Fenmoor Specialty Underwriting - Security Questionnaire v1
Documentdraft Fenmoor Specialty Underwriting: documents · security_questionnaire · draft · 2025-11-03
Draft BB-Demo answers to Fenmoor's supplier security questionnaire, dated 3 Nov 2025, for review by Nadia Osei. It commits to no figures beyond the 07:00 nightly refresh. Several answers are still open or pending evidence.
What it says
What this says
Current to 11 Oct 26Draft BB-Demo answers to Fenmoor's supplier security questionnaire, dated 3 Nov 2025, for review by Nadia Osei. It commits to no figures beyond the 07:00 nightly refresh. Several answers are still open or pending evidence.
What it is: a draft security questionnaire completed by Hannah Lowe for review by Fenmoor's IT Security Lead, Nadia Osei. It states "Nothing here is a control sign-off; that stays with Fenmoor."
Commits: the nightly refresh "completes by 07:00 Fenmoor local time on business days". Availability and P1 response are only referred to the order form, with service credits for availability only.
Unusual: it flags that SSO and SCIM are Enterprise, not Growth, and that EU or US residency is a separate add-on. This is an upsell route before the term ends on 30 Jun 2026.
Not settled: model training wording (A4), breach notification (D2) and sub-processors (D3) are Open. The region of Fenmoor's Snowflake account is unconfirmed, and no sign-off date is set. The text does not show a final version.
As found in this document
Current to 9 Oct 26- Date end30 Jun 2026Source: object_read:doc_001_020
- Nightly refreshcompletes by 07:00 Fenmoor local time on business dayscompletes by 07:00 Fenmoor local time on business days · Source: object_read:doc_001_020
- AvailabilityThe standard service level for the Growth tier applies, as stated in the order form, with service credits for availability only.The standard service level for the Growth tier applies, as stated in the order form, with service credits for availability only. · Source: object_read:doc_001_020
- P1 first responseThe Growth tier first-response commitment for priority-one incidents applies. The exact wording will be copied from the order form into the final version.The Growth tier first-response commitment for priority-one incidents applies. The exact wording will be copied from the order form into the final version. · Source: object_read:doc_001_020
The document
Body
Fenmoor Specialty Underwriting - Security Questionnaire v1
Status: Draft - BB-Demo answers prepared for review by Fenmoor's IT Security Lead. Not yet signed off.
1. Document control
| Item | Detail |
|---|---|
| Customer | Fenmoor Specialty Underwriting |
| Completed by | Hannah Lowe, Solutions Engineer, BB-Demo |
| Reviewer | Nadia Osei, IT Security Lead, Fenmoor Specialty Underwriting |
| Account owner | Priya Raman |
| Customer Success Manager | Daniel Okafor |
| Draft date | 3 Nov 2025 |
| Customer since | 1 Jul 2024 |
| Current tier | Growth, with the licensed user allowance set out in the order form |
| Current term ends | 30 Jun 2026 |
This questionnaire supports Fenmoor's supplier security review, which its capacity providers audit. Answers below are BB-Demo's draft position. Where evidence is still being gathered, the answer says so rather than assuming. Nothing here is a control sign-off; that stays with Fenmoor.
2. How to read this draft
Read the whole document (6,193 characters)
- Answered means BB-Demo can state the position and will provide written evidence.
- Evidence pending means the position is stated but the supporting document is not yet attached.
- Open means the answer needs a check with BB-Demo's security lead before it is committed to writing.
3. Questions and draft answers
3.1 Architecture and data location
| No. | Question | Draft answer | Status |
|---|---|---|---|
| A1 | Where is Fenmoor's data stored and processed? | To be precise: the brain is built and run inside Fenmoor's own Snowflake account. BB-Demo does not hold a separate copy of Fenmoor's data in a BB-Demo-owned warehouse. | Answered |
| A2 | Is data residency configurable? | The short answer is that Fenmoor's data sits where Fenmoor's Snowflake account sits. The longer answer is that dedicated EU or US residency is a separate add-on and is not part of the Growth tier. Fenmoor should confirm which region its Snowflake account uses so the audit trail is complete. | Evidence pending |
| A3 | Which source systems are connected? | The connectors agreed in the order form: submissions, bordereaux queries, claims tickets and CRM activity. A connector list will be attached as a one-page diagram. | Evidence pending |
| A4 | Is customer data used to train shared models? | Fenmoor's data is queried in place within its own account. BB-Demo will put the exact wording of this position in writing for the questionnaire. | Open |
3.2 Access control
| No. | Question | Draft answer | Status |
|---|---|---|---|
| B1 | How is access to the brain controlled? | Access is granted per named user, within the licensed user allowance. Administrators manage who can see which pages and sources. | Answered |
| B2 | Is single sign-on supported? | Single sign-on and automated user provisioning (SSO and SCIM) are part of the Enterprise tier, not Growth. For Fenmoor today, users are managed directly by Fenmoor's administrators. An upgrade would be the route if Fenmoor needs SSO for audit reasons. | Answered |
| B3 | Can BB-Demo staff access Fenmoor's data? | Access by BB-Demo staff is limited to what is needed to implement and support the service. The access process and approval record will be written out for the audit file. | Evidence pending |
| B4 | How are leavers handled? | Fenmoor's administrators remove leavers from the brain. BB-Demo recommends this is tied to Fenmoor's own leaver process and will describe the steps in writing. | Answered |
3.3 Availability and support
| No. | Question | Draft answer | Status |
|---|---|---|---|
| C1 | What availability is committed? | The standard service level for the Growth tier applies, as stated in the order form, with service credits for availability only. | Answered |
| C2 | How quickly are priority incidents answered? | The Growth tier first-response commitment for priority-one incidents applies. The exact wording will be copied from the order form into the final version. | Answered |
| C3 | When is data refreshed? | The nightly refresh completes by 07:00 Fenmoor local time on business days. | Answered |
| C4 | Is there a record of past incidents? | There have been no high-priority tickets from Fenmoor in the last thirty days and no tickets of any kind in that period. A fuller history can be exported from the helpdesk on request. | Evidence pending |
3.4 Governance and audit trail
| No. | Question | Draft answer | Status |
|---|---|---|---|
| D1 | Can BB-Demo evidence its controls to an auditor? | BB-Demo will supply written evidence for each control claimed. Where a control cannot be evidenced it will be listed as not claimed rather than described loosely. | Answered |
| D2 | Is there a breach notification process? | A process exists. The notification window and contacts will be written into the final answer and checked before this section is marked complete. | Open |
| D3 | How are sub-processors managed? | BB-Demo will list the systems involved in delivering the service and confirm which of them touch Fenmoor data. This needs a check with BB-Demo's security lead. | Open |
| D4 | What happens to data at the end of the contract? | Because the brain runs in Fenmoor's own Snowflake account, Fenmoor retains its data. BB-Demo's components can be removed at the end of the term; the removal steps will be documented. | Evidence pending |
4. Open points before review
- Confirm the region of Fenmoor's Snowflake account for the data residency answer (A2).
- Written position on model training and data use (A4).
- Breach notification wording and contacts (D2).
- Sub-processor list (D3).
- Attach the connector diagram and access-process record (A3, B3).
5. Next steps
- Hannah Lowe sends the evidence pack for the pending items, with the open items checked internally first.
- Nadia Osei reviews the draft against the capacity providers' requirements and lists anything further she needs in the questionnaire.
- Sign-off dates are set by Fenmoor once its capacity providers have seen the pack.
- Daniel Okafor keeps Priya Raman informed so that any tier question, such as SSO, is picked up with the account before the current term ends on 30 Jun 2026.
Thanks, Hannah
Unusual terms
Current to 9 Oct 26- SSO and SCIM not in Growth tier
- EU or US residency is a separate add-on
- Several answers Open or evidence pending