Clonvara Insurance Services - Security Questionnaire
Documentfinal Clonvara Insurance Services: documents · security_questionnaire · final · 2025-08-29
Security questionnaire completed by Hannah Lowe, Solutions Engineer, for the Growth tier discussion. It states the brain runs inside the customer's own Snowflake account, with a P1 first response of one business hour. It states no price.
What it says
What this says
Current to 11 Oct 26Security questionnaire completed by Hannah Lowe, Solutions Engineer, for the Growth tier discussion. It states the brain runs inside the customer's own Snowflake account, with a P1 first response of one business hour. It states no price.
What it is: a final questionnaire from BB-Demo's Solutions Engineer, prepared for the Dublin customer. For Growth, it says the questionnaire and a follow-up call are the security review.
Commits: the P1 first response is one business hour and the nightly refresh completes by 07:00 customer local time on business days. Growth credits apply for availability only.
Unusual: nothing off standard terms. Availability is not given as a figure; it defers to the standard Growth commitment unless an executed order form changes it.
Not settled: whether dedicated EU data residency is required, and which source systems are in scope for the first connectors. The document is not a contract, carries no price, and the data processing agreement is still to be agreed before any data is connected.
As found in this document
Current to 9 Oct 26- AvailabilityThe standard Growth availability commitment applies unless an executed order form changes it.The standard Growth availability commitment applies unless an executed order form changes it. · Source: object_read:doc_025_001
- P1 first responseGrowth has a priority-one first response of one business hour.Growth has a priority-one first response of one business hour. · Source: object_read:doc_025_001
- Nightly refreshThe nightly refresh completes by 07:00 customer local time on business days, on every tier.The nightly refresh completes by 07:00 customer local time on business days, on every tier. · Source: object_read:doc_025_001
- Service creditsOn Growth, credits apply for availability only.On Growth, credits apply for availability only. · Source: object_read:doc_025_001
- Data processing agreementAgreed before any data is connected.Agreed before any data is connected. · Source: object_read:doc_025_001
The document
Body
Clonvara Insurance Services - Security Questionnaire
Status: Final Completed by: Hannah Lowe, Solutions Engineer, BB-Demo Date: 29 August 2025 Prepared for: Clonvara Insurance Services, Dublin Tier under discussion: Growth
This questionnaire sets out how the BB-Demo company brain handles data for Clonvara Insurance Services. Where a control depends on the contract or on Clonvara's own Snowflake configuration, the answer says so. To be precise, I have only answered what we can stand behind in writing.
Architecture and data location
Read the whole document (3,780 characters)
| Question | Answer |
|---|---|
| Where does the brain run? | Inside Clonvara's own Snowflake account. BB-Demo builds and operates the brain there; it is not a separate multi-customer data store. |
| Does customer data leave the customer's Snowflake account? | The short answer is no for the stored data: indexed records stay in Clonvara's account. The longer answer is that answers to questions are generated from that data and returned to the people who asked. |
| Can data be held in the EU or a specific region? | The brain sits in the region of Clonvara's Snowflake account. Dedicated EU data residency is also available as an add-on, and we can discuss whether it is needed. |
| Which source systems connect? | The connectors agreed in the order form, for example the CRM, the helpdesk, the call recorder and the accounting system. The Growth tier includes a defined number of connectors, and any addition is a commercial change. |
Access control
| Question | Answer |
|---|---|
| How are users authenticated? | Users sign in to the brain with their individual accounts. Single sign-on and SCIM provisioning are part of the Enterprise tier, not Growth. |
| Can access be limited by team or role? | Yes. Administrators control which users and teams see which pages and dashboards. Source permissions are agreed during connector design. |
| Do BB-Demo staff have access to Clonvara data? | Only the staff working on Clonvara's implementation and support, and only as needed for that work. I will put the access arrangements in writing as part of the contract pack. |
Service levels and resilience
| Question | Answer |
|---|---|
| What availability is committed? | The standard Growth availability commitment applies unless an executed order form changes it. |
| What are support response times? | Growth has a priority-one first response of one business hour. Premium support, with a named engineer, is available as an add-on. |
| How fresh is the data? | The nightly refresh completes by 07:00 customer local time on business days, on every tier. |
| Are service credits offered? | On Growth, credits apply for availability only. Data freshness credits are an Enterprise feature. |
Governance and assurance
| Question | Answer |
|---|---|
| Is there a formal security review? | A full security review is part of the Enterprise sales process. For Growth, this questionnaire and a follow-up call with me are the review. |
| How are personal data and processing terms handled? | Through a data processing agreement alongside the master services agreement, agreed before any data is connected. |
| Is there a sandbox for testing changes? | The Sandbox is an add-on, and from the second price book it is included with Enterprise. It is not part of Growth. |
| Who do we contact with follow-up questions? | Hannah Lowe, Solutions Engineer. I will put any further answers in writing. |
Open items
- Clonvara to confirm whether dedicated EU data residency is required.
- Clonvara to confirm which source systems are in scope for the first connectors.
- Any question outside the answers above will be checked with our security lead before I reply, rather than answered from memory.
Thanks, Hannah