Fairhallow Travel - Security Questionnaire
Documentfinal Fairhallow Travel: documents · security_questionnaire · final · 2024-10-21
Final version 1 security questionnaire, dated 21 Oct 2024, prepared by Hannah Lowe for Fairhallow Travel's evaluation of the Growth tier. It states no figures for availability, P1 response or price, and leaves certifications, testing and sub-processors to be confirmed in writing.
What it says
What this says
Current to 11 Oct 26Final version 1 security questionnaire, dated 21 Oct 2024, prepared by Hannah Lowe for Fairhallow Travel's evaluation of the Growth tier. It states no figures for availability, P1 response or price, and leaves certifications, testing and sub-processors to be confirmed in writing.
What it is: a questionnaire response from Hannah Lowe, Solutions Engineer, answering Fairhallow Travel's security questions during its Growth tier evaluation. It is a pre-sale assurance document, not a contract.
Commits: the nightly refresh is stated as "completes by 07:00 customer local time on business days, on every tier". The brain runs in the customer's own Snowflake account and the data is owned by Fairhallow Travel.
Unusual: availability and P1 response are described only as the standard Growth commitments, with no figures given. SSO and SCIM are said to be Enterprise only, and Premium support is described as an Enterprise add-on.
Not settled: certification status, penetration testing summary, the sub-processor list and the arrangement for BB-Demo staff access are all deferred to written confirmation. The document does not show whether those confirmations were sent, or whether Fairhallow Travel signed.
As found in this document
Current to 9 Oct 26- Nightly refreshcompletes by 07:00 customer local time on business days, on every tiercompletes by 07:00 customer local time on business days, on every tier · Source: object_read:doc_020_001
- AvailabilityThe standard Growth availability commitment, with service credits for availability breaches.The standard Growth availability commitment, with service credits for availability breaches. · Source: object_read:doc_020_001
- P1 first responseGrowth carries the Growth first-response commitment for priority one incidents, measured in business hours.Growth carries the Growth first-response commitment for priority one incidents, measured in business hours. · Source: object_read:doc_020_001
The document
Body
Fairhallow Travel - Security Questionnaire
Status: Final, version 1 Date: 21 October 2024 Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Prepared for: Fairhallow Travel, Manchester Tier under evaluation: Growth
About this response
This document answers the security questions raised during Fairhallow Travel's evaluation of the BB-Demo company brain on the Growth tier. Where an answer depends on a document or control I cannot state precisely here, I say so and will put it in writing rather than guess.
Architecture and data location
| Area | Question | Response |
|---|---|---|
| Hosting | Where does the brain run and where is our data stored? | The brain is built and run inside your own Snowflake account. Your data is not copied to a separate BB-Demo data store. |
| Data residency | Can data be kept in a specific region? | Your data stays in the region of your own Snowflake account. Dedicated EU or US data residency is available as an add-on where it is needed. |
| Ownership | Who owns the data in the brain? | Fairhallow Travel. BB-Demo works on it inside your environment, under the agreement between us. |
Connected systems
Read the whole document (3,763 characters)
| Area | Question | Response |
|---|---|---|
| Connectors | Which systems can be connected? | Typical sources are the CRM, call recorder, email, helpdesk, accounting system and shared drives. Named examples are Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint and Slack. |
| Scope | Can we limit what the brain reads? | Yes. Connectors are configured one source at a time, and you decide which sources are connected. |
| Refresh | How fresh is the data? | The nightly refresh completes by 07:00 customer local time on business days, on every tier. |
Access control
| Area | Question | Response |
|---|---|---|
| Single sign-on | Is SSO supported? | To be precise, SSO and SCIM provisioning are part of the Enterprise tier and are not included in Growth. If you need them, that points to Enterprise. |
| User access | How are users managed on Growth? | Users are managed by your administrators within the brain, up to the Growth user allowance. |
| BB-Demo staff access | Who at BB-Demo can reach our environment? | Access is limited to staff working on your implementation and support. I will put the exact arrangement in writing as part of the contract pack. |
Service and support
| Area | Question | Response |
|---|---|---|
| Availability | What availability is committed? | The standard Growth availability commitment, with service credits for availability breaches. |
| Incidents | How quickly do you respond to a priority incident? | Growth carries the Growth first-response commitment for priority one incidents, measured in business hours. |
| Premium support | Is a named engineer available? | Premium support is an Enterprise add-on and is not part of Growth. |
Assurance and certification
| Area | Question | Response |
|---|---|---|
| Certifications | Which independent certifications does BB-Demo hold? | I am not stating certification status in this questionnaire. I will confirm it in writing so that you have an accurate, dated answer. |
| Penetration testing | Is independent testing carried out and can we see a summary? | I will confirm the position and what can be shared in writing. |
| Sub-processors | Which sub-processors are used? | I will provide the current list in writing alongside the data processing terms. |
Open items for BB-Demo to confirm in writing
- Current certification status and any supporting documents.
- Summary of independent testing, if it can be shared.
- Current sub-processor list.
- Exact arrangement for BB-Demo staff access to your environment.
Thanks, Hannah
Unusual terms
Current to 9 Oct 26- SSO and SCIM not included in Growth
- Premium support not part of Growth
- Certifications and sub-processors deferred to written confirmation