Lindqvarn Retail - Security Questionnaire
Documentfinal Lindqvarn Retail: documents · security_questionnaire · final · 2025-02-22
Final security questionnaire prepared by Hannah Lowe on 22 Feb 2025 for the Enterprise tier. It describes architecture, access control, data handling and support, and states no availability percentage, response time or price. Three items are left to a written addendum.
What it says
What this says
Current to 11 Oct 26Final security questionnaire prepared by Hannah Lowe on 22 Feb 2025 for the Enterprise tier. It describes architecture, access control, data handling and support, and states no availability percentage, response time or price. Three items are left to a written addendum.
What it is: a pre-contract answer sheet for Lindqvarn Retail's security team, written by Hannah Lowe, Solutions Engineer. It describes the Enterprise tier and says it "describes how the Enterprise tier is built and run".
Commits: nothing in figures. Availability and response time are deferred, with "The order form states it" for availability. It confirms SSO, SCIM and credits for "availability and also to data freshness".
Unusual: nothing off standard terms. Dedicated EU data residency is an add-on, and Premium support is "an optional add-on" outside the baseline.
Not settled: administrator log retention, the exact EU residency arrangement and any extra controls. The document does not show whether the addendum was sent, who signed, or whether Lindqvarn Retail took the add-ons.
As found in this document
Current to 9 Oct 26- Availability commitmentThe Enterprise service level, which is the highest of our three tiers. The order form states it.The Enterprise service level, which is the highest of our three tiers. The order form states it. · Source: object_read:doc_026_001
- First response for urgent issuesThe Enterprise response time for the most urgent tickets, which is the fastest we offer.The Enterprise response time for the most urgent tickets, which is the fastest we offer. · Source: object_read:doc_026_001
- Service creditsOn Enterprise, credits apply to availability and also to data freshness.On Enterprise, credits apply to availability and also to data freshness. · Source: object_read:doc_026_001
- Nightly refreshcompletes by the start of the business day in your local time on business days, on every tiercompletes by the start of the business day in your local time on business days, on every tier · Source: object_read:doc_026_001
- Written addendumI will send these as a short written addendum once your security team has confirmed which of them apply.I will send these as a short written addendum once your security team has confirmed which of them apply. · Source: object_read:doc_026_001
The document
Body
Lindqvarn Retail - Security Questionnaire
Status: Final Prepared for: Lindqvarn Retail, Stockholm Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Date: 22 Feb 2025 Tier under review: Enterprise
1. Purpose and scope
This document answers the security questions raised by Lindqvarn Retail during evaluation of the brain for customer service, e-commerce and store feedback data. To be precise, it describes how the Enterprise tier is built and run. Where a point depends on the final contract, we say so and will put it in writing in the order form.
2. Architecture and data location
Read the whole document (4,284 characters)
| Question | Answer |
|---|---|
| Where does the brain run? | Inside Lindqvarn Retail's own Snowflake account. BB-Demo builds and operates it there, so your data is not copied into a BB-Demo-owned data store. |
| Which sources can be connected? | Systems such as Salesforce, HubSpot, Zendesk, Xero, Gong, Google Workspace, Dropbox, SharePoint and Slack. The connectors in scope are agreed per customer in the order form. |
| Can data be kept in a specific region? | Dedicated EU data residency is available as an add-on. We would confirm the exact arrangement for a Nordic retailer in the order form. |
| Who can see customer data on the BB-Demo side? | Only the engineers working on your implementation and support cases, and only through access you grant in your Snowflake account. You can withdraw that access at any time. |
3. Access control and identity
| Question | Answer |
|---|---|
| Is single sign-on supported? | Yes. Enterprise includes SSO. |
| Is automated user provisioning supported? | Yes. Enterprise includes SCIM, so joiners and leavers can follow your identity provider. |
| Can access be limited by team or role? | Yes. Users see only the content their role allows, and we would configure this with your IT team during implementation. |
| Are administrator actions recorded? | Administrative changes are logged. The short answer is yes; the longer answer is that the retention period of those logs is something I will confirm and put in writing. |
4. Data handling
| Question | Answer |
|---|---|
| Is data refreshed automatically? | Yes. A nightly refresh runs and completes by the start of the business day in your local time on business days, on every tier. |
| Is customer data used to train models for other customers? | No. The brain works over your data inside your own account, and that data is not pooled with other customers. |
| What happens at the end of the contract? | The brain sits in your Snowflake account, so the data remains yours. Removal of BB-Demo components and access is agreed as part of exit. |
| Can personal data in store feedback be excluded? | Yes. Fields can be excluded or masked at connector level. Please tell us which fields during design. |
5. Availability and support
| Question | Answer |
|---|---|
| What availability commitment applies? | The Enterprise service level, which is the highest of our three tiers. The order form states it. |
| What is the first-response commitment for urgent issues? | The Enterprise response time for the most urgent tickets, which is the fastest we offer. |
| Are service credits available? | Yes. On Enterprise, credits apply to availability and also to data freshness. |
| Is a named support engineer available? | Premium support is an optional add-on. It is not part of this questionnaire's baseline answers. |
6. Security review support
The Enterprise implementation includes security review support. In practice that means:
- a walkthrough of the architecture with your IT and security colleagues;
- written answers to any follow-up questions, checked internally before they are sent;
- a review of the connector list and the access you would grant.
7. Items we will confirm in writing
A few answers above depend on contract detail or on checks we want to do properly rather than from memory:
- The retention period for administrator logs.
- The exact EU residency arrangement, if Lindqvarn Retail takes that add-on.
- Any additional controls your own policies require beyond the standard Enterprise set.
I will send these as a short written addendum once your security team has confirmed which of them apply.
Thanks, Hannah
Unusual terms
Current to 9 Oct 26- Figures deferred to the order form
- Open items to be confirmed in a written addendum