Ardcarne Life Assurance - Security Questionnaire v1
Documentdraft Ardcarne Life Assurance: documents · security_questionnaire · draft · 2026-05-05
Draft DORA ICT third-party questionnaire prepared by Theo Gallagher for Declan Furlong on 5 May 2026. Several answers are open, with no dated commitments. It states no availability figure, P1 response time or price, and says the order form will set binding terms.
What it says
What this says
Current to 11 Oct 26Draft DORA ICT third-party questionnaire prepared by Theo Gallagher for Declan Furlong on 5 May 2026. Several answers are open, with no dated commitments. It states no availability figure, P1 response time or price, and says the order form will set binding terms.
What it is: a draft DORA security questionnaire for the BB-Demo company brain, stating "Not final and not for filing in the register of information until every open finding below is closed with evidence." It was created and last modified on 5 May 2026.
Commits: it makes no binding service commitment. On service levels it says "The executed order form will set the binding terms", and the nightly refresh is only "intended to complete by 07:00 customer local time on business days".
Unusual: single sign-on is described as "an availability statement, not a commitment" because the tier is not agreed. The stated exit position is that data stays in the customer's Snowflake account, but the exit plan and its test are open.
Not settled: the sub-processor list, staff access and review cadence, incident history, notification times and exit plan all carry "To be agreed" as the dated commitment. The file does not show whether a second version was issued.
As found in this document
Current to 9 Oct 26- Nightly refreshintended to complete by 07:00 customer local time on business daysintended to complete by 07:00 customer local time on business days · Source: object_read:doc_008_002
- Binding service termsThe executed order form will set the binding terms.The executed order form will set the binding terms. · Source: object_read:doc_008_002
- Data protection agreementIt will be issued alongside the order form for review by Ardcarne.It will be issued alongside the order form for review by Ardcarne. · Source: object_read:doc_008_002
The document
Body
Ardcarne Life Assurance - Security Questionnaire v1
Status: Draft. Not final and not for filing in the register of information until every open finding below is closed with evidence.
| Prepared for | Declan Furlong, Chief Information Security Officer, Ardcarne Life Assurance |
| Prepared by | Theo Gallagher, Solutions Engineer, BB-Demo |
| Date | 5 May 2026 |
| Scope | DORA ICT third-party questionnaire for the BB-Demo company brain |
| Account owner (BB-Demo) | Matteo Ricci |
| Customer success manager (BB-Demo) | Elena Novak |
How to read this document
Each answer carries a control reference, a status and the evidence we can attach. Where an answer depends on the platform team, it is marked as such and is not to be treated as confirmed. Where a dated commitment is needed, the commitment is listed in the open findings section and has no date yet. We will not offer a verbal assurance in its place.
Status values used:
- Answered, evidence attached: the control exists and we can evidence it.
- Answered, evidence to follow: the control exists but the document has not yet been supplied.
- Open: we cannot yet answer in full.
Read the whole document (7,007 characters)
Section A: Governance and architecture
| Ref | Question | BB-Demo response | Evidence | Status |
|---|---|---|---|---|
| GOV-A | Where is customer data stored and processed? | The brain is built and run inside the customer's own Snowflake account. Customer data stays in Ardcarne's Snowflake account and is not copied into a BB-Demo-owned store. | Architecture overview | Answered, evidence to follow |
| GOV-B | Which systems would be connected? | Only the systems Ardcarne chooses to connect, for example Salesforce, Microsoft 365 or the helpdesk. Each connector is an explicit, reviewable decision. | Connector list agreed during scoping | Answered, evidence to follow |
| GOV-C | Who at BB-Demo is accountable for the service? | Matteo Ricci owns the commercial relationship and Elena Novak owns adoption and service review. Technical security answers are owned by Theo Gallagher. | Named contacts in this document | Answered, evidence attached |
| GOV-D | Are sub-processors used? | We will list every sub-processor with its role. This list has not yet been confirmed with the platform team. | None yet | Open |
Section B: Access control and identity
| Ref | Question | BB-Demo response | Evidence | Status |
|---|---|---|---|---|
| IAM-A | How do Ardcarne users authenticate? | Single sign-on and automated user provisioning are available on the Enterprise tier. The tier for Ardcarne has not yet been agreed, so this is an availability statement, not a commitment. | Tier description | Answered, evidence to follow |
| IAM-B | How is BB-Demo staff access to the environment controlled? | Staff access is by named individual and on a need-to-act basis. The exact mechanism inside the customer's Snowflake account needs confirmation from the platform team before we put it in writing. | None yet | Open |
| IAM-C | Is access reviewed? | We will describe the review cadence once the platform team has confirmed it. We will not state a cadence we cannot evidence. | None yet | Open |
Section C: Resilience, incidents and notification
| Ref | Question | BB-Demo response | Evidence | Status |
|---|---|---|---|---|
| INC-A | What is your incident history? | We understand incident history is a priority for Ardcarne. A written incident summary, with cause, impact and corrective actions, will be supplied as an attachment rather than described in this table. | Incident report to follow | Open |
| INC-B | What are your notification times for a major incident? | We will provide a dated commitment on notification times. The contractual position will be set out in the order form, which takes precedence over any statement in this questionnaire. | Order form, once drafted | Open |
| INC-C | What availability and refresh service levels apply? | Availability and nightly refresh targets vary by tier. The nightly refresh is intended to complete by 07:00 customer local time on business days. Service credits depend on the tier. The executed order form will set the binding terms. | Service level schedule | Answered, evidence to follow |
| INC-D | How is availability distinguished from data freshness? | They are reported separately. A brain can be available while answering on stale data, and the credit position differs by tier. | Service level schedule | Answered, evidence to follow |
Section D: Exit and continuity
| Ref | Question | BB-Demo response | Evidence | Status |
|---|---|---|---|---|
| EXT-A | What is the exit plan if Ardcarne terminates? | Because the brain runs inside Ardcarne's Snowflake account, the data and the structures built on it remain with Ardcarne. We need to document precisely what BB-Demo removes and what remains, and we will provide that as a written exit plan. | Exit plan to follow | Open |
| EXT-B | Can Ardcarne retrieve its data in a usable form? | Yes in principle, as the data is already in the customer's account. The format and the handover steps will be written down and tested before we call this closed. | Exit plan to follow | Open |
| EXT-C | Is the exit plan tested? | Not yet evidenced. We will not claim a test that has not been run. | None yet | Open |
Section E: Data protection and residency
| Ref | Question | BB-Demo response | Evidence | Status |
|---|---|---|---|---|
| DAT-A | Where will data be hosted? | In the region of Ardcarne's own Snowflake account. A dedicated EU data residency option exists as an add-on, and we will confirm whether it applies once the deployment is scoped. | Scoping notes | Answered, evidence to follow |
| DAT-B | Is a data processing agreement available? | Yes. It will be issued alongside the order form for review by Ardcarne. | Data processing agreement | Answered, evidence to follow |
Open findings and owners
These are the findings we will list at the start of the next call.
| Finding | Owner at BB-Demo | Needs from Ardcarne | Dated commitment |
|---|---|---|---|
| Sub-processor list (GOV-D) | Theo Gallagher, with the platform team | Confirmation of the required format | To be agreed |
| Staff access and review cadence (IAM-B, IAM-C) | Theo Gallagher, with the platform team | None | To be agreed |
| Incident history and notification times (INC-A, INC-B) | Theo Gallagher, with Matteo Ricci for the contractual wording | The format needed for the register of information | To be agreed |
| Exit plan and test (EXT-A to EXT-C) | Theo Gallagher | Ardcarne's exit requirements | To be agreed |
Next steps
- Declan Furlong to review this draft and mark any answer he does not accept.
- Theo Gallagher to obtain the platform team's written confirmation on the open items and attach evidence to each.
- Both parties to agree dated commitments for each open finding.
- A second version to be issued with the status changed only when every finding is closed with evidence.
Thanks, Theo
Unusual terms
Current to 9 Oct 26- Single sign-on stated as availability, not commitment
- All dated commitments marked To be agreed
- Exit plan not yet tested