Wexmoor Property Group - Security Questionnaire
Documentfinal Wexmoor Property Group: documents · security_questionnaire · final · 2025-10-23
Final security questionnaire completed by Hannah Lowe on 23 Oct 2025 for Wexmoor Property Group's evaluation of the Growth tier. It states no figures: availability and P1 response are the standard Growth levels, deferred to the order form. It claims no certification.
What it says
What this says
Current to 11 Oct 26Final security questionnaire completed by Hannah Lowe on 23 Oct 2025 for Wexmoor Property Group's evaluation of the Growth tier. It states no figures: availability and P1 response are the standard Growth levels, deferred to the order form. It claims no certification.
What it is: BB-Demo's answers to security questions raised while Wexmoor evaluated the Growth tier. Prepared by Hannah Lowe, Solutions Engineer, and issued as final on 23 Oct 2025.
Commits: data stays in Wexmoor's own Snowflake account, and Wexmoor controls access and can revoke it. Refresh is nightly, completed by early morning customer local time on business days, for every tier.
Unusual: it defers service levels to the order form, saying the figure "would take precedence over this document". It also says Hannah will confirm the model-training wording in the contract documents.
Not settled: no availability figure, response time, price or term is stated. It names no signatory for Wexmoor and does not show whether an order form followed. SSO, SCIM, Sandbox, Premium support and US data residency are tier or add-on questions, not included in Growth.
As found in this document
Current to 9 Oct 26- Data locationIn Wexmoor's own Snowflake account. BB-Demo builds and runs the brain inside that account.In Wexmoor's own Snowflake account. BB-Demo builds and runs the brain inside that account. · Source: object_read:doc_010_001
- Data refreshNightly, completed by early morning customer local time on business days.Nightly, completed by early morning customer local time on business days. · Source: object_read:doc_010_001
- AvailabilityThe standard Growth service level for availability.The standard Growth service level for availability. · Source: object_read:doc_010_001
- Priority incident first responseThe standard Growth service level.The standard Growth service level. · Source: object_read:doc_010_001
- Service creditsYes, for availability breaches on the Growth tier.Yes, for availability breaches on the Growth tier. · Source: object_read:doc_010_001
The document
Body
Wexmoor Property Group - Security Questionnaire
Status: Final, version one Completed: 23 October 2025 Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Prepared for: Wexmoor Property Group, Chicago (IT and operations) Tier under discussion: Growth Account owner: Jordan Pike Customer success manager: Elena Novak
Purpose and scope
Wexmoor Property Group manages office and light-industrial portfolios across the Midwest and wants operations to see tenant tickets, lease-renewal calls and service contracts in one place. This questionnaire records BB-Demo's answers to the security questions raised during evaluation of the Growth tier. It covers the product as it would be deployed for Wexmoor, not BB-Demo's wider corporate estate.
To be precise, answers describe what is true of the Growth tier. Where a control belongs to a different tier or an add-on, the answer says so rather than implying it is included.
Section one: architecture and data location
Read the whole document (5,675 characters)
| Question | Answer | Notes |
|---|---|---|
| Where does the customer's data live? | In Wexmoor's own Snowflake account. BB-Demo builds and runs the brain inside that account. | Data is not copied into a separate BB-Demo data store for the product to work. |
| Who controls the Snowflake account? | Wexmoor. | Wexmoor decides who has access and can revoke it. |
| Which source systems connect? | Only the systems Wexmoor chooses to connect, for example the CRM, the helpdesk, the call recorder and shared drives. | Each connector is configured and agreed with Wexmoor's IT team before it goes live. |
| Is dedicated US data residency available? | Yes, as an add-on. | It is not part of the Growth tier by default. |
| Does the brain write back to source systems? | The short answer is no for the standard deployment. The longer answer is that any write-back would be scoped separately and agreed in writing. | Hannah will put that in writing if it becomes a requirement. |
Section two: access control
| Question | Answer | Notes |
|---|---|---|
| How do users sign in? | Through the standard sign-in provided with the Growth tier. | Single sign-on and SCIM provisioning are part of the Enterprise tier, not Growth. |
| Can access be limited by team? | Yes. Pages, chat and search respect the permissions set up during implementation. | Permission design is reviewed with Wexmoor's operations lead before launch. |
| Is there an admin role? | Yes. Wexmoor nominates its own administrators. | We recommend more than one administrator so access is not tied to one person. |
| Can BB-Demo staff see customer data? | Only where needed to deliver implementation and support, and only through access Wexmoor grants. | Wexmoor can withdraw that access at any time. |
Section three: availability and service levels
| Question | Answer | Notes |
|---|---|---|
| What availability is committed? | The standard Growth service level for availability. | The figure is stated in the order form, which would take precedence over this document. |
| What is the first-response commitment for a priority incident? | The standard Growth service level. | Faster response is part of Enterprise and the Premium support add-on. |
| When is data refreshed? | Nightly, completed by early morning customer local time on business days. | This applies to every tier. |
| Are service credits offered? | Yes, for availability breaches on the Growth tier. | Credits for data freshness are an Enterprise feature. |
| Is there a sandbox for testing changes? | Not on Growth by default. | The Sandbox is available with Enterprise or as an add-on. |
Section four: data handling and lifecycle
| Question | Answer | Notes |
|---|---|---|
| Is customer data used to train models for other customers? | No. The brain works over Wexmoor's own data inside Wexmoor's own account. | Hannah will confirm the precise wording of this commitment in the contract documents. |
| What happens at the end of the contract? | Because the data sits in Wexmoor's Snowflake account, it stays with Wexmoor. BB-Demo's access and the connectors are removed. | The exit steps are agreed with IT at the time. |
| How are deletions handled? | Deletion in a source system is reflected in the brain at the next refresh. | Retention rules are set with Wexmoor during implementation. |
Section five: assurance and incident handling
| Question | Answer | Notes |
|---|---|---|
| Does BB-Demo run security reviews with customers? | Yes. The Enterprise tier includes security review support. For Growth, Hannah answers questionnaires such as this one. | Further evidence can be requested through the account owner. |
| How are incidents communicated? | Through the support channel and the named customer contacts, with a written summary after a significant incident. | Contact names are agreed during onboarding. |
| Can Wexmoor audit BB-Demo's controls? | Reasonable audit requests are handled through the account owner and the Solutions Engineer. | Scope and timing are agreed in advance. |
Open items and limits of these answers
- This document does not claim any certification or attestation. Any such evidence would be supplied separately and in writing.
- Answers about single sign-on, premium support, the Sandbox and data residency are tier or add-on questions. They are commercial decisions for the order form, not security gaps.
- Where Wexmoor's IT team asks something this questionnaire does not cover, Hannah will check it properly before answering and put the answer in writing.
Sign-off
Completed and issued as final by Hannah Lowe, Solutions Engineer, BB-Demo, on 23 October 2025.
Thanks, Hannah
Unusual terms
Current to 9 Oct 26- Service levels deferred to the order form
- Model-training wording to be confirmed in contract documents
- No certification or attestation claimed