Brannock Medical Supplies - Security Questionnaire
Documentfinal Brannock Medical Supplies: documents · security_questionnaire · final · 2024-02-26
Security and data-handling answers from BB-Demo's CTO to Brannock's IT and governance reviewers, completed 26 Feb 2024 for the Growth tier. It states no availability percentage, P1 response time or price, and it is not a contract.
What it says
What this says
Current to 11 Oct 26Security and data-handling answers from BB-Demo's CTO to Brannock's IT and governance reviewers, completed 26 Feb 2024 for the Growth tier. It states no availability percentage, P1 response time or price, and it is not a contract.
What it is: BB-Demo's written answers to Brannock's evaluation questions on hosting, access, AI use and support, stored as final. Tobias Renwick prepared it for the Growth tier.
Commits: the brain runs inside Brannock's own Snowflake account, and retention follows Brannock's own warehouse policies. Availability and incident response refer to the standard Growth service levels and the order form, with no figures stated here.
Unusual: it says plainly that SSO and SCIM are Enterprise only, so "an Enterprise tier discussion would be required" if Brannock needs them. Data residency and Premium support are add-ons outside Growth.
Not settled: the actual service level figures, price and term, which sit in the order form. It makes no roadmap commitments and is dated 26 Feb 2024, so later changes are not reflected.
As found in this document
Current to 9 Oct 26- AvailabilityThe standard Growth availability service level applies, with service credits for availability breaches as set out in the order form.The standard Growth availability service level applies, with service credits for availability breaches as set out in the order form. · Source: object_read:doc_016_001
- Data freshnessThe nightly refresh completes by early morning customer local time on business days. Freshness credits apply to Enterprise only.The nightly refresh completes by early morning customer local time on business days. Freshness credits apply to Enterprise only. · Source: object_read:doc_016_001
- Incident responseThe Growth first-response service level for the most serious priority applies.The Growth first-response service level for the most serious priority applies. · Source: object_read:doc_016_001
- Data locationData stays within Brannock's own warehouse and its existing controls.Data stays within Brannock's own warehouse and its existing controls. · Source: object_read:doc_016_001
The document
Body
Brannock Medical Supplies - Security Questionnaire
Status: Final Completed: 26 Feb 2024 Prepared by: Tobias Renwick, Chief Technology Officer and Co-founder, BB-Demo Prepared for: the Brannock Medical Supplies IT and information governance reviewers Tier under discussion: Growth
Purpose and scope
This questionnaire records BB-Demo's answers to the security and data-handling questions raised by Brannock Medical Supplies during evaluation. Brannock distributes clinical consumables to NHS trusts, GP practices and care homes, so the questions focus on where data sits, who can reach it and how it is controlled. To be precise, answers describe the Growth tier as it would be configured for Brannock. Where a capability belongs to a different tier or is an add-on, the answer says so.
Architecture and data location
Read the whole document (4,558 characters)
| Area | Question | Answer |
|---|---|---|
| Hosting | Where does the brain run and where is data stored? | BB-Demo is built and run inside the customer's own Snowflake account. Brannock's data stays within Brannock's own warehouse and its existing controls. |
| Data copies | Does BB-Demo keep a separate copy of customer data outside the customer's environment? | The design intent is that the data stays in the customer's account. Any exception would be agreed in writing before implementation, and none is proposed for Brannock. |
| Residency | Can data be held in a specific region? | Location follows the region of Brannock's own Snowflake account. Dedicated EU or US data residency is a separate add-on and is not part of the Growth tier. |
| Sources | Which systems does the brain connect to? | Only the systems Brannock chooses to connect, within the Growth connector allowance. Each connector is read-oriented and can be switched off by Brannock at any time. |
Access control
| Area | Question | Answer |
|---|---|---|
| User access | How are users managed? | Users are provisioned by Brannock administrators within the Growth user allowance. Access to underlying data follows the roles set in Brannock's Snowflake account. |
| Single sign-on | Is SSO or SCIM provisioning available? | SSO and SCIM are part of the Enterprise tier and are not included in Growth. If Brannock needs them, the honest answer is that an Enterprise tier discussion would be required. |
| BB-Demo staff access | Who at BB-Demo can see customer data? | Only named engineers working on Brannock's implementation or a support case, and only through access that Brannock grants and can revoke. |
| Least privilege | Can access be limited by team? | Yes. Pages, chat and search respect the access rules Brannock sets, so key-account managers see what their role allows. |
Data handling and AI use
| Area | Question | Answer |
|---|---|---|
| Querying | How does the AI layer answer questions? | Questions are answered from data already indexed inside Brannock's Snowflake account, and answers are limited to what the asking user is permitted to see. |
| Retention | Who decides how long data is kept? | Brannock does. Retention follows Brannock's own warehouse policies, and removing a source removes it from the brain. |
| Deletion on exit | What happens when the contract ends? | The brain sits in Brannock's account, so Brannock keeps control of its data. BB-Demo's access is withdrawn and the configuration can be removed on request. |
Availability and support
| Area | Question | Answer |
|---|---|---|
| Availability | What availability is committed? | The standard Growth availability service level applies, with service credits for availability breaches as set out in the order form. |
| Data freshness | How current is the data? | The nightly refresh completes by early morning customer local time on business days. Freshness credits apply to Enterprise only. |
| Incident response | How fast does BB-Demo respond to a serious incident? | The Growth first-response service level for the most serious priority applies. Incident reviews are blameless and written up for the customer. |
| Premium support | Is a named engineer available? | Premium support is an add-on and is not included in Growth. |
Open items and follow-up
- Brannock may request further written evidence for its information governance file. Tobias Renwick will respond to each request directly.
- No roadmap commitments are made in this document. It describes the product as it stands.
- Marcus Bell will be the customer success contact after signature and can walk Brannock's reviewers through the controls above.
Best, Tobias
Unusual terms
Current to 9 Oct 26- SSO and SCIM excluded from Growth
- Data residency is a separate add-on
- Premium support not included