Harrowden Foods - Security Questionnaire
Documentfinal Harrowden Foods: documents · security_questionnaire · final · 2025-10-31
Final, version one security questionnaire completed by Hannah Lowe on 31 Oct 2025 for a Growth tier evaluation. It describes architecture and service levels, not certifications. It quotes no availability percentage, P1 response time or price.
What it says
What this says
Current to 11 Oct 26Final, version one security questionnaire completed by Hannah Lowe on 31 Oct 2025 for a Growth tier evaluation. It describes architecture and service levels, not certifications. It quotes no availability percentage, P1 response time or price.
What it is: BB-Demo's answers to security questions raised while Harrowden Foods evaluates the Growth tier. It was completed by Hannah Lowe, Solutions Engineer, on 31 Oct 2025.
Commits: the brain runs "Inside Harrowden Foods' own Snowflake account", and on Growth credits "cover availability only". The text gives no figures for availability, response times or price.
Unusual: nothing off the standard terms. The document says single sign-on and SCIM "belong to the Enterprise tier", so an IT requirement for them would be an upgrade conversation.
Not settled: it is not a statement of certifications, and it says anything not stated "has not been promised". Four open items remain: the connector list, single sign-on need, Snowflake region and retailer data conditions.
As found in this document
Current to 9 Oct 26- HostingInside Harrowden Foods' own Snowflake accountInside Harrowden Foods' own Snowflake account · Source: object_read:doc_009_001
- Service credits on GrowthOn Growth, credits cover availability onlyOn Growth, credits cover availability only · Source: object_read:doc_009_001
- P1 responseThe Growth first-response commitment for a top-priority issue, measured in business hoursThe Growth first-response commitment for a top-priority issue, measured in business hours · Source: object_read:doc_009_001
- Nightly refreshThe nightly refresh completes before the start of your business day on business daysThe nightly refresh completes before the start of your business day on business days · Source: object_read:doc_009_001
The document
Body
Harrowden Foods - Security Questionnaire
Status: Final, version one Completed by: Hannah Lowe, Solutions Engineer, BB-Demo Completed on: Friday 31 October 2025 Prepared for: Harrowden Foods, Leicester Tier under discussion: Growth BB-Demo account owner: Lewis Kerr BB-Demo customer success manager: Amara Obi
About this document
Harrowden Foods is evaluating the Growth tier so that commercial insights and customer service can see retailer accounts, service-level complaints and orders together. This questionnaire records how BB-Demo answers the security questions raised during that evaluation. Where the honest answer is "it depends on how you configure it", the answer says so. Where I could not give a complete answer without checking, I have said that I will put it in writing rather than guess.
The short answer to most of the architecture questions is that the brain is built and run inside your own Snowflake account. The longer answer is in the sections below.
Section A: Hosting and data location
Read the whole document (6,148 characters)
| Question | Answer |
|---|---|
| Where does the brain run? | Inside Harrowden Foods' own Snowflake account. BB-Demo builds and operates the brain there; it is not a separate copy of your data held in a BB-Demo environment. |
| Who owns the data in the brain? | Harrowden Foods. The data stays in your Snowflake account and under your account controls. |
| Is dedicated regional data residency available? | Yes, as an add-on, for EU or US residency. Harrowden Foods is a UK customer, so residency would follow the region of your Snowflake account unless you ask for something different. |
| Does BB-Demo keep a separate store of customer data? | No. The brain is a layer over your own systems and warehouse. |
Section B: Connectors and data sources
| Question | Answer |
|---|---|
| Which sources can be connected? | Your CRM, call recordings, email, helpdesk, product usage, finance and HR data. The named systems we connect to include Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint and Slack. |
| How many connectors does the Growth tier include? | The Growth connector allowance. This is a hard limit, so additional connectors are bought as an add-on. |
| Who decides which sources are connected? | Harrowden Foods. Nothing is connected without your sign-off on the connector list during implementation. |
| Can a source be disconnected later? | Yes. Removing a connector stops further loading from that source. Agreeing what happens to data already indexed is part of the offboarding conversation, and I will put the options in writing if you need them before signing. |
Section C: Access control
| Question | Answer |
|---|---|
| How are users managed on Growth? | Users are created and removed by your administrators. Growth includes the Growth user allowance, which is a soft limit. |
| Is single sign-on available? | Single sign-on and SCIM provisioning belong to the Enterprise tier. They are not part of Growth. If your IT team needs them as a condition of go-live, that is an upgrade conversation and I would rather raise it now than after signature. |
| Can access be limited by team? | Yes. Commercial insights and customer service can be given different views, and access follows the permissions you set in your own Snowflake account. |
| Do BB-Demo staff have standing access to your data? | Access is limited to what is needed to build and support the brain inside your account, and it is granted through your account controls so that you can see and revoke it. |
Section D: Availability and support
| Question | Answer |
|---|---|
| What availability service level applies? | The standard Growth availability service level, with service credits for availability breaches only. |
| What response time applies to a serious incident? | The Growth first-response commitment for a top-priority issue, measured in business hours. |
| Is the data refreshed daily? | The nightly refresh completes before the start of your business day on business days. This applies to every tier. |
| Are service credits paid for stale data on Growth? | No. On Growth, credits cover availability only. Credit for data freshness is an Enterprise feature. To be precise, a brain that answers on stale data is still counted as available. |
| Is Premium support available? | Premium support, with a named engineer, is an add-on for Enterprise from the second price book version. It is not part of Growth. |
Section E: Security review scope
| Question | Answer |
|---|---|
| Is a formal security review included? | Security review support is included in the Enterprise implementation. For Growth, I complete this questionnaire and answer follow-up questions from your IT team. |
| Can Harrowden Foods have a sandbox for testing? | The Sandbox is an Enterprise feature from the second price book version, so it is not included in Growth. |
| Can this be taken as a statement of certifications? | No. This questionnaire describes architecture and service levels. It does not list certifications or audit reports. If your procurement process requires those, ask and I will confirm in writing what we can provide. |
Open items for Harrowden Foods
These are things I could not close from the information so far. None of them blocks a decision, but I would like them settled before implementation starts.
- Confirm the list of sources to connect, so we can check it fits within the Growth connector allowance.
- Confirm whether your IT team will require single sign-on, which would point to Enterprise rather than Growth.
- Confirm the Snowflake region you want the brain to run in.
- Tell us if your retailer customers impose any contractual conditions on how complaint and order data is handled, so we can check them against the design.
Statement
The answers above are accurate to the best of my knowledge on the date of completion. Anything not stated here has not been promised. If a control is not described, assume it is not yet confirmed and ask me.
Thanks, Hannah
Hannah Lowe Solutions Engineer, BB-Demo Friday 31 October 2025