Quillmark Health - Security Questionnaire
Documentfinal Quillmark Health: documents · security_questionnaire · final · 2026-04-23
Final security questionnaire answers prepared by Hannah Lowe on 23 Apr 2026 for an Enterprise tier assessment. It states no availability figure, P1 response time or price, and leaves seven items open, including the business associate agreement for HIPAA.
What it says
What this says
Current to 11 Oct 26Final security questionnaire answers prepared by Hannah Lowe on 23 Apr 2026 for an Enterprise tier assessment. It states no availability figure, P1 response time or price, and leaves seven items open, including the business associate agreement for HIPAA.
What it is: BB-Demo's written answers to Quillmark Health's security review, prepared by Hannah Lowe, Solutions Engineer, and marked Final. It assesses the Enterprise tier and records that Quillmark "has told us it is" subject to HIPAA.
Commits: the brain runs "Inside the customer's own Snowflake account", and "The nightly refresh is complete by 07:00 your local time on business days." SSO and SCIM are included, and Enterprise is credited for availability and data freshness.
Not settled: the availability figure and P1 response time are deferred to the order form, and no price appears. Seven open items remain, including the business associate agreement, certifications, penetration testing and staff access logging.
Unusual: the answers promise written follow-up before the review closes. The document is not a contract and binds nothing until those answers and the order form are in place.
As found in this document
Current to 9 Oct 26- Data locationInside the customer's own Snowflake account.Inside the customer's own Snowflake account. · Source: object_read:doc_006_002
- Nightly refreshThe nightly refresh is complete by 07:00 your local time on business days.The nightly refresh is complete by 07:00 your local time on business days. · Source: object_read:doc_006_002
- Service creditsEnterprise carries credits for availability and also for data freshness.Enterprise carries credits for availability and also for data freshness. · Source: object_read:doc_006_002
- Security review supportIncluded in the fixed fee.Source: object_read:doc_006_002
The document
Body
Quillmark Health - Security Questionnaire
Prepared for: Quillmark Health, Boston Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Date: 23 Apr 2026 Tier assessed: Enterprise Version: Final
About these answers
The short answer is that these responses describe how the BB-Demo company brain is built and run for an Enterprise customer. The longer answer is that I have only stated what I can stand behind. Where a control, certificate or contractual term is not something I can confirm from the architecture itself, the answer says so and is listed under open items at the end. I will put each of those in writing before your review closes. I have not rounded anything up.
Section one: architecture and data location
Read the whole document (6,001 characters)
| Question | Answer |
|---|---|
| Where does the customer's data reside? | Inside the customer's own Snowflake account. BB-Demo builds and runs the brain there. The data is not moved into an environment that BB-Demo holds. |
| Does BB-Demo hold a separate copy of customer data? | The design is that the brain operates inside the customer's account. To be precise, any item that would sit outside that account is listed in the open items so that you can judge it. |
| Can the customer choose the region of the data? | Dedicated US data residency is available as an add-on. Because the brain runs in your Snowflake account, the region follows the account you choose. |
| Which systems can be connected? | Systems such as the CRM, helpdesk, call recorder, email, file storage and accounting system, within the Enterprise connector allowance. Each connector is agreed in advance and can be switched off by the customer. |
| Can the customer limit which sources the brain reads? | Yes. Connectors are configured one at a time and only the agreed sources are loaded. |
Section two: access control
| Question | Answer |
|---|---|
| Is single sign-on supported? | Yes. Single sign-on is included in the Enterprise tier. |
| Is automated user provisioning supported? | Yes. SCIM provisioning is included in the Enterprise tier, so leavers can be removed through your identity provider. |
| Who at BB-Demo can access the customer's environment? | Access is limited to the people working on the implementation and support for that customer. A named list can be agreed in the order form. The exact access mechanism is covered in the open items. |
| Is there an administrator role for the customer? | Yes. Your administrators manage users, connectors and what each group of users can see. |
Section three: service levels and availability
| Question | Answer |
|---|---|
| What availability is committed? | The Enterprise availability commitment, which is the highest of our three tiers. The figure is stated in the order form. |
| What is the response time for a priority-one incident? | The Enterprise priority-one first response, which is the fastest of our three tiers. Premium support with a named engineer is available as an add-on. |
| How fresh is the data? | The nightly refresh is complete by 07:00 your local time on business days. |
| Are there service credits? | Yes. Enterprise carries credits for availability and also for data freshness. Lower tiers are credited for availability only. |
| Is there a place to test changes safely? | The Sandbox is available as an add-on for Enterprise customers. |
One point I want to be precise about: availability and freshness are separate measures. A brain can be available and still answering on stale data. Only Enterprise is credited for freshness.
Section four: regulated data and HIPAA
| Question | Answer |
|---|---|
| Is the customer subject to HIPAA? | Yes, Quillmark Health has told us it is. This is the reason the security review is part of the Enterprise implementation. |
| Will BB-Demo sign a business associate agreement? | I cannot confirm this from the architecture. It is a contractual point, so I have listed it as an open item, and I will not answer it informally. |
| Will protected health information be loaded into the brain? | That is a decision for you. We recommend agreeing in writing, before any connector goes live, which fields are in scope. Connectors can be limited so that fields you exclude are never loaded. |
| Can data be removed on request? | Because the data sits in your Snowflake account, you control retention and deletion there. How derived content is handled is in the open items. |
Section five: assurance and certifications
| Question | Answer |
|---|---|
| Does BB-Demo hold independent security certifications? | I am not going to state a certification in a questionnaire unless I can attach the evidence. This is an open item and will be answered in writing with the supporting document. |
| Is penetration testing carried out? | Open item. I will confirm the position, with the date of the most recent test, in writing. |
| Is the security review supported by BB-Demo? | Yes. Security review support is part of the Enterprise implementation, and it is included in the fixed fee. |
| Are staff background-checked and trained? | Open item. This is answered by our people team and I will not paraphrase it. |
Open items
These are the questions I could not answer from the architecture alone. Each will be answered in writing, and confirmed with our security lead before it is sent.
- The business associate agreement position.
- Any component that would sit outside the customer's Snowflake account.
- How BB-Demo staff access a customer environment, and how that access is logged.
- Independent certifications and the evidence for them.
- The date and scope of the most recent penetration test.
- Staff screening and security training.
- Handling of derived content on deletion requests.
Contact
If your security team wants any of these walked through, I am happy to start the call by asking what they most need to know, and I will put the answers in writing afterwards.
Thanks, Hannah
Hannah Lowe Solutions Engineer BB-Demo
Unusual terms
Current to 9 Oct 26- Seven open items to be answered in writing
- Business associate agreement not confirmed
- Availability figure deferred to the order form