Cairnlea Homes - Security Questionnaire
Documentfinal Cairnlea Homes: documents · security_questionnaire · final · 2024-12-30
A BB-Demo security questionnaire answer sheet for Cairnlea Homes, version 1, dated 30 Dec 2024, covering a Growth tier implementation. It states TLS 1.2 or higher in transit and a 4 business hour incident reporting commitment. It is not a contract and states no price.
What it says
What this says
Current to 11 Oct 26A BB-Demo security questionnaire answer sheet for Cairnlea Homes, version 1, dated 30 Dec 2024, covering a Growth tier implementation. It states TLS 1.2 or higher in transit and a 4 business hour incident reporting commitment. It is not a contract and states no price.
What it is: a vendor-completed control assessment, written by Hannah Lowe's side of BB-Demo, for the Growth tier implementation. Stored as final, and the text shows no draft marking.
Commits: incident reporting is promised "within 4 business hours" to the customer's nominated contact, with root-cause analysis and remediation tracking. Recovery uses a "24-hour recovery point objective", and data is encrypted in transit and at rest.
Unusual: it states SOC 2 Type II and GDPR compliance as assertions, and says BB-Demo keeps no separate audit logs. Support staff have no standing data access.
Not settled: it is not signed, names no customer signatory, and sets no availability, price or renewal terms. It is dated 30 Dec 2024 and the evidence does not show whether it has been refreshed since.
As found in this document
Current to 9 Oct 26- Incident responseSecurity incidents reported to your nominated contact within 4 business hours with root-cause analysis and remediation tracking.Security incidents reported to your nominated contact within 4 business hours with root-cause analysis and remediation tracking. · Source: object_read:doc_038_001
- Backup and recoveryRecovery environment maintained with 24-hour recovery point objective.Recovery environment maintained with 24-hour recovery point objective. · Source: object_read:doc_038_001
- Data in transitTLS 1.2 or higher for all data to and from Snowflake.TLS 1.2 or higher for all data to and from Snowflake. · Source: object_read:doc_038_001
The document
Body
Cairnlea Homes, Security Questionnaire
Version 1 · 30 December 2024
Assessment of security and compliance controls for Growth tier implementation.
Control assessment
| Question | Answer |
|---|---|
| Data in transit | TLS 1.2 or higher for all data to and from Snowflake. API authentication via OAuth 2.0. |
| Data at rest | Encrypted within your Snowflake account using Snowflake's native encryption. Customer-managed keys available on request. BB-Demo retains no copies outside Snowflake. |
| Access control | BB-Demo runs inside your Snowflake account. Access governed by your Snowflake roles and permissions. Support staff have no standing data access; access granted only for debugging with customer consent. |
| Audit logging | All queries and access logged in Snowflake's audit system. We do not maintain separate audit logs. |
| Authentication | Growth tier supports username/password and SSO via your identity provider. Passwords are salted and hashed; plaintext never stored. |
| Segregation of duties | Admins manage users and connectors. Query results restricted to authorised users. Data pipelines run under restricted Snowflake roles with no human r |
Read the whole document (1,786 characters)
ead access. | | Backup and recovery | Handled by Snowflake. Recovery environment maintained with 24-hour recovery point objective. | | Compliance | SOC 2 Type II certified and GDPR-compliant. Data Protection Addendum available. | | Incident response | Security incidents reported to your nominated contact within 4 business hours with root-cause analysis and remediation tracking. |
Summary
BB-Demo meets the security and compliance standards expected for a Growth tier platform. We welcome discussion of any aspect of this assessment with your IT and compliance teams.
Unusual terms
Current to 9 Oct 26- No separate audit logs kept
- Customer-managed keys on request
- Support access only with customer consent