewal; Salesforce’s own attrition disclosure proves that organizations migrate away from systems containing their core customer records every fiscal year when escalation pathways fail or pricing structures misalign with actual utilization.

The disclosure asymmetry across these three filings is structurally significant. Two companies volunteer quarterly NRR figures while Salesforce does not, and that divergence maps directly to how each organization tracks pre-renewal risk. Snowflake and Datadog instrument consumption telemetry to trigger automated expansion workflows, whereas Salesforce relies on subscription attrition tracking because its pricing architecture requires manual seat allocation and module bundling. According to Windows Forum (Aug 28, 2026), Agentforce sales and service product seats grew year-over-year while attrition remained near record lows, yet the base CRM tier still faces structural headwinds against industry averages that sit around $15 per user per month (Tech.co, Dec 12, 2022). Multi-year contract negotiations can reduce list pricing by 20-40% according to third-party advisors (Swell, Apr 2026), further compressing the margin cushion that once protected legacy subscription models.

The mechanism is clear: vendors that embed pricing into customer growth loops capture expansion passively, while those requiring active commercial intervention face higher pre-renewal friction. When you evaluate a platform’s durability, ignore raw data volume claims and audit how the system escalates usage signals before the contract expires. If the architecture doesn’t convert customer expansion into automatic revenue, the moat is already leaking.

The Moat Scorecard

Snowflake scores as the explicit winner. Its ~120% NRR, quarterly disclosure cadence, and consumption-based pricing model create an automatic expansion mechanism that scales directly with customer data growth. Crucially, it holds the largest disclosed $1M+ customer cohort among the three, making all five tests both favorable and fully auditable from the filing. This alignment confirms a measured expansion flywheel rather than a static asset base.

Datadog emerges as the strong runner-up. Its ~112% NRR clears the 115% test only during strong quarters, yet its host-based pricing combined with quarterly disclosure ensures its expansion engine remains real and visible. However, the scorecard flags Datadog's NRR as the most sensitive of the three to macro slowdowns in infrastructure spend, introducing volatility absent in Snowflake's consumption curve.

Salesforce serves as the cautionary baseline. Seat-based pricing expands only when headcount grows, while approximately 8% attrition eats into expansion gains. The absence of an NRR disclosure forces inference, revealing a moat claim resting on switching costs rather than a measured expansion flywheel. This structure falsifies the widespread boardroom belief that "we hold their data, so they can't leave." Salesforce's own attrition disclosure demonstrates that enterprise customers churn out of systems holding their CRM data every year, proving that data custody alone does not prevent revenue leakage.

The table's explicit verdict is unambiguous. Snowflake wins on the moat-as-measured-by-NRR test, validating the thesis that instrumenting and escalating customer-risk signals before renewal drives sustainable retention. Datadog represents the viable alternative when usage-based telemetry—not data warehousing—is the category focus. Salesforce demonstrates that brand equity plus switching costs alone does not clear the 115% bar, exposing the structural fragility of seat-based models when macro conditions compress hiring.

What the Data Doesn't Tell You

The limitations of the evidence are structural. Filings aggregate cohorts, masking variance across segments. A vendor might report 118% NRR while enterprise accounts churn at 20% annually, offset by aggressive upselling to mid-market users who never held critical workloads. This aggregation hides the attrition risk embedded in specific verticals or contract classes. Furthermore, the data cannot distinguish between expansion driven by genuine workflow integration versus expansion forced by contractual lock-in or penalty clauses. If a customer stays because switching costs are prohibitive rather than value realized, the NRR signal is false; the moat is artificial and collapses when the customer's leverage shifts.

Variance across cases explains why two vendors with similar NRR profiles present different risk postures. Snowflake's reliance on consumption-based pricing creates volatility where usage spikes inflate NRR temporarily, even if core platform adoption stagnates. Salesforce demonstrates high retention through deep CRM entrenchment, yet their own disclosures confirm annual attrition among enterprise customers holding vast amounts of data, proving that data gravity alone does not prevent exit. Datadog's modular architecture allows customers to retain only monitoring tools while shedding adjacent products, creating a "partial moat" scenario where NRR remains healthy but the total addressable relationship erodes. These patterns require reading beyond the headline percentage to the composition of the cohort.

The canonical rule breaks under specific conditions that demand manual verification. First, the rule fails for organizations undergoing rapid restructuring; a sudden drop in NRR may reflect internal budget reallocation rather than product dissatisfaction, requiring analysis of procurement communications to interpret correctly. Second, the rule is uncertain during major platform transitions. If a vendor migrates billing engines or changes API pricing structures, the resulting churn spike distorts the signal for several quarters until the new baseline stabilizes. Third, the rule assumes rational renewal behavior; in regulated industries, customers may renew due to audit requirements even when technical debt makes the system untenable, creating a lagged collapse that the current quarter's NRR will not predict.

What the Filings Can't Show

Net revenue retention filings capture the financial residue of a renewal cycle, but they do not record the operational friction that precedes it. When you audit the FY2026 10-Ks for Snowflake, Salesforce, and Datadog through an organizational systems lens, the gap between reported NRR and actual moat integrity widens significantly. The filings present a sanitized aggregate that masks definition drift, survivorship bias, attribution opacity, and critical disclosure lags. For an analyst tracking how organizations instrument and escalate risk signals before renewal, these omissions are not minor footnotes; they are structural blind spots that can invert your assessment of customer-lock-in.

The first distortion is definition drift. Datadog's dollar-based NRR excludes customers not yet live a full period, effectively pruning the cohort of early-stage churn events that often signal product-market fit failures. Meanwhile, Snowflake's largest-customer NRR overweights accounts already above $1M, creating a metric that measures the behavior of a tiny subset of enterprise whales rather than the broader base. Because the same 'NRR' label measures fundamentally different cohorts across these filings, cross-company comparison carries a margin of error of several points. You cannot treat a 118% figure from Snowflake as directly equivalent to a 115% from Datadog without adjusting for this sampling bias. Furthermore, consumption pricing introduces a deceleration counter-case: a consumption-priced vendor's NRR can fall faster than a seat-based vendor's in a downturn because customers can throttle usage immediately, while seat contracts lock in for the term. This means Snowflake's higher NRR is partly a function of higher variance and contract rigidity, not strictly a deeper moat. In a stress scenario, the consumption model reveals true value leakage more rapidly, whereas seat-based models may preserve NRR temporarily while signaling underlying dissatisfaction.

Survivorship bias further distorts the picture. NRR is reported only for surviving customers and excludes logos that churned to zero entirely in some definitions. Consequently, a 120% figure can coexist with meaningful logo loss that the single metric never surfaces. A vendor could lose 15% of its customer base to zero-revenue churn while reporting 120% NRR on the remaining cohort, creating a false impression of health. This is particularly dangerous when evaluating the 'data moat' thesis; if the lost logos were mid-market accounts where data portability was low, the moat may be eroding even as the aggregate number looks robust. The canonical decision rule requires sustained NRR above 115% across four consecutive quarters, but this rule assumes the cohort composition remains stable. If the denominator is shrinking due to unreported logo loss, the sustainability of the NRR becomes questionable regardless of the percentage.

The disclosure lag problem adds another layer of temporal disconnect. FY2026 10-K figures describe cohort behavior that began 12-24 months earlier. An organizational breakdown in escalation or support in the last two quarters is invisible until two filings later. As Rachel Kim notes, the reader is auditing last year's customer-success operation. If a vendor recently restructured its customer success team or reduced investment in risk-escalation protocols, the impact will not appear in the current NRR report. By the time the decline manifests in the filing, the damage to the moat may be irreversible. This lag makes real-time assessment of organizational health impossible based solely on retrospective financial data. Analysts must look for leading indicators in management commentary and operational disclosures, which are often sparse.

Finally, the attribution gap leaves the mechanism of retention opaque. Nothing in a 10-K reveals whether NRR was defended by product value or by discounting at renewal. Management commentary routinely credits 'customer success investments' without any quantified tie to the churn rate. The organizational machinery that Rachel's escalation-framework lens requires—how tickets are prioritized, how risk signals are escalated, how compliance issues are resolved—remains a black box in all three filings. Without visibility into these operational details, you cannot distinguish between a moat built on genuine value and one propped up by temporary concessions. The widespread boardroom belief that 'we hold their data, so they can't leave' is falsified by Salesforce's own attrition disclosure, which shows enterprise customers churn out of systems holding their CRM data every year. Retention is not guaranteed by data custody; it is earned through continuous value delivery and effective risk management, neither of which is captured in the NRR number alone.

Worked Case

Decomposing Snowflake's reported 120% expansion requires isolating gross churn from pure growth. The filing's commentary implies a gross churn rate of approximately 5%, meaning the remaining ~25 points of expansion must originate entirely from consumption growth on stored data rather than seat sales. This distinction matters: seat-based expansion can be capped by headcount budgets, but consumption expansion scales with workload intensity. According to FourWeekMBA (Apr 2026), dollar-based net revenue retention is tracked specifically to measure this expansion revenue against churn and contraction, confirming that the moat relies on usage elasticity. Furthermore, contracted revenue still due within 12 months grew 14% in constant currency during the reported quarter, as noted by Windows Forum (Aug 28, 2026). This growth in deferred revenue validates that expansion is not theoretical; it is locked into future cash flows, reinforcing the conditional nature of the moat.

A 25-point expansion contribution demands rigorous operational discipline. Usage dips and renewal risks must surface and resolve within the fiscal year, or the expansion target collapses. An escalation-audit test maps this requirement to three control points: first, telemetry must flag anomalous query drops or storage stagnation; second, account teams must review these signals at a cadence that precedes budget cycles; third, a documented path must escalate any at-risk $1M+ account before contract expiry. If an organization cannot demonstrate this chain, the expansion number is likely driven by a few hyper-growth accounts masking systemic friction. The canonical decision rule holds here: sustained NRR above 115% across four consecutive quarters is the only defensible signal because it proves the escalation system works consistently, not just for top-tier clients.

Stress-testing the case exposes the fragility of the advantage. Applying a 20% consumption deceleration scenario to the same cohort drives NRR toward roughly 104%. This collapse demonstrates that the worked-case advantage depends entirely on customer workloads growing; the number is conditional, not structural. When consumption slows, the moat evaporates unless the vendor has already instrumented early-warning signals to pivot usage or renegotiate value. Procurement teams should use this math by requesting the vendor's cohort NRR and gross churn separately. Only by seeing both numbers can buyers determine whether lock-in suppresses exits or expansion drives growth. The myth that "we hold their data, so they can't leave" is falsified by Salesforce's own attrition disclosure, which shows enterprise customers churn out of systems holding their CRM data every year. The only honest version of the moat question asks whether the vendor's operational systems can detect and reverse risk before the renewal date.

Sustained NRR of 115%+ across four consecutive reported quarters serves as the canonical decision rule for validating a data moat. A single strong quarter or an unlabeled "best-in-class retention" statement fails this test because it masks cohort fragility. Organizations must require evidence of continuity; a vendor reporting 120% NRR in Q3 but 108% in Q4 does not possess a moat, they possess volatility. The four-quarter requirement filters out seasonal spikes and accounting adjustments, ensuring the retention figure reflects genuine product stickiness and successful risk escalation over a full business cycle. If the sequence

Frequently Asked Questions

What specific revenue threshold does Snowflake use to isolate its highest-signal customer cohort for NRR reporting?

Snowflake explicitly identifies accounts with over $1 million in trailing product revenue as the primary growth engine driving its approximately 120% dollar-based NRR.

At what gross churn percentage does data lock-in fail to prevent customer attrition according to the article's threshold logic?

If gross churn exceeds roughly 5 percent, it serves as direct evidence that platform lock-in is not binding on the customer base.

How does Datadog's FY2026 methodological constraint affect which customers are included in its reported NRR calculation?

Datadog's footnote clarifies that its dollar-based NRR includes only customers live for a full reporting period, intentionally excluding early-stage cohorts that distort retention math.

What annual cohort growth rate results from maintaining a 120 percent net revenue retention without acquiring new sales?

A 120 percent NRR grows a customer cohort by 20 percent annually with zero new sales required to sustain that expansion.

By what maximum percentage can multi-year contract negotiations reduce list pricing, and what surcharge offsets this discount?

Multi-year negotiations can reduce list pricing by up to 40 percent, while premium support adds a 30 percent surcharge that distorts the arithmetic of actual churn resolution.

What annual attrition rate does Salesforce disclose for dollar-based subscriptions despite holding enterprise CRM data?

Salesforce discloses an annual attrition rate of approximately 8 percent for dollar-based subscriptions, proving that organizations migrate away from systems containing their core customer records every fiscal year.

Quick answers

Also worth reading: 2025 Shared Issue-Ops Taxonomy Cuts Legal Escalation Time by 40%: 2025 Shared Issue-Ops Taxonomy Cuts · 72-Hour SLA vs. AFCA & TIO Medians: 2025 Escalation Data: 72-Hour SLA vs. AFCA &