Fenmoor Specialty Underwriting - Security Questionnaire
Documentfinal Fenmoor Specialty Underwriting: documents · security_questionnaire · final · 2024-04-11
BB-Demo's answers to Fenmoor's security review of the Growth tier, dated 11 Apr 2024. It states nightly refresh by 07:00 customer local time and a P1 first response of one business hour. It gives no availability percentage and no price.
What it says
What this says
Current to 11 Oct 26BB-Demo's answers to Fenmoor's security review of the Growth tier, dated 11 Apr 2024. It states nightly refresh by 07:00 customer local time and a P1 first response of one business hour. It gives no availability percentage and no price.
What it is: a final security questionnaire prepared by Tobias Renwick for Fenmoor's security and operations reviewers. It describes the product as built on 11 Apr 2024 and is not a contract.
Commits: it states "The nightly refresh completes by 07:00 customer local time on business days, on every tier." It gives P1 first response as one business hour on Growth, and Growth service credits for availability only.
Unusual: nothing off standard terms. It says single sign-on and SCIM, the Sandbox, regional residency and named-engineer support are not part of Growth.
Not settled: it states no availability percentage, price or connector dates. It says "Contractual security commitments are set by the executed order form under the MSA and take precedence over this questionnaire." It also gives no certification or penetration-test evidence.
As found in this document
Current to 9 Oct 26- Nightly refreshThe nightly refresh completes by 07:00 customer local time on business days, on every tier.The nightly refresh completes by 07:00 customer local time on business days, on every tier. · Source: object_read:doc_001_001
- P1 first responseOne business hour on Growth.Source: object_read:doc_001_001
- Service creditsService credits on Growth apply to availability only, not to data freshness.Service credits on Growth apply to availability only, not to data freshness. · Source: object_read:doc_001_001
- Named-engineer supportNamed-engineer support is the Premium support add-on and is not part of Growth.Named-engineer support is the Premium support add-on and is not part of Growth. · Source: object_read:doc_001_001
The document
Body
Fenmoor Specialty Underwriting - Security Questionnaire
Status: Final Date: 11 Apr 2024 Prepared by: Tobias Renwick, Chief Technology Officer and Co-founder, BB-Demo Prepared for: the security and operations reviewers at Fenmoor Specialty Underwriting Tier under discussion: Growth
Purpose and scope
Fenmoor Specialty Underwriting is a City managing general agent writing marine cargo and professional indemnity for Lloyd's syndicates. Its underwriting operations team wants one view of submissions, bordereaux queries, claims tickets and CRM activity, so that it can answer capacity providers' oversight questions. This questionnaire records how BB-Demo answers the security questions raised during review of the Growth tier.
To be precise, the answers describe the product as it is built today. Where an answer depends on how Fenmoor configures its own Snowflake account, we say so rather than claim a control that is not ours to give.
Section A - Architecture and data location
Read the whole document (5,215 characters)
| Question | Answer |
|---|---|
| Where does the brain run? | Inside the customer's own Snowflake account. BB-Demo does not copy the customer's data into a separate BB-Demo data store. |
| Who owns the data held in the brain? | The customer. The brain is built and run on the customer's warehouse and remains under the customer's controls. |
| Which source systems can be connected? | Systems such as Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint and Slack. Fenmoor chooses which sources are connected, within the Growth connector allowance. |
| Is a separate environment used for testing? | A Sandbox is an add-on and is not part of the Growth tier. It would need to be agreed in the order form. |
| Can data be held in a specific region? | Dedicated EU or US data residency is an add-on. Fenmoor is a UK organisation, and the brain sits in whichever region its Snowflake account is in. |
Section B - Access control
| Question | Answer |
|---|---|
| How do users get access? | Through accounts managed in the brain by the customer's administrators. Growth is aimed at several teams, so we recommend Fenmoor nominates more than one administrator. |
| Is single sign-on supported? | Single sign-on and SCIM provisioning are part of the Enterprise tier, not Growth. The honest answer is that Growth users are managed directly in the product. |
| Can access be limited by team or role? | Access to data follows the permissions the customer sets in its Snowflake account and the connected source systems. The trade-off is that the brain can only show what the connecting role is allowed to read. |
| Does BB-Demo staff access customer data? | Only as needed to build, support and run the brain, and within the access the customer grants in its own account. The customer can withdraw that access. |
Section C - Data handling
| Question | Answer |
|---|---|
| Is data encrypted? | Encryption at rest and in transit is provided by the customer's Snowflake account and the platform it runs on, as configured by Fenmoor. |
| How fresh is the data? | The nightly refresh completes by 07:00 customer local time on business days, on every tier. Availability and freshness are separate measures. |
| What happens to data if the contract ends? | Because the data lives in the customer's own account, it stays there. BB-Demo's components and access are removed on exit. The detail belongs in the order form and the data processing terms. |
| Is customer data used to train models for other customers? | No. Each brain is built and run in its own customer's account, and nothing is shared across customers. |
Section D - Service and incident response
| Question | Answer |
|---|---|
| What availability applies? | The Growth service level for availability. Service credits on Growth apply to availability only, not to data freshness. |
| What is the first response for a priority-one issue? | One business hour on Growth. |
| How are incidents reviewed? | Through a blameless review that sets out the timeline, impact, cause and actions, shared with the affected customer. |
| Who is the named contact? | Fenmoor's account owner is Priya Raman and its customer success manager is Daniel Okafor. Named-engineer support is the Premium support add-on and is not part of Growth. |
Section E - Items outside this questionnaire
- Any certification, audit report or penetration-test summary that the reviewers require is not stated here. We will not assert something this document cannot evidence, and any such material should be requested separately.
- Contractual security commitments are set by the executed order form under the MSA and take precedence over this questionnaire.
- Fenmoor's own controls over Snowflake, its CRM and its helpdesk remain Fenmoor's responsibility.
Open points for the reviewers
- Confirm whether the Sandbox or regional residency add-ons are wanted before the order form is drafted.
- Confirm which source systems will connect first, so the connector commitments in the order form are realistic.
- Confirm the named administrators on the Fenmoor side.
Anything further, send it to me directly.
Best, Tobias