Brakkevoort Logistics - Security Questionnaire
Documentfinal Brakkevoort Logistics: documents · security_questionnaire · final · 2025-02-02
Final version one security questionnaire for the Growth tier, prepared by Hannah Lowe on 2 Feb 2025. It states no availability percentage, P1 response time or price, and defers these to the order form. Four open points are carried forward.
What it says
What this says
Current to 11 Oct 26Final version one security questionnaire for the Growth tier, prepared by Hannah Lowe on 2 Feb 2025. It states no availability percentage, P1 response time or price, and defers these to the order form. Four open points are carried forward.
What it is: a pre-sale answer sheet for Brakkevoort Logistics, written while it evaluated the brain. It is not a contract and binds no one to a figure.
Commits: the data stays in the customer's account, with the line "Your data stays in your account and is not copied into a shared BB-Demo data store." BB-Demo acts as processor, and the data processing agreement is signed alongside the order form.
Unusual: single sign-on and SCIM are stated as Enterprise only, so Growth users sign in with the standard method. Availability, P1 response and service credits are left to the order form.
Not settled: the sub-processor list, the staff access note, which assurance reports can be shared, and whether EU data residency is wanted as an add-on. The evidence does not show whether these were closed.
As found in this document
Current to 9 Oct 26- Data locationThe brain is built and run inside your own Snowflake account.The brain is built and run inside your own Snowflake account. · Source: object_read:doc_024_001
- Data freshnessThe nightly refresh completes before the start of the business day in your local time, on business days.The nightly refresh completes before the start of the business day in your local time, on business days. · Source: object_read:doc_024_001
- Availability and creditsThe standard Growth availability service level applies, with service credits for availability breaches as set out in the order form.The standard Growth availability service level applies, with service credits for availability breaches as set out in the order form. · Source: object_read:doc_024_001
- P1 first responseThe Growth first-response commitment for a priority one issue applies. The figure is stated in the order form.The Growth first-response commitment for a priority one issue applies. The figure is stated in the order form. · Source: object_read:doc_024_001
- Data processing agreementIt sits under the master agreement and is signed alongside the order form.It sits under the master agreement and is signed alongside the order form. · Source: object_read:doc_024_001
- Incident notificationWe notify your named contacts as soon as an incident affecting your data is confirmedWe notify your named contacts as soon as an incident affecting your data is confirmed · Source: object_read:doc_024_001
The document
Body
Brakkevoort Logistics - Security Questionnaire
Status: Final, version one Date: 2 Feb 2025 Prepared for: Brakkevoort Logistics, Rotterdam Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Tier under discussion: Growth Account owner: Tom Ashdown Customer success manager: Natalie Eze
Purpose and scope
This document answers the security and data-handling questions raised by Brakkevoort Logistics while it evaluates the brain. The answers describe the Growth tier as it would apply to a port-linked warehousing and road freight business that wants account managers to see shipper accounts, exception tickets and calls together. Where an answer depends on the signed order form, it says so. Where a point needs written confirmation beyond this sheet, it is marked as such rather than guessed.
Section A: Architecture and data location
Read the whole document (5,245 characters)
| Question | Answer |
|---|---|
| Where does the brain run and where is customer data stored? | The brain is built and run inside your own Snowflake account. Your data stays in your account and is not copied into a shared BB-Demo data store. |
| Who owns the data held in the brain? | Brakkevoort Logistics. BB-Demo works on it inside your environment to provide the service. |
| Can data be kept in a particular region? | Your Snowflake account sits in the region you choose. Dedicated EU data residency is available as an add-on, and we would confirm the exact arrangement in the order form. |
| Which source systems can be connected? | CRM, helpdesk, call recorder, mailboxes, finance and shared-drive sources can be connected. The Growth tier has a connector allowance, and the specific list is agreed during implementation. |
Section B: Access control
| Question | Answer |
|---|---|
| How is access to the brain controlled? | Access is granted per user by your named administrators. People only see what their role has been given. |
| Is single sign-on available? | Single sign-on and SCIM provisioning are part of the Enterprise tier, not Growth. To be precise, on Growth, users sign in with the standard method. If single sign-on is a hard requirement we should talk about Enterprise. |
| Can we limit which teams see which sources? | Yes. Connectors and views can be scoped so that, for example, finance data is not visible to every account manager. We would agree the scoping with you during design. |
| Does BB-Demo staff access require approval? | Support access to your environment is limited to named BB-Demo staff working on your account. I will put the detail of the access procedure in writing as a separate note. |
Section C: Service levels and resilience
| Question | Answer |
|---|---|
| What availability is offered? | The standard Growth availability service level applies, with service credits for availability breaches as set out in the order form. |
| What is the response time for a serious incident? | The Growth first-response commitment for a priority one issue applies. The figure is stated in the order form. |
| How fresh is the data? | The nightly refresh completes before the start of the business day in your local time, on business days. |
| Are backups and recovery in scope? | Storage and recovery of your data follow your Snowflake account configuration. We will confirm in writing what BB-Demo adds on top for configuration and pipelines. |
Section D: Compliance and assurance
| Question | Answer |
|---|---|
| Is a data processing agreement available? | Yes. It sits under the master agreement and is signed alongside the order form. |
| Is BB-Demo a processor or a controller of your data? | BB-Demo acts as a processor for the customer data it handles on your instructions. |
| Are sub-processors used? | The short answer is that your Snowflake account is the main platform. The longer answer is that I will list any other sub-processors in writing before signature, so that you are not relying on this sheet alone. |
| Can we receive independent assurance reports? | I have referred this to our security team and will confirm in writing which reports we can share. I have not stated anything here that I cannot back up. |
Section E: Incident handling and people
| Question | Answer |
|---|---|
| How will you tell us about a security incident? | We notify your named contacts as soon as an incident affecting your data is confirmed, and the notification terms are written into the data processing agreement. |
| Who is our day-to-day contact for security questions? | Hannah Lowe handles security questions during evaluation and implementation. After go-live, Natalie Eze is your customer success manager. |
| Is security review support included? | Questionnaire support is part of the sales process. Dedicated security review support is included in the Enterprise implementation. |
Open points carried to the order form
- Written list of sub-processors, if any, beyond your Snowflake account.
- Written note on BB-Demo staff access procedure.
- Confirmation of which independent assurance reports can be shared.
- Decision on whether EU data residency is wanted as an add-on.
Sign-off
Prepared and reviewed by Hannah Lowe, Solutions Engineer, BB-Demo, 2 Feb 2025.
Thanks, Hannah
Unusual terms
Current to 9 Oct 26- SSO and SCIM not included on Growth
- EU data residency only as an add-on
- Four open points carried to the order form